Function at 0x6bad3b8d
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x6bb85d20]
cmp dword [rax], 0
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb0], r8d
mov qword [rsp + 0xb8], r9
je 0x6bad4267
mov ecx, 0x1a67fe0e
call fcn.6bad7ff0
mov rdx, qword [0x6bb85e30]
mov ecx, 0xcd1d9b0e
mov dword [rdx], eax
mov rax, qword [0x6bb85f70]
mov dword [rax], 0xd4b85873
call fcn.6bad7ff0
mov rsi, qword [0x6bb85310]
mov ecx, 0xa9419a28
mov dword [rsi], eax
call fcn.6bad7ff0
mov rbx, qword [0x6bb85590]
mov r15, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Suscipit_vero_aliquid_quisquam_sint_eum_non_sit
mov dword [rbx], eax
call r15
mov ecx, dword [rbx]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85aa0]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85310]
mov edx, dword [rax]
mov rax, qword [str.sYEMr]
mov dword [rax], edx
xor edx, edx
call rsi
mov r12, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r12
mov rax, qword [0x6bb85440]
xor ecx, ecx
mov rdi, qword [0x6bb85450]
mov rbx, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.Veritatis_voluptatibus_ad_vel_nobis_sapiente_hic_ex_maiores_nobis_dolorum
mov eax, dword [rax]
mov dword [rdi], eax
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call rdi
mov r10, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.OcieKessler
mov qword [rsp + 0x40], r10
call r10
mov rax, qword [0x6bb85fd0]
mov edx, dword [rax]
mov rax, qword [0x6bb85820]
mov dword [rax], edx
mov rax, qword [0x6bb85740]
mov dword [rax], 0x2c28a91d
mov rax, qword [0x6bb85680]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85340]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov ecx, 0xa21614db
call fcn.6bad7ff0
mov rdx, qword [0x6bb85fa0]
mov ecx, 0x89e45d18
mov dword [rdx], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb85390]
lea rcx, str.Aut_aliquam_sit_eos_aut_quia_vitae
mov dword [rdx], eax
call r15
mov rax, qword [0x6bb85580]
mov ecx, 0x3cbfae5d
mov dword [rax], 0x4acb17cc
call fcn.6bad7ff0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb857c0]
mov r14, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call r14
xor edx, edx
xor ecx, ecx
call rsi
xor ecx, ecx
lea rdx, str.Quod_dolores_sit_delectus_quae_atque
call rbx
lea rdx, str.JaylonOKeefe
xor ecx, ecx
call rbx
xor ecx, ecx
call rdi
mov ecx, 0x283d362b
call fcn.6bad7ff0
mov rdx, qword [0x6bb85b70]
mov rbp, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov qword [rsp + 0x38], rax
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r14
mov rax, qword [0x6bb853b0]
xor ecx, ecx
mov dword [rax], 0xe21aba99
call r12
mov rax, qword [0x6bb85600]
mov ecx, 0x1826999e
mov dword [rax], 0x24093246
call fcn.6bad7ff0
mov rdx, qword [0x6bb854b0]
mov dword [rdx], eax
mov rax, qword [0x6bb85da0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85300]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Et_minima_et_reiciendis_temporibus
call rbx
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb85690]
mov r13, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.HudsonSpinkaMD
mov dword [rax], 0x627a6552
call r13
mov rax, qword [0x6bb85560]
lea rcx, str.Sed_et_quo
mov dword [rax], 0x7abc1ab6
call r15
xor ecx, ecx
call r12
mov ecx, 0xcd044d4
call fcn.6bad7ff0
mov rcx, qword [0x6bb85840]
lea rdx, str.JacksonWisoky
mov dword [rcx], eax
xor ecx, ecx
call rbx
mov rax, qword [0x6bb85920]
mov rcx, qword [0x6bb85f60]
mov edx, dword [rax]
mov rax, qword [0x6bb85860]
mov dword [rax], edx
mov rax, qword [0x6bb85c20]
mov dword [rax], 0xeb27b35
mov rax, qword [0x6bb85b30]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb85ee0]
mov dword [rax], 0x23179bab
mov rax, qword [0x6bb85ae0]
mov edx, dword [rax]
mov rax, qword [0x6bb856f0]
mov dword [rax], edx
mov rax, qword [0x6bb85570]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85c80]
xor ecx, ecx
mov dword [rdx], eax
call rdi
lea rcx, str.Architecto_id_aut
call r15
mov rax, qword [0x6bb85b10]
mov dword [rax], 0xecc2500a
mov rax, qword [0x6bb85840]
mov ecx, dword [rax]
call fcn.6bad7ff0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb85450]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call r14
mov rax, qword [0x6bb85800]
xor ecx, ecx
mov dword [rax], 0xdf32c31a
mov rax, qword [rsp + 0x38]
call rax
mov r11, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.DrAverySchaeferDVM
lea rcx, str.GustHarris
mov qword [rsp + 0x48], r11
call r11
mov rax, qword [0x6bb85600]
xor edx, edx
xor ecx, ecx
mov r10, qword [rsp + 0x40]
lea r8, str.RicardoArmstrong
mov dword [rax], 0xa42f2051
call r10
mov ecx, 0xee2f455b
call fcn.6bad7ff0
mov rdx, qword [0x6bb86050]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Qui_nihil_modi_harum_eveniet_ullam_reprehenderit
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb857e0]
mov rcx, qword [0x6bb85f60]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb85b20]
lea rcx, str.Omnis_enim_dolores_ut
mov dword [rax], 0xb6def25d
call r15
mov rax, qword [0x6bb85fc0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85700]
lea rcx, str.JefferyThompson
mov dword [rdx], eax
mov rax, qword [0x6bb85dd0]
mov rdx, qword [0x6bb86020]
mov eax, dword [rax]
mov dword [rdx], eax
call r13
lea rcx, str.ProfOriePadbergJr
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r14
mov rax, qword [0x6bb856a0]
mov rcx, qword [0x6bb855b0]
mov edx, dword [rax]
mov rax, qword [0x6bb85710]
mov dword [rax], edx
mov rax, qword [0x6bb85f90]
mov dword [rax], 0x15a9ca70
mov rax, qword [0x6bb85f30]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rdi
mov r11, qword [rsp + 0x48]
lea rdx, str.Consequuntur_voluptates_adipisci_quibusdam_eum_ipsa
lea rcx, str.MsLonieOKonMD
call r11
mov r10, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
lea r8, str.Quia_et_ab_dolor_consequuntur_pariatur
call r10
mov rax, qword [0x6bb85f00]
mov edx, dword [rax]
mov rax, qword [0x6bb857b0]
mov dword [rax], edx
mov rax, qword [0x6bb854d0]
mov rdx, qword [0x6bb85580]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb85ad0]
mov dword [rax], 0x40c870f4
mov rax, qword [0x6bb85420]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85d90]
lea rcx, str.Et_id_optio_ea_maxime_ut_qui_vel_qui_sint_numquam_eaque
mov dword [rdx], eax
call r13
mov rax, qword [0x6bb85330]
mov r14, qword [0x6bb85770]
mov dword [rax], 0xc22c9628
mov rax, qword [str.qCeHV]
mov ecx, dword [r14]
mov dword [rax], 0xcf8d5c03
mov rax, qword [0x6bb85e50]
mov dword [rax], 0x52780ba4
call fcn.6bad7ff0
mov rdx, qword [0x6bb85cb0]
xor ecx, ecx
mov dword [rdx], eax
call r12
mov rax, qword [0x6bb85c40]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov r15, qword [0x6bb85360]
mov dword [r15], eax
mov rax, qword [0x6bb85f10]
mov edx, dword [rax]
mov rax, qword [0x6bb85460]
mov dword [rax], edx
mov rax, qword [0x6bb85490]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb856d0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
xor ecx, ecx
call rdi
mov rax, qword [0x6bb85bb0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85890]
mov dword [rax], edx
xor edx, edx
call rbp
mov ecx, 0x495f64b2
call fcn.6bad7ff0
mov rdx, qword [0x6bb85810]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
lea rcx, str.Aut_et_dolore_ut_totam_nostrum_consequatur
call r13
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb853b0]
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov dword [r14], eax
call rbp
mov rax, qword [0x6bb85640]
mov edx, dword [rax]
mov rax, qword [0x6bb85a60]
mov dword [rax], edx
mov rax, qword [0x6bb86020]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rbp, qword [0x6bb853a0]
mov rcx, qword [0x6bb85310]
mov dword [r14], eax
mov eax, dword [rbp]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x6bb855b0]
mov ecx, 0x8eb82a8e
mov dword [r15], 0x1073359f
mov dword [rax], 0x2d4f0865
mov rax, qword [0x6bb85d70]
mov edx, dword [rax]
mov rax, qword [0x6bb85cd0]
mov dword [rax], edx
mov rdx, qword [0x6bb85840]
mov eax, dword [rbp]
mov dword [rdx], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb855e0]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x6bb85930]
lea rdx, str.Vel_sequi_officia_nemo_mollitia_et
xor ecx, ecx
mov dword [rax], 0x43f8ea81
call rbx
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call fcn.6bad3668
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret