Function at 0x6bad1ffd
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x6bb85d20]
cmp dword [rax], 0x4c3b
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r9
jle 0x6bad251a
mov rax, qword [0x6bb85f20]
mov rsi, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
xor ecx, ecx
lea rdx, str.Enim_et_eum_sapiente
mov dword [rax], 0x5daf7bde
call rsi
lea rdx, str.ProfJeanieBlanda
xor ecx, ecx
call rsi
mov rax, qword [0x6bb85d10]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb853c0]
mov r13, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [str.qCeHV]
mov rdi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Quis_et_maxime_repellat_laudantium_voluptatem_ipsam_non_quod
mov dword [rax], 0xf4c1dec
call rdi
mov rax, qword [0x6bb85840]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rbx, qword [0x6bb85700]
mov dword [rbx], eax
mov rax, qword [0x6bb85810]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85310]
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov ecx, 0x49715bea
call fcn.6bad7ff0
mov rdx, qword [0x6bb853a0]
mov r15, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
mov rax, qword [0x6bb85c60]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rbx, qword [0x6bb85940]
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rbx], eax
call rbp
xor ecx, ecx
call r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rbx, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Et_perspiciatis_et_incidunt_nisi
lea rcx, str.KathleenGerhold
call rbx
lea rcx, str.Omnis_recusandae_quis_quas_harum_repellendus_asperiores_accusantium_eum_nesciunt_asperiores_doloremque
call rdi
mov ecx, 0xacbe79cd
call fcn.6bad7ff0
mov rdx, qword [0x6bb853d0]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov rax, qword [0x6bb85b90]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85440]
xor ecx, ecx
mov dword [rdx], eax
call rbp
lea rdx, str.ProfAdelleLemke
lea rcx, str.Non_qui_molestiae_fuga_iure_nihil_aperiam_impedit_quae
call rbx
lea rdx, str.DrAmosWaelchi
lea rcx, str.MissSandrineHegmannDVM
call rbx
lea rcx, str.Molestiae_ipsa_dicta_nisi_ut
call rdi
xor ecx, ecx
call rbp
mov r12, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r12
lea rdx, str.DexterEmmerich
xor ecx, ecx
call rsi
mov rax, qword [0x6bb85b60]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.PercivalHaneI
mov dword [rax], 0xad471a27
call rdi
lea rcx, str.BrendaStrosin
call rdi
lea rdx, str.ChaimKoelpin
lea rcx, str.JohnathonBashirian
call rbx
xor edx, edx
xor ecx, ecx
call r15
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
call r13
mov r15, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.AdaBecker
call r15
lea rcx, str.ProfBirdieBorer
call rdi
xor edx, edx
lea r8, str.TyrellWhite
xor ecx, ecx
call r15
mov rax, qword [0x6bb85580]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85ff0]
mov dword [rax], edx
mov rax, qword [0x6bb85880]
xor edx, edx
mov dword [rax], 0xd6abe02d
mov qword [rsp + 0x20], 0
call r12
mov rax, qword [0x6bb85700]
xor edx, edx
xor ecx, ecx
lea r8, str.BenKoss
mov dword [rax], 0x9afca9c6
call r15
mov rax, qword [0x6bb85e60]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x2d92d4c8
call r13
mov rax, qword [0x6bb857f0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85fa0]
mov dword [rax], edx
call r14
mov rax, qword [0x6bb85fb0]
lea rcx, str.Neque_quae_provident_culpa_ut_quia_totam_occaecati_dicta_nam_amet_est
mov dword [rax], 0x7de5f0eb
call rdi
mov rax, qword [0x6bb85850]
xor ecx, ecx
mov dword [rax], 0x7bc49466
call r14
mov rax, qword [0x6bb85970]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xe1f3ca49
mov qword [rsp + 0x20], 0
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r12
xor ecx, ecx
lea rdx, str.Eveniet_numquam_voluptatem_earum_officiis_dignissimos_consequatur_ratione_odio
call rsi
mov rax, qword [0x6bb857c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x987900e6
mov qword [rsp + 0x20], 0
call r12
lea r8, str.Saepe_saepe_eos_maxime_nisi_nam_temporibus_laborum
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb85ec0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85500]
mov dword [rax], edx
lea rdx, str.Officia_vel_quae_quam_animi_voluptatem
call rsi
mov rax, qword [0x6bb85e90]
mov rdx, qword [0x6bb85c60]
lea rcx, str.Facilis_omnis_possimus_quia_quis_sit_velit_laborum_magni
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb86040]
lea rdx, str.HettieBauch
mov dword [rax], 0x23fa7dcc
mov rax, qword [0x6bb85720]
mov dword [rax], 0xc1e8121e
mov rax, qword [0x6bb85390]
mov dword [rax], 0x57927e2c
call rbx
mov rax, qword [0x6bb86020]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb85730]
mov dword [rax], edx
call rbp
xor ecx, ecx
call r14
mov rax, qword [0x6bb85300]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x19f39b33
call r13
mov ecx, 0xf19a88a1
call fcn.6bad7ff0
mov rdx, qword [str.sYEMr]
mov ecx, 0xac249463
mov dword [rdx], eax
call fcn.6bad7ff0
mov rdx, qword [0x6bb85350]
mov dword [rdx], eax
mov rax, qword [0x6bb854e0]
mov edx, dword [rax]
mov rax, qword [0x6bb85dd0]
mov dword [rax], edx
mov rax, qword [0x6bb85d70]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85cc0]
lea rcx, str.JeramyFahey
mov dword [rdx], eax
call rdi
lea rcx, str.MrJedMcCulloughIV
call rdi
mov rax, qword [0x6bb85460]
mov edx, dword [rax]
mov rax, qword [0x6bb857d0]
mov dword [rax], edx
mov rax, qword [0x6bb85b70]
mov dword [rax], 0x6ec59365
mov rax, qword [0x6bb85490]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdi, qword [0x6bb85940]
mov dword [rdi], eax
mov rax, qword [0x6bb85920]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85f50]
mov dword [rdx], eax
mov rax, qword [0x6bb85ed0]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85930]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [0x6bb85370]
xor ecx, ecx
mov dword [rax], 0xb85bd37d
mov rax, qword [0x6bb85940]
mov edx, dword [rax]
mov rax, qword [0x6bb85e40]
mov dword [rax], edx
lea rdx, str.Numquam_nam_qui_dolorem_eos_ut_numquam_sunt
call rsi
lea rdx, str.DrMarceloBrakus
lea rcx, str.JacquesLowe
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.6bad1808
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret