Function at 0x6bad5c48
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [0x6bb7ad60], 0x4c3b
jle 0x6bad6291
mov eax, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov dword [esp + 4], str.Enim_et_eum_sapiente
mov dword [0x6bb7afc8], 0x5daf7bde
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call eax
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.ProfJeanieBlanda
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7af20]
push edx
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7afc4], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [esp], 0
mov dword [ebp - 0x28], eax
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [str.qCeHV], 0xf4c1dec
push ecx
push ecx
mov dword [esp], str.Quis_et_maxime_repellat_laudantium_voluptatem_ipsam_non_quod
call ebx
mov eax, dword [0x6bb7af40]
push esi
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7af18], eax
mov eax, dword [0x6bb7b014]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af10], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x2c], eax
call eax
push edi
mov dword [esp], 0x49715bea
call fcn.6badcbb4
mov edi, dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [esp + 4], 0
mov dword [0x6bb7af0c], eax
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [0x6bb7af04]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af08], eax
mov eax, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [ebp - 0x20], eax
call eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
push eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0x24], eax
mov dword [esp + 4], str.Et_perspiciatis_et_incidunt_nisi
mov dword [esp], str.KathleenGerhold
call eax
push eax
push eax
mov dword [esp], str.Omnis_recusandae_quis_quas_harum_repellendus_asperiores_accusantium_eum_nesciunt_asperiores_doloremque
call ebx
push edx
mov dword [esp], 0xacbe79cd
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b00c], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [0x6bb7afd8]
push ecx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af6c], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [ebp - 0x24]
push esi
mov dword [esp + 4], str.ProfAdelleLemke
mov dword [esp], str.Non_qui_molestiae_fuga_iure_nihil_aperiam_impedit_quae
call eax
push eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], str.DrAmosWaelchi
mov dword [esp], str.MissSandrineHegmannDVM
call eax
push eax
push eax
mov dword [esp], str.Molestiae_ipsa_dicta_nisi_ut
call ebx
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x1c]
sub esp, 0x14
mov dword [esp + 4], str.DexterEmmerich
mov dword [esp], 0
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x6bb7afa4], 0xad471a27
push eax
push eax
mov dword [esp], str.PercivalHaneI
call ebx
push edx
mov dword [esp], str.BrendaStrosin
call ebx
mov eax, dword [ebp - 0x24]
push ecx
mov dword [esp + 4], str.ChaimKoelpin
mov dword [esp], str.JohnathonBashirian
call eax
push eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
push eax
push eax
mov dword [esp + 8], str.AdaBecker
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0xc
mov dword [esp], str.ProfBirdieBorer
call ebx
push eax
mov dword [esp + 8], str.TyrellWhite
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov eax, dword [0x6bb7b000]
mov dword [0x6bb7aefc], 0xd6abe02d
sub esp, 0xc
mov dword [0x6bb7af00], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov dword [0x6bb7af18], 0x9afca9c6
sub esp, 0x14
mov dword [esp + 8], str.BenKoss
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov eax, dword [ebp - 0x28]
mov dword [0x6bb7b064], 0x2d92d4c8
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7affc]
push edx
push edx
mov dword [0x6bb7af90], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
mov dword [0x6bb7afe4], 0x7de5f0eb
push ecx
mov dword [esp], str.Neque_quae_provident_culpa_ut_quia_totam_occaecati_dicta_nam_amet_est
call ebx
mov dword [0x6bb7aef8], 0x7bc49466
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
mov dword [0x6bb7af48], 0xe1f3ca49
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x1c]
sub esp, 0x14
mov dword [esp + 4], str.Eveniet_numquam_voluptatem_earum_officiis_dignissimos_consequatur_ratione_odio
mov dword [esp], 0
call eax
mov dword [0x6bb7aef4], 0x987900e6
push eax
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x14
mov dword [esp + 8], str.Saepe_saepe_eos_maxime_nisi_nam_temporibus_laborum
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov eax, dword [0x6bb7aeec]
sub esp, 0xc
mov dword [0x6bb7aef0], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.Officia_vel_quae_quam_animi_voluptatem
mov dword [esp], 0
call eax
mov dword [0x6bb7aee4], 0x23fa7dcc
push eax
push eax
mov eax, dword [0x6bb7aee8]
mov dword [0x6bb7b030], 0xc1e8121e
mov dword [0x6bb7af04], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6bb7aee0], 0x57927e2c
mov dword [esp + 4], str.HettieBauch
mov dword [esp], str.Facilis_omnis_possimus_quia_quis_sit_velit_laborum_magni
call eax
push eax
push eax
mov eax, dword [0x6bb7aedc]
mov dword [0x6bb7b03c], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x2c]
push edx
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x28]
mov dword [0x6bb7b054], 0x19f39b33
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push esi
push esi
mov dword [esp], 0xf19a88a1
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0xac249463
mov dword [esp + 4], 0
mov dword [str.sYEMr], eax
call fcn.6badcbb4
mov dword [0x6bb7aed4], eax
mov eax, dword [0x6bb7aed0]
mov dword [0x6bb7af38], eax
mov eax, dword [0x6bb7b058]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.JeramyFahey
mov dword [0x6bb7aecc], eax
call ebx
push edi
mov dword [esp], str.MrJedMcCulloughIV
call ebx
mov dword [0x6bb7afc0], 0x6ec59365
push eax
mov eax, dword [0x6bb7aec4]
mov dword [0x6bb7aec8], eax
mov eax, dword [0x6bb7aec0]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7af08], eax
mov eax, dword [0x6bb7aeb8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7aebc], eax
mov eax, dword [0x6bb7aeac]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7aeb4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], 0
call eax
mov dword [0x6bb7aea8], 0xb85bd37d
push eax
push eax
mov eax, dword [0x6bb7af08]
mov dword [0x6bb7b038], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.Numquam_nam_qui_dolorem_eos_ut_numquam_sunt
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], str.DrMarceloBrakus
mov dword [esp], str.JacquesLowe
call eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
call fcn.6bad5392
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret