Function at 0x6bad2908
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [0x6bb884c0]
cmp dword [rax], 0x3fad
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0xd8], r9
jle 0x6bad3308
mov rax, qword [0x6bb87d40]
mov dword [rax], 0x67d21ac0
mov rax, qword [0x6bb88340]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb886f0]
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x6bb87ea0]
mov dword [rax], 0xbed39ec9
mov rax, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov qword [rsp + 0x48], rax
call rax
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
call rbp
mov ecx, 0x64721b55
call fcn.6bad9930
mov rbx, qword [0x6bb87bc0]
mov r15, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov dword [rbx], eax
call r15
mov rdi, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb87d80]
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [0x6bb88240]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb880f0]
mov dword [rsi], 0xbe0abbc9
mov dword [rax], edx
mov rax, qword [0x6bb88060]
xor edx, edx
mov dword [rax], 0x92fbaf85
mov qword [rsp + 0x20], 0
call rdi
mov rax, qword [0x6bb87f40]
mov ecx, dword [rax]
call fcn.6bad9930
mov rbx, qword [0x6bb88030]
xor edx, edx
lea rcx, str.RoderickHowell
mov dword [rbx], eax
mov rax, qword [0x6bb87da0]
mov rbx, qword [0x6bb883c0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb87ef0]
mov rbx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov dword [rax], 0x67c8d90
call rbx
mov rax, qword [0x6bb88630]
xor ecx, ecx
mov dword [rax], 0x8c273afb
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rdi
mov ecx, 0x7c11eaf3
call fcn.6bad9930
mov rdx, qword [0x6bb88250]
mov dword [rdx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov r11, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], r11
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov r14, qword [0x6bb88690]
mov rax, qword [0x6bb87c20]
mov dword [rsi], 0x7d0e7d56
mov r12, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.JalonDaniel
mov edx, dword [r14]
mov dword [rax], edx
mov rax, qword [0x6bb88330]
mov edx, dword [rax]
mov rax, qword [0x6bb88540]
mov dword [rax], edx
mov rax, qword [0x6bb87ec0]
mov edx, dword [rax]
mov rax, qword [0x6bb87c40]
mov dword [rax], edx
call r12
mov rax, qword [0x6bb884f0]
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rax], 0xa85fc9dc
mov rax, qword [0x6bb87d00]
mov dword [rax], 0x80b0bda0
call rbp
xor edx, edx
lea rcx, str.Non_facilis_amet_iure
call rbx
mov rsi, qword [0x6bb87ed0]
mov rax, qword [0x6bb88050]
xor edx, edx
lea rcx, str.YasminCasperIII
mov dword [rsi], 0x8052010d
mov dword [rax], 0x31be6584
call rbx
mov ecx, 0x1a519bc2
call fcn.6bad9930
mov rdx, qword [0x6bb882a0]
mov ecx, 0x27dc6cb2
mov dword [rdx], eax
mov rax, qword [0x6bb88030]
mov edx, dword [rax]
mov rax, qword [0x6bb87f30]
mov dword [rax], edx
call fcn.6bad9930
mov rdx, qword [0x6bb87e80]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [str.h__mz_aHV]
mov dword [rax], 0x1e097866
mov rax, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x6bb87d40]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x6bb87bb0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rdi
mov rax, qword [0x6bb87ca0]
mov rcx, qword [0x6bb87f50]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r15
mov ecx, 0x1d5a2984
call fcn.6bad9930
mov ecx, 0x5a14ab54
mov dword [rsi], eax
call fcn.6bad9930
mov rcx, qword [0x6bb87ea0]
mov dword [rcx], eax
mov rax, qword [0x6bb87c10]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87d90]
mov rcx, qword [0x6bb87e10]
mov dword [rdx], eax
mov rax, qword [0x6bb886f0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb883f0]
xor ecx, ecx
mov dword [rax], 0xa2639ed7
mov rax, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x6bb88450]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88110]
mov dword [rdx], eax
mov rax, qword [0x6bb88720]
mov dword [rax], 0x7a2dffd3
mov rax, qword [0x6bb87f80]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb882f0]
mov dword [r14], eax
mov rax, qword [0x6bb87e00]
mov eax, dword [rax]
mov dword [rcx], eax
mov ecx, 0x22b670d7
call fcn.6bad9930
mov rdx, qword [0x6bb885c0]
xor ecx, ecx
mov dword [rdx], eax
call r15
lea rcx, str.Occaecati_dolores_maiores_sit_voluptatem_nostrum_officia_at
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rdi
mov rax, qword [0x6bb87c00]
mov rdx, qword [0x6bb88300]
mov ecx, dword [rsi]
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb87d50]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x50]
call rax
xor r9d, r9d
lea r8, str.Voluptates_repudiandae_placeat_eveniet_consequatur_est_voluptatem_natus_facere_veritatis_commodi_ducimus
mov r14, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
lea rdx, str.CelestineBatzV
lea rcx, str.LeeProsacco
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
mov rax, qword [0x6bb882f0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rsi, qword [0x6bb87e10]
mov r12, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.MozelleHilpert
lea rcx, str.GabeBotsfordI
mov dword [rsi], eax
mov rax, qword [0x6bb87fb0]
mov dword [rax], 0x8e70bd63
call r12
mov rax, qword [0x6bb87e60]
lea rdx, str.Quod_necessitatibus_illo_et_voluptas
lea rcx, str.AllanLangosh
mov dword [rax], 0x976bd0b8
mov rax, qword [0x6bb88220]
mov dword [rax], 0xcf084832
call r12
xor edx, edx
xor ecx, ecx
call r13
mov r10, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], r10
call r10
mov rsi, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
lea rdx, str.Voluptatem_adipisci_cupiditate_et_hic_incidunt_tenetur_veritatis_nemo_sed_tenetur_dolor_soluta
lea rcx, str.Magnam_numquam_magnam_facilis_quo
call rsi
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb88720]
mov dword [rax], 0x857c1f6e
mov rax, qword [0x6bb88360]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb882c0]
lea rcx, str.PatsyHintzII
mov dword [rdx], eax
mov rax, qword [0x6bb87e10]
lea rdx, str.Veniam_eius_facere_distinctio_fugit
mov dword [rax], 0x589674aa
mov rax, qword [0x6bb886b0]
mov dword [rax], 0xec8c82b0
call rsi
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
lea rcx, str.DrRachelleWisozkSr
call rbx
xor ecx, ecx
call r15
lea rdx, str.Quae_soluta_inventore_et_possimus_aut_cum
lea rcx, str.MsOttilieBraunJr
call rsi
xor r9d, r9d
lea r8, str.Aut_ex_vel_eos_totam_totam
lea rdx, str.Voluptas_quidem_incidunt_quod_quia
mov qword [rsp + 0x28], 0
lea rcx, str.ZitaSwaniawski
mov qword [rsp + 0x20], 0
call r14
mov ecx, 0xaadae205
call fcn.6bad9930
mov rdx, qword [0x6bb880e0]
lea rcx, str.DangeloHarvey
mov dword [rdx], eax
mov rax, qword [0x6bb87f10]
lea rdx, str.Est_unde_aut
mov dword [rax], 0x7c4c7f73
call rsi
xor edx, edx
lea rcx, str.Voluptatibus_et_dolor_pariatur
call rbx
mov rax, qword [0x6bb886f0]
mov ecx, 0x3c6f64d3
mov dword [rax], 0xc709e039
mov rax, qword [0x6bb87e60]
mov edx, dword [rax]
mov rax, qword [0x6bb883e0]
mov dword [rax], edx
call fcn.6bad9930
mov rdx, qword [0x6bb88670]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb882f0]
mov edx, dword [rax]
mov rax, qword [0x6bb885d0]
mov dword [rax], edx
call r15
mov rax, qword [0x6bb87ee0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb88020]
mov dword [rcx], eax
mov rax, qword [0x6bb87d40]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87f40]
xor r9d, r9d
lea r8, str.Et_adipisci_quidem_repellendus_vel_qui_neque_assumenda
lea rcx, str.ProfXavierKovacekDDS
mov dword [rdx], eax
mov rax, qword [0x6bb880c0]
lea rdx, str.WadeEmmerich
mov dword [rax], 0xd802f25e
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb883c0]
mov rcx, qword [0x6bb88270]
xor r9d, r9d
lea r8, str.RosendoOKeefe
mov dword [rax], 0x27eb81ad
mov rax, qword [0x6bb87f90]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb87cd0]
lea rcx, str.AlysaBorer
mov edx, dword [rax]
mov rax, qword [0x6bb886e0]
mov dword [rax], edx
lea rdx, str.GlennaLubowitz
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
mov ecx, 0x18251171
call fcn.6bad9930
mov rdx, qword [0x6bb88490]
lea rcx, str.Qui_et_eos_libero_possimus_expedita_ratione_ab_voluptates_nulla_ipsa_voluptates
mov dword [rdx], eax
lea rdx, str.ProfAdeleSchimmel
call rsi
lea rdx, str.SusanaBlanda
lea rcx, str.Veniam_sequi_cupiditate_quibusdam_earum
call r12
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
lea rdx, str.DrVirgilChristiansen
lea rcx, str.Velit_et_iure_dolor_vel_id_sint_provident
call rsi
xor r9d, r9d
lea r8, str.JazlynLittel
lea rdx, str.Et_itaque_ex_qui_sit_sunt_dolorum_porro_veniam_incidunt_ut_amet
mov qword [rsp + 0x28], 0
lea rcx, str.Ea_enim_et_sit_ea_quae_assumenda_nostrum_unde_dolorum
mov qword [rsp + 0x20], 0
call r14
mov rax, qword [0x6bb88680]
mov ecx, 0x9f43056a
mov dword [rax], 0x20883746
call fcn.6bad9930
mov rdx, qword [0x6bb87bc0]
mov ecx, 0x8578fa0
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb87f00]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb87e10]
xor edx, edx
mov dword [rax], 0x508a4d26
call r13
lea rdx, str.MsKatelinJacobsJr
lea rcx, str.Et_fuga_porro_molestiae_enim
call r12
mov rax, qword [0x6bb87ba0]
mov ecx, 0x66fa995d
mov dword [rax], 0x8631817b
call fcn.6bad9930
mov rcx, qword [0x6bb87ef0]
xor edx, edx
mov dword [rcx], eax
xor ecx, ecx
call rbp
mov rax, qword [0x6bb87ff0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87d70]
lea rcx, str.Aperiam_illo_qui_accusantium_nihil_occaecati
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x6bb884b0]
mov r14, qword [0x6bb883a0]
mov edx, dword [rax]
mov rax, qword [0x6bb88580]
mov dword [r14], 0xb6f2d7bf
mov dword [rax], edx
mov rax, qword [0x6bb88410]
mov ecx, dword [rax]
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb87cd0]
mov dword [rdx], eax
mov rax, qword [0x6bb87d20]
xor edx, edx
mov dword [rax], 0x2a373673
mov qword [rsp + 0x20], 0
call rdi
mov rax, qword [0x6bb87ee0]
lea rdx, str.EnaKihn
lea rcx, str.Amet_repellat_magnam_libero_ut
mov dword [rax], 0x2f7aee70
call r12
xor edx, edx
mov r10, qword [rsp + 0x60]
xor ecx, ecx
call r10
mov rax, qword [0x6bb87f50]
xor edx, edx
mov rdi, qword [0x6bb87bb0]
lea rcx, str.JavonteSatterfield
mov eax, dword [rax]
mov dword [rdi], eax
call rbx
mov edx, dword [r14]
mov rax, qword [0x6bb88290]
xor ecx, ecx
mov dword [rax], edx
xor edx, edx
call r13
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb88550]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xd61b5adb
mov rax, qword [0x6bb88020]
mov dword [rax], 0x247f66bc
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x6bb87fa0]
mov rdi, qword [0x6bb87e00]
xor ecx, ecx
mov dword [rax], 0xa1f44366
mov rax, qword [0x6bb88050]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x6bb88000]
mov edx, dword [rax]
mov rax, qword [0x6bb880d0]
mov dword [rax], edx
xor edx, edx
call r13
mov r11, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r11
mov rax, qword [0x6bb87bb0]
lea rdx, str.Dolor_numquam_soluta
lea rcx, str.MrChaimWard
mov dword [rax], 0xc933a38f
mov rax, qword [0x6bb88110]
mov dword [rax], 0xa53b3a1b
call r12
mov rax, qword [0x6bb87d60]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x5e97b75d
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call r15
xor edx, edx
xor ecx, ecx
call rbp
lea rdx, str.Maxime_modi_dignissimos_fugit_natus_expedita_quis_ullam_odio_magni_ad
lea rcx, str.A_et_fuga
call rsi
mov rax, qword [0x6bb88300]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88320]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb87e50]
mov dword [rax], 0x97890e9b
mov rax, qword [rsp + 0x48]
call rax
xor edx, edx
lea rcx, str.Magni_soluta_officia_earum
call rbx
mov rax, qword [0x6bb88270]
mov edx, dword [rax]
mov rax, qword [0x6bb88280]
mov dword [rax], edx
mov rax, qword [0x6bb88220]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87cc0]
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
mov rcx, rax
mov rax, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
call fcn.6bad210c
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret