Function at 0x6bad3e50
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x6bb884c0]
mov qword [rsp + 0x48], rcx
cmp dword [rax], 0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x64], r9d
je 0x6bad44bb
mov rdi, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
lea rdx, str.Rerum_iste_ad_delectus_quas_expedita_hic_doloribus_quis_voluptatibus_dignissimos_soluta
lea rcx, str.ArdithWeber
call rdi
mov r14, qword [0x6bb884a0]
xor r9d, r9d
xor r8d, r8d
mov rax, qword [0x6bb882f0]
xor ecx, ecx
mov edx, dword [r14]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor edx, edx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call rax
mov r15, qword [0x6bb88690]
mov rax, qword [0x6bb87e80]
xor ecx, ecx
mov rsi, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov edx, dword [r15]
mov dword [rax], edx
xor edx, edx
call rsi
mov ecx, 0x70ff91e0
call fcn.6bad9930
mov rdx, qword [str.h__mz_aHV]
lea rcx, str.Dolorem_neque_tenetur
mov dword [rdx], eax
lea rdx, str.Neque_dolor_adipisci_et_ut_dolores_dolores_quia
call rdi
mov rbx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [str.32_]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87c80]
mov r13, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [0x6bb87cb0]
xor r9d, r9d
mov rbp, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
lea r8, str.AvisFahey
lea rdx, str.Nam_quisquam_non_architecto_eum_aut_soluta
mov dword [rax], 0x443df67e
lea rcx, str.Non_quam_laudantium_aperiam_iure_omnis_rerum_tenetur_unde_dignissimos_sit
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
xor r9d, r9d
lea r8, str.IsabelleNienow
lea rdx, str.BeverlyBoyer
mov qword [rsp + 0x28], 0
lea rcx, str.Distinctio_consectetur_est_occaecati_cum
mov qword [rsp + 0x20], 0
call rbp
mov r12, qword [0x6bb88590]
mov ecx, dword [r12]
call fcn.6bad9930
mov rdx, qword [0x6bb88660]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
mov qword [rsp + 0x40], rax
call rax
mov r11, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], r11
call r11
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb88380]
mov rcx, qword [0x6bb883b0]
xor edx, edx
mov dword [rax], 0xec4c9ffb
mov rax, qword [0x6bb87d00]
mov dword [rax], 0x5bb239ce
mov rax, qword [0x6bb88280]
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [0x6bb885d0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [r15]
call fcn.6bad9930
mov rdx, qword [0x6bb87e50]
lea rcx, str.Ipsam_sed_neque_quis_blanditiis_aperiam
mov dword [rdx], eax
lea rdx, str.Nisi_eveniet_et_sed
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov r12, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ItzelAnkunding
call r12
mov rax, qword [0x6bb88710]
mov ecx, dword [rax]
call fcn.6bad9930
xor edx, edx
xor ecx, ecx
mov dword [r14], eax
call rsi
mov rax, qword [0x6bb87dd0]
xor r8d, r8d
xor edx, edx
mov r10, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
mov dword [rax], 0xe0fd916c
mov rax, qword [0x6bb87c30]
mov qword [rsp + 0x70], r10
mov dword [rax], 0x7ba8d6f2
call r10
mov r15, qword [0x6bb87d90]
mov ecx, dword [r15]
call fcn.6bad9930
mov rdx, qword [0x6bb883d0]
mov ecx, 0x4022e1b1
mov dword [rdx], eax
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb88720]
mov r14, qword [0x6bb88020]
mov dword [rdx], eax
mov rax, qword [0x6bb880c0]
xor edx, edx
mov eax, dword [rax]
mov dword [r14], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], 0
call rax
mov ecx, 0x85a35b4f
call fcn.6bad9930
mov rdx, qword [0x6bb88340]
mov ecx, 0xe6bc81
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb886e0]
mov ecx, 0xefb6d421
mov dword [rdx], eax
mov eax, dword [r15]
mov dword [r14], eax
mov rax, qword [0x6bb88330]
mov dword [rax], 0xf5f0a750
call fcn.6bad9930
mov rcx, qword [0x6bb88400]
mov dword [rcx], eax
mov ecx, 0x73fbd54c
call fcn.6bad9930
mov rcx, qword [0x6bb883b0]
mov r15, qword [0x6bb880d0]
xor edx, edx
mov dword [rcx], eax
mov rax, qword [0x6bb886f0]
lea rcx, str.Dolorem_beatae_ipsam_repudiandae_officia_nobis
mov dword [r15], 0x198b934a
mov dword [rax], 0x18d11fb2
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov ecx, 0xa4bb32db
call fcn.6bad9930
mov rcx, qword [0x6bb88710]
mov dword [rcx], eax
mov rax, qword [0x6bb884b0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb880b0]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rax, qword [0x6bb88260]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov edx, dword [rax]
mov rax, qword [0x6bb87fe0]
mov dword [rax], edx
mov rax, qword [0x6bb88040]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x9a2ea4c8
call r14
lea rdx, str.Qui_animi_magnam_laudantium_velit_et
lea rcx, str.Et_et_non
call rdi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor edx, edx
xor ecx, ecx
call rsi
mov ecx, 0x3c966e66
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb88620]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [0x6bb87dc0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87df0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb88470]
xor edx, edx
mov dword [rax], 0x65de3bde
mov rax, qword [0x6bb88400]
mov eax, dword [rax]
mov dword [r15], eax
call rbx
mov rax, qword [0x6bb88550]
mov r11, qword [rsp + 0x78]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb88360]
mov dword [rax], edx
xor edx, edx
call r11
lea rdx, str.Consequuntur_et_reiciendis
lea rcx, str.Sit_totam_quis
call rdi
mov ecx, 0x74af7cf8
call fcn.6bad9930
mov rdx, qword [0x6bb87fb0]
mov ecx, 0x2d77cb5e
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb87e40]
mov ecx, 0x125fdf88
mov dword [rdx], eax
mov rax, qword [0x6bb87e60]
mov edx, dword [rax]
mov rax, qword [0x6bb88680]
mov dword [rax], edx
call fcn.6bad9930
mov rdx, qword [0x6bb87bb0]
xor ecx, ecx
mov dword [rdx], eax
call r13
xor r9d, r9d
lea r8, str.GwenHarber
lea rdx, str.LizaMraz
mov qword [rsp + 0x28], 0
lea rcx, str.Nemo_iste_et_voluptatem_beatae_facere
mov qword [rsp + 0x20], 0
call rbp
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb886f0]
lea rcx, str.BenedictHaley
mov edx, dword [rax]
mov rax, qword [0x6bb87c50]
mov dword [rax], edx
mov rax, qword [0x6bb883b0]
mov edx, dword [rax]
mov rax, qword [0x6bb88110]
mov dword [rax], edx
lea rdx, str.BusterToySr
call rdi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x6bb87c30]
mov edx, dword [rax]
mov rax, qword [0x6bb87cc0]
mov dword [rax], edx
mov rax, qword [0x6bb87d40]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88450]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov r10, qword [rsp + 0x70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [0x6bb880e0]
mov dword [rax], 0xf7f889c3
mov rax, qword [0x6bb87c20]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb88080]
mov rdx, qword [0x6bb88520]
mov ecx, dword [rdi]
mov dword [rdx], eax
mov rax, qword [0x6bb88120]
mov dword [rax], 0xd3b6bda
call fcn.6bad9930
mov rdx, qword [0x6bb87e00]
xor r9d, r9d
lea r8, str.Error_sint_perspiciatis_sequi_velit
lea rcx, str.AdeleRippin
mov dword [rdx], eax
lea rdx, str.Magnam_dolores_illo_nulla_aliquam_sunt_modi_labore
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
xor edx, edx
xor ecx, ecx
call rsi
mov ecx, 0xfb3ce832
call fcn.6bad9930
mov rdx, qword [0x6bb87ee0]
mov dword [rdi], 0xcdf7b382
mov dword [rdx], eax
mov rax, qword [0x6bb880b0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rsi, qword [0x6bb87fd0]
lea rcx, str.JoanTorphy
mov dword [rsi], eax
call r12
xor edx, edx
xor ecx, ecx
mov dword [rdi], 0x7e247f90
call rbx
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x6bb87cf0]
lea rcx, str.Provident_esse_architecto_atque_libero_quia_ea_officiis_quia_nesciunt_magni_ratione
mov edx, dword [rax]
mov rax, qword [0x6bb88670]
mov dword [rax], edx
mov rax, qword [0x6bb87ea0]
mov eax, dword [rax]
mov dword [rsi], eax
call r12
mov rax, qword [0x6bb87ba0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87c90]
mov dword [rdx], eax
lea rdx, str.VirtualProtectEx
lea rcx, str.kernel32.dll
call fcn.6bad103b
mov rbx, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0xf0], rbx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax