Function at 0x6bad38eb
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x6bb884c0]
cmp dword [rax], 0
mov qword [rsp + 0xa0], rcx
mov r13d, r8d
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb8], r9d
je 0x6bad3e13
mov r12, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call r12
mov r8, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.ProfLawsonGradyDDS
lea rcx, str.LinneaZulaufPhD
mov qword [rsp + 0x38], r8
call r8
mov rax, qword [0x6bb87e30]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb882f0]
mov rdi, qword [0x6bb88370]
lea rcx, str.DrNewellGusikowski
mov rsi, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [rdx], eax
mov rax, qword [0x6bb88430]
mov edx, dword [rax]
mov rax, qword [0x6bb88600]
mov dword [rax], edx
mov rax, qword [0x6bb88390]
lea rdx, str.LeopoldDibbert
mov eax, dword [rax]
mov dword [rdi], eax
call rsi
mov rax, qword [0x6bb87e00]
mov rbx, qword [0x6bb883b0]
lea rcx, str.RubieSchmittDVM
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb88660]
mov edx, dword [rax]
mov rax, qword [0x6bb88510]
mov dword [rax], edx
mov rax, qword [0x6bb88220]
lea rdx, str.LesleyChristiansen
mov dword [rax], 0x38db1f51
call rsi
mov rax, qword [0x6bb88270]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x39e1c27b
mov rax, qword [0x6bb88670]
mov dword [rax], 0xba2149d3
mov rax, qword [0x6bb87f00]
mov dword [rax], 0x8b8d9aeb
mov rax, qword [0x6bb87cf0]
mov dword [rax], 0xa6d07c9b
mov rax, qword [0x6bb88240]
mov dword [rax], 0xe67a08ff
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
mov rbx, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
call rbx
mov ecx, 0xaf5f1622
call fcn.6bad9930
mov rdi, qword [0x6bb88380]
mov r14, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rdi], eax
call r14
lea rcx, str.ClemmieHansen
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call rbp
mov ecx, 0x342e6a
call fcn.6bad9930
mov rdx, qword [0x6bb88140]
mov ecx, 0xb0e0f945
mov dword [rdx], eax
mov rax, qword [0x6bb885e0]
mov dword [rax], 0x6bcfb162
call fcn.6bad9930
mov rdx, qword [0x6bb87e10]
mov ecx, 0x5552eab6
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb88040]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x6bb88590]
mov rdi, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov dword [rax], 0xd6a818bf
call rdi
mov rax, qword [0x6bb87c90]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xb5ea7780
call rbx
mov ecx, 0xa032dc5c
call fcn.6bad9930
mov rdx, qword [0x6bb87f90]
lea rcx, str.Repudiandae_blanditiis_aut_libero_in_voluptas_veritatis_eos_velit
mov dword [rdx], eax
mov rax, qword [0x6bb88550]
mov dword [rax], 0xb2ad9da6
mov rax, qword [0x6bb88620]
mov edx, dword [rax]
mov rax, qword [0x6bb87f40]
mov dword [rax], edx
mov rax, qword [0x6bb88520]
mov edx, dword [rax]
mov rax, qword [0x6bb87c10]
mov dword [rax], edx
lea rdx, str.Quia_perspiciatis_qui_nulla
call rsi
mov rax, qword [0x6bb88090]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87d60]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call rdi
mov rax, qword [0x6bb87c70]
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov dword [rax], 0x73ed4e27
call r15
mov rax, qword [0x6bb88010]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb88290]
mov dword [rax], edx
call r14
mov r8, qword [rsp + 0x38]
lea rdx, str.Facilis_aut_sint_odio_suscipit_minus
lea rcx, str.MyrtieThiel
call r8
mov r11, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x48], r11
call r11
mov r10, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
xor r9d, r9d
lea r8, str.Deserunt_necessitatibus_quam_sunt_provident_iusto_sunt_eveniet_nobis_qui_reprehenderit
lea rdx, str.Alias_quibusdam_expedita_est
lea rcx, str.MsTaraLeschDVM
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x20], 0
call r10
lea rdx, str.OlinMcClureMD
lea rcx, str.Tenetur_in_excepturi_totam_aut_temporibus_delectus_et_voluptas_magni_nesciunt_molestiae_et_minus
call rsi
mov ecx, 0xd921616a
call fcn.6bad9930
mov rdx, qword [0x6bb884f0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov r9, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], r9
call r9
mov rax, qword [0x6bb880c0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88730]
mov rcx, qword [0x6bb88380]
mov dword [rdx], eax
mov rax, qword [0x6bb87fb0]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb88270]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88320]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
xor edx, edx
lea rcx, str.TellyDibbert
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov r11, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call r11
mov ecx, 0xe5fdcd1
call fcn.6bad9930
mov rdx, qword [0x6bb87eb0]
lea rcx, str.Quae_quod_quia_qui_sit_amet_nulla
mov dword [rdx], eax
lea rdx, str.Dolores_molestiae_illum_libero_ipsum_voluptatum
call rsi
mov rax, qword [0x6bb87d30]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87bc0]
mov dword [rax], edx
call rbp
mov rax, qword [0x6bb88660]
mov rsi, qword [0x6bb885e0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x6bb884a0]
mov dword [rax], 0xf23c86de
call r14
xor ecx, ecx
call rbp
mov rax, qword [0x6bb885e0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb882d0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r12
mov ecx, 0xd067ed20
call fcn.6bad9930
mov rdx, qword [0x6bb87d00]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x6bb87e80]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87cb0]
mov dword [rax], edx
mov rax, qword [0x6bb88370]
mov dword [rax], 0x4ff91f12
call rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r9, qword [rsp + 0x38]
call r9
xor r9d, r9d
mov r10, qword [rsp + 0x40]
lea r8, str.Exercitationem_possimus_ut_qui_hic_eum_odio_fuga
lea rdx, str.Sunt_dolore_voluptas_corporis_neque_consectetur_quo_nesciunt
lea rcx, str.Velit_omnis_incidunt_rerum_sint_quos_esse
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r10
mov rax, qword [0x6bb883b0]
mov edx, dword [rax]
mov rax, qword [0x6bb87e50]
mov dword [rax], edx
mov rax, qword [0x6bb87be0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88500]
mov dword [rdx], eax
mov rax, qword [0x6bb87bb0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87fa0]
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb88640]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb885b0]
mov dword [rax], edx
xor edx, edx
call r12
mov ecx, 0xdd5e7761
call fcn.6bad9930
mov rdx, qword [0x6bb87dd0]
xor ecx, ecx
mov dword [rdx], eax
call rbp
xor ecx, ecx
call rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
mov r9d, r13d
mov rcx, rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
call fcn.6bad3365
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret