Function at 0x6bad2361
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rax, qword [0x6bb80f80]
cmp dword [rax], 0xa126
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], r8
mov qword [rsp + 0xe8], r9
jle 0x6bad2b95
mov rbx, qword [0x6bb80d00]
lea rcx, str.Molestiae_et_quia_ratione_minima_quos_mollitia
mov dword [rbx], 0xc8bc7f6
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rax, qword [0x6bb80ad0]
mov r15, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [rbx], 0x131d6a98
lea rcx, str.ChristelleBeattyIV
mov edx, dword [rax]
mov rax, qword [0x6bb80f60]
mov dword [rax], edx
xor edx, edx
call r15
mov rax, qword [0x6bb80a20]
xor edx, edx
lea rcx, str.Est_tempore_vel_voluptatem
mov dword [rax], 0x9b06bf0a
call r15
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call rsi
lea rdx, str.KellieCollier
lea rcx, str.AlainaManteDDS
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rax, qword [0x6bb80d90]
mov ecx, 0x5755bd34
mov rdi, qword [0x6bb80820]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x6bb807a0]
mov dword [rax], 0x7cbac6ae
call fcn.6bad9c90
mov rdi, qword [0x6bb80ca0]
xor edx, edx
xor ecx, ecx
mov rbx, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov dword [rdi], eax
mov rax, qword [0x6bb80940]
mov dword [rax], 0xf5a0b7fe
call rbx
mov rax, qword [0x6bb808d0]
mov rbp, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Voluptates_sint_nisi_sequi_consequuntur_voluptatibus_consequatur_tempora
mov edx, dword [rax]
mov rax, qword [0x6bb81120]
mov dword [rax], edx
mov rax, qword [0x6bb80ab0]
mov dword [rax], 0x6bdb1726
call rbp
xor edx, edx
mov rdi, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call rdi
mov rax, qword [0x6bb80a40]
mov dword [rax], 0x8c328968
mov rax, qword [0x6bb805e0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80530]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
mov qword [rsp + 0x48], rax
call rax
mov rax, qword [0x6bb80520]
mov rdx, qword [0x6bb81050]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x50], rax
call rax
xor edx, edx
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, str.LeeOsinski
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
xor r9d, r9d
mov r14, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call rbx
xor edx, edx
lea rcx, str.DrMargarettaDonnelly
call r15
xor edx, edx
lea rcx, str.Veniam_assumenda_quae_cumque_sed_porro_voluptate_aut
call r15
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [str.eNl.h_Q]
mov edx, dword [rax]
mov rax, qword [0x6bb80fb0]
mov dword [rax], edx
mov rax, qword [0x6bb80750]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80ef0]
mov dword [rdx], eax
mov rax, qword [0x6bb81080]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb81190]
mov rdi, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov r13, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call r13
mov rax, qword [str.7U5]
mov ecx, dword [rax]
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb80eb0]
mov r12, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rdx], eax
mov rax, qword [0x6bb80e50]
xor edx, edx
mov dword [rax], 0x86ed38ef
mov rax, qword [0x6bb80cd0]
mov dword [rax], 0x7a8691d4
mov dword [rsp + 0x20], 0
call r12
mov rax, qword [0x6bb807c0]
xor ecx, ecx
xor edx, edx
mov dword [rax], 0xe08dbc74
mov rax, qword [rsp + 0x48]
call rax
xor edx, edx
mov rsi, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
call rsi
mov rax, qword [0x6bb80d50]
xor r9d, r9d
xor r8d, r8d
mov r11, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80840]
mov qword [rsp + 0x70], r11
mov dword [rax], edx
mov rax, qword [0x6bb80f50]
xor edx, edx
mov dword [rax], 0x5c36473
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r11
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb80920]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xf17f8813
mov dword [rsp + 0x20], 0
call r12
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x6bb80a10]
lea rcx, str.Consectetur_autem_eveniet_corporis_quisquam
mov dword [rax], 0xcc10e148
call rbp
mov rax, qword [0x6bb81010]
xor ecx, ecx
mov dword [rax], 0x3ed70506
mov rax, qword [0x6bb80570]
mov dword [rax], 0xd870dc01
mov rax, qword [rsp + 0x50]
call rax
mov ecx, 0x1741d033
call fcn.6bad9c90
mov rdx, qword [0x6bb807b0]
mov ecx, 0x6cd384f4
mov dword [rdx], eax
mov rax, qword [0x6bb80890]
mov edx, dword [rax]
mov rax, qword [0x6bb80860]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [str.Z2iy]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [0x6bb81130]
mov ecx, 0x8b30b1f3
mov dword [rax], 0xa2996213
call fcn.6bad9c90
mov rdx, qword [0x6bb80e40]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
xor ecx, ecx
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb80dd0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x661236a8
call rsi
mov rax, qword [0x6bb810e0]
mov ecx, 0x9b3c5317
mov dword [rax], 0x4a1ac8d7
call fcn.6bad9c90
mov r10, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rdx, qword [0x6bb80ca0]
xor ecx, ecx
mov qword [rsp + 0x78], r10
mov dword [rdx], eax
call r10
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb80770]
mov r11, qword [rsp + 0x70]
xor ecx, ecx
mov rdx, qword [0x6bb80d20]
xor r9d, r9d
xor r8d, r8d
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb80820]
xor edx, edx
mov dword [rax], 0xa03e60b4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb80dc0]
mov rdx, qword [0x6bb80890]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [str.Z2iy]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80730]
mov dword [rax], edx
xor edx, edx
call rbx
mov ecx, 0x5d58540e
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb80e40]
mov dword [rdx], eax
xor edx, edx
call r14
mov rax, qword [0x6bb80d90]
xor r8d, r8d
xor edx, edx
mov r14, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
mov dword [rax], 0x74391846
call r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
lea rcx, str.TravisPagac
call r15
mov rax, qword [0x6bb80d20]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80940]
mov r14, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [0x6bb80ab0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80f20]
mov dword [rax], edx
mov rax, qword [0x6bb806b0]
mov dword [rax], 0xceacf4ce
mov rax, qword [0x6bb808d0]
mov edx, dword [rax]
mov rax, qword [0x6bb80f10]
mov dword [rax], edx
mov rax, qword [0x6bb80db0]
mov edx, dword [rax]
mov rax, qword [0x6bb811b0]
mov dword [rax], edx
xor edx, edx
mov dword [rsp + 0x20], 0
call r12
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [0x6bb81040]
lea rcx, str.Perspiciatis_iure_voluptatem_nesciunt_cumque_omnis_quisquam_quos
mov dword [rax], 0x31c8692a
call rbp
mov rax, qword [0x6bb80980]
mov ecx, dword [rax]
call fcn.6bad9c90
mov r8, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov rdx, qword [0x6bb806f0]
xor ecx, ecx
mov qword [rsp + 0x70], r8
mov dword [rdx], eax
call r8
xor edx, edx
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x6bb80930]
mov r8, qword [rsp + 0x70]
xor ecx, ecx
mov dword [rax], 0x23079c82
call r8
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
lea rcx, str.KoryRuecker
call rbp
mov rax, qword [0x6bb809e0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80820]
mov ecx, 0x96da624a
mov dword [rdx], eax
call fcn.6bad9c90
mov rcx, qword [0x6bb80920]
mov r10, qword [rsp + 0x78]
mov dword [rcx], eax
mov rax, qword [0x6bb81050]
xor ecx, ecx
mov dword [rax], 0xb3eac7
call r10
xor edx, edx
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb805f0]
mov ecx, 0x70d14450
mov edx, dword [rax]
mov rax, qword [0x6bb81210]
mov dword [rax], edx
mov rax, qword [0x6bb80ea0]
mov dword [rax], 0xa55e0a62
call fcn.6bad9c90
mov rdx, qword [0x6bb80e40]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [0x6bb80fe0]
mov dword [rax], 0xaea79a49
mov rax, qword [0x6bb811f0]
mov edx, dword [rax]
mov rax, qword [0x6bb80d30]
mov dword [rax], edx
mov rax, qword [0x6bb80c80]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x25e84fef
call rsi
mov rax, qword [0x6bb81080]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80600]
mov dword [rax], edx
call r13
lea r8, str.KarianneHyattI
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rax, qword [0x6bb80f40]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80a60]
mov ecx, 0xdbb433a7
mov dword [rdx], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb811d0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
xor edx, edx
xor ecx, ecx
call rbx
lea rcx, str.ElveraDavis
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x6bb810b0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rbx, qword [0x6bb80b20]
xor edx, edx
lea rcx, str.RamiroDoyle
mov dword [rbx], eax
call r15
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x6bb81150]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb810c0]
mov dword [rax], edx
call r13
xor ecx, ecx
call rdi
mov ecx, 0xc5f5f62f
call fcn.6bad9c90
mov rdx, qword [0x6bb80a50]
xor ecx, ecx
mov rsi, qword [0x6bb805e0]
mov dword [rbx], 0xde0b706d
mov dword [rdx], eax
mov rax, qword [0x6bb80560]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x6bb80b40]
mov dword [rax], 0x4c8b1e21
mov rax, qword [rsp + 0x68]
call rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xd8]
mov rcx, rax
mov rax, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x20], rax
call fcn.6bad1b61
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret