Function at 0x6bad46f2
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [0x6bb80f80]
cmp dword [rax], 0x52cb
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rdx
mov dword [rsp + 0xd0], r8d
mov qword [rsp + 0xd8], r9
jle 0x6bad4ceb
xor r8d, r8d
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
xor ecx, ecx
call rsi
lea rdx, str.Sit_nesciunt_et_omnis_vel_aliquid_inventore
lea rcx, str.MsTiannaCremin
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor edx, edx
mov r15, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call r15
mov rax, qword [0x6bb808b0]
mov rdi, qword [0x6bb80570]
mov ecx, 0x68214e73
mov eax, dword [rax]
mov dword [rdi], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb80940]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x6bb80970]
mov r13, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80720]
mov dword [rax], edx
xor edx, edx
call r13
mov r14, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb80f10]
mov rbx, qword [0x6bb805f0]
mov ecx, 0x4593f8f8
mov edx, dword [rax]
mov rax, qword [0x6bb81050]
mov dword [rax], edx
mov rax, qword [0x6bb80db0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb807c0]
mov dword [rax], 0x60ae1d5f
call fcn.6bad9c90
mov rdx, qword [0x6bb80630]
lea rcx, str.LorenBoehm
mov dword [rdi], eax
mov rdi, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [rdx], eax
mov rax, qword [0x6bb80700]
mov edx, dword [rax]
mov rax, qword [0x6bb80b30]
mov dword [rax], edx
xor edx, edx
call rdi
mov rbp, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call rbp
mov rax, qword [0x6bb80850]
mov edx, dword [rax]
mov rax, qword [0x6bb80d50]
mov dword [rax], edx
mov rax, qword [str.:_]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80ce0]
mov r12, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.EmoryRau
mov dword [rdx], eax
call r12
xor ecx, ecx
call r14
xor edx, edx
lea rcx, str.Saepe_expedita_facere
call rdi
mov rax, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x48], rax
call rax
mov r11, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov edx, dword [rbx]
xor ecx, ecx
mov rax, qword [0x6bb80a60]
mov qword [rsp + 0x60], r11
mov dword [rax], edx
call r11
mov rdi, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call rdi
mov ecx, 0x605bf83b
call fcn.6bad9c90
mov rdx, qword [0x6bb81030]
lea rcx, str.CaterinaJerde
mov dword [rdx], eax
mov rax, qword [0x6bb80eb0]
mov edx, dword [rax]
mov rax, qword [0x6bb811f0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov r10, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], r10
call r10
xor ecx, ecx
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r14
xor ecx, ecx
call r14
lea r8, str.DrNoeMarvin
xor edx, edx
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_OpenEventA]
call rbx
mov rax, qword [0x6bb80a40]
mov dword [rax], 0xd0255e91
mov rax, qword [0x6bb81140]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80b60]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb81190]
mov edx, dword [rax]
mov rax, qword [str.Z2iy]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov qword [rsp + 0x58], rax
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov r9, qword [0x6bb80e80]
mov rax, qword [0x6bb80620]
mov edx, dword [r9]
mov dword [rax], 0xe469f00d
mov rax, qword [0x6bb80df0]
mov dword [rax], edx
mov rax, qword [0x6bb80d20]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rcx, qword [0x6bb80b10]
lea r8, str.Et_ut_nulla_vel
xor edx, edx
mov dword [rcx], eax
mov rax, qword [0x6bb80a10]
xor ecx, ecx
mov dword [rax], 0xbb960e4a
call rbx
mov rax, qword [0x6bb80d00]
mov rbx, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rax], 0xbf645a0f
mov rax, qword [0x6bb80b20]
mov dword [rax], 0xb7f110e3
call rbx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb807c0]
mov dword [rax], 0x9f3d192e
mov rax, qword [0x6bb811d0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80820]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov r11, qword [rsp + 0x60]
xor ecx, ecx
call r11
mov r8, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov qword [rsp + 0x60], r8
call r8
mov rax, qword [0x6bb811a0]
mov dword [rax], 0xcfafd027
mov rax, qword [0x6bb808b0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80dd0]
mov r10, qword [rsp + 0x68]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r10
xor edx, edx
xor ecx, ecx
call r13
mov r14, qword [0x6bb80930]
mov rax, qword [0x6bb810e0]
lea rcx, str.Iure_nisi_earum_quia_consectetur_ipsam_rerum_voluptatum_laborum
mov edx, dword [r14]
mov dword [rax], edx
call r12
mov rax, qword [0x6bb80950]
xor ecx, ecx
mov r9, qword [0x6bb80e80]
mov dword [r14], 0xf0e4d612
mov r14, qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rax], 0x90b75e11
mov rax, qword [0x6bb80ed0]
mov dword [r9], 0x242c91e0
mov edx, dword [rax]
mov rax, qword [0x6bb81040]
mov dword [rax], edx
mov rax, qword [0x6bb80fc0]
mov dword [rax], 0x24bc6664
mov rax, qword [0x6bb805a0]
mov dword [rax], 0x3dab7dae
mov rax, qword [0x6bb80b10]
mov dword [rax], 0x3b44fba3
call r14
mov rax, qword [0x6bb80cd0]
mov ecx, 0x71baf11
mov dword [rax], 0xe0c2afc
call fcn.6bad9c90
mov rdx, qword [0x6bb80560]
mov ecx, 0x16b448ee
mov dword [rdx], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb81000]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x6bb80690]
mov r8, qword [rsp + 0x60]
xor ecx, ecx
mov dword [rax], 0xf85e2fe7
call r8
mov rax, qword [0x6bb80a20]
mov ecx, 0x142c1165
mov dword [rax], 0x4c71ea84
call fcn.6bad9c90
mov rdx, qword [0x6bb81160]
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
lea rcx, str.Ut_minus_distinctio_iste_sed_impedit_consequuntur_neque
call r12
xor ecx, ecx
call rbp
mov rax, qword [0x6bb80d10]
mov rbp, qword [0x6bb809b0]
mov ecx, 0xbe170006
mov dword [rax], 0xf4fc02a
mov rax, qword [0x6bb80d70]
mov eax, dword [rax]
mov dword [rbp], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb80db0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
call rdi
mov rax, qword [0x6bb81190]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb806d0]
mov ecx, 0xc1d61821
mov dword [rdx], eax
call fcn.6bad9c90
xor edx, edx
xor ecx, ecx
mov dword [rbp], eax
call r15
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rax
mov rax, qword [0x6bb808a0]
mov ecx, 0xf08a3a47
mov dword [rax], 0xb92d3316
mov rax, qword [0x6bb80f20]
mov dword [rax], 0xe305fd69
call fcn.6bad9c90
mov rdx, qword [0x6bb80920]
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call r14
mov rax, qword [0x6bb80a00]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [str.eNl.h_Q]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
xor ecx, ecx
call rbx
xor edx, edx
xor r8d, r8d
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
mov rax, qword [0x6bb80b70]
mov edx, dword [rax]
mov rax, qword [0x6bb810b0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
mov rcx, rax
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call fcn.6bad3d41
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret