Function at 0x6bad4505
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x6bb884c0]
cmp dword [rax], 0x2fb8
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdx
mov dword [rsp + 0xc0], r8d
mov qword [rsp + 0xc8], r9
jne 0x6bad4e5b
mov rax, qword [0x6bb87d30]
mov ecx, 0x9dbfdafa
mov edx, dword [rax]
mov rax, qword [0x6bb87c20]
mov dword [rax], edx
call fcn.6bad9930
mov rdi, qword [0x6bb88000]
mov r15, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov dword [rdi], eax
call r15
mov rax, qword [0x6bb87c90]
mov r13, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
lea rcx, str.Modi_omnis_recusandae_eveniet_mollitia
mov edx, dword [rax]
mov rax, qword [0x6bb88040]
mov dword [rax], edx
lea rdx, str.DrDellaHerzog
call r13
xor ecx, ecx
call r15
mov rsi, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.Modi_cumque_iure_laborum
call rsi
mov rbp, qword [0x6bb88640]
mov rax, qword [0x6bb88340]
mov ecx, dword [rbp]
mov dword [rax], 0x9745f19f
call fcn.6bad9930
mov rdx, qword [0x6bb88570]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov qword [rsp + 0x30], rax
call rax
mov rax, qword [0x6bb886b0]
mov rbx, qword [0x6bb87eb0]
mov ecx, 0x8de21dbd
mov dword [rax], 0xdb9a2238
mov rax, qword [0x6bb88560]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x6bb886f0]
mov dword [rax], 0xc3841220
call fcn.6bad9930
mov rdi, qword [0x6bb88610]
xor edx, edx
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov dword [rdi], eax
call rbx
mov r10, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
mov rax, qword [0x6bb87f20]
mov qword [rsp + 0x58], r10
mov dword [rax], 0x6d127b80
call r10
mov rax, qword [0x6bb87d80]
mov rdi, qword [0x6bb87f20]
mov ecx, 0xbd6e5343
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x6bb87fb0]
mov edx, dword [rax]
mov rax, qword [0x6bb88030]
mov dword [rax], edx
call fcn.6bad9930
mov rdx, qword [0x6bb87d50]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb884b0]
mov dword [rax], 0xd1a17fdb
mov rax, qword [0x6bb885d0]
mov edx, dword [rax]
mov rax, qword [0x6bb88620]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
mov qword [rsp + 0x38], rax
call rax
mov rax, qword [0x6bb88700]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x41fd8282
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call rdi
mov rax, qword [0x6bb883a0]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x6bb88630]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor edx, edx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov ecx, 0x582cfc56
call fcn.6bad9930
mov r12, qword [0x6bb87da0]
mov rdx, qword [0x6bb88650]
xor ecx, ecx
mov dword [rdx], eax
mov edx, dword [r12]
mov rax, qword [0x6bb88440]
mov dword [rax], edx
call rdi
mov rax, qword [0x6bb880f0]
mov rdx, qword [0x6bb88400]
mov dword [rax], 0x3c11b2e6
mov rax, qword [0x6bb87f50]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb88280]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87e10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x30]
call rax
lea rdx, str.ProfMontanaWatsicaJr
lea rcx, str.VickieBuckridge
call r13
mov rax, qword [0x6bb88730]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb88420]
mov dword [rax], edx
call rdi
mov rax, qword [0x6bb883e0]
xor edx, edx
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [rax], 0x34f995d4
call r14
mov rax, qword [0x6bb883a0]
mov ecx, 0x93c6c905
mov dword [rax], 0x44cc3e2e
call fcn.6bad9930
mov rdx, qword [0x6bb87c60]
lea rcx, str.Velit_qui_enim_dolorem_praesentium
mov dword [rdx], eax
xor edx, edx
call rsi
xor ecx, ecx
call r15
mov ecx, 0x4ca056a8
call fcn.6bad9930
mov rdx, qword [0x6bb884f0]
xor ecx, ecx
mov dword [r12], 0x7d75b3a0
mov dword [rdx], eax
xor edx, edx
call r14
xor edx, edx
xor ecx, ecx
call r14
mov ecx, 0x67a20997
call fcn.6bad9930
mov rdx, qword [0x6bb87f80]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x6bb88020]
mov dword [rdx], eax
mov rax, qword [0x6bb87ed0]
mov edx, dword [rax]
mov rax, qword [0x6bb88470]
mov dword [rax], edx
mov rax, qword [0x6bb87ea0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
call rax
lea rdx, str.Repellat_quaerat_qui_autem_voluptatem_deleniti_modi
lea rcx, str.Quas_eaque_quia_harum_et_qui
call r13
mov rax, qword [0x6bb87bc0]
xor ecx, ecx
mov dword [rbp], 0xabcd7a55
mov edx, dword [rax]
mov rax, qword [0x6bb88330]
mov dword [rax], edx
mov rax, qword [rsp + 0x30]
call rax
mov r11, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
xor r9d, r9d
lea r8, str.Quis_culpa_voluptas_et_molestiae_quia_similique_libero
lea rdx, str.Recusandae_dolor_debitis_earum_totam_eius_aspernatur_quasi_in_rerum_cumque_quaerat
lea rcx, str.DomingoWolfIV
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x20], 0
call r11
xor r8d, r8d
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb886a0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87fe0]
mov rcx, qword [0x6bb88490]
mov dword [rdx], eax
mov rax, qword [0x6bb88430]
lea rdx, str.DeonWitting
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.TerryKutch
call r13
mov rax, qword [0x6bb88050]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87fd0]
lea rcx, str.ProfAdelbertReilly
mov dword [rdx], eax
lea rdx, str.CarissaPurdy
call r13
mov rbp, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ProfMitchelParkerPhD
call rbp
mov rax, qword [0x6bb88530]
mov edx, dword [rax]
mov rax, qword [0x6bb87ee0]
mov dword [rax], edx
mov rax, qword [0x6bb87c40]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88750]
mov ecx, 0xc2ebd15
mov dword [rdx], eax
call fcn.6bad9930
mov rcx, qword [0x6bb886b0]
mov dword [rcx], eax
mov ecx, 0x1aabc0e4
call fcn.6bad9930
mov rdx, qword [0x6bb88400]
mov ecx, 0xc3cfcec7
mov dword [rdx], eax
call fcn.6bad9930
mov rcx, qword [0x6bb88060]
mov dword [rcx], eax
mov ecx, 0x72d2c909
call fcn.6bad9930
mov rdx, qword [0x6bb883b0]
lea rcx, str.Iure_aut_neque_adipisci_magnam_error_quibusdam_impedit_neque
mov dword [rdx], eax
xor edx, edx
call rsi
xor ecx, ecx
call r15
lea rdx, str.KacieTowne
lea rcx, str.Illo_qui_similique_minus
call r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.Necessitatibus_quam_at_ut_iusto
lea rcx, str.Ut_adipisci_illo_recusandae_recusandae_eum
call r13
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x6bb883e0]
mov r9, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb882f0]
mov qword [rsp + 0x48], r9
mov dword [rax], edx
xor edx, edx
call r9
mov r9, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call r9
mov r14, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call r14
xor ecx, ecx
call rdi
mov rax, qword [0x6bb87ef0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb885f0]
mov dword [rdx], eax
mov rax, qword [0x6bb88000]
mov rdx, qword [0x6bb88610]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x6bb883e0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb87f20]
xor edx, edx
mov dword [rcx], eax
lea rcx, str.MrSamirKleinIII
call rsi
lea rdx, str.MaximoOberbrunner
lea rcx, str.RoyalAufderhar
call r13
mov ecx, 0x9e057f0d
call fcn.6bad9930
mov rdx, qword [0x6bb87eb0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x38]
call rax
xor ecx, ecx
call r14
mov rax, qword [0x6bb88110]
mov edx, dword [rax]
mov rax, qword [0x6bb88310]
mov dword [rax], edx
mov rax, qword [0x6bb87d80]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88600]
mov rcx, qword [0x6bb87fd0]
xor r8d, r8d
mov dword [rdx], eax
mov rax, qword [0x6bb88400]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb87f30]
xor ecx, ecx
mov dword [rax], 0xc48835c7
call r12
mov rax, qword [0x6bb87c10]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87d80]
lea rcx, str.FrankieTromp
mov dword [rdx], eax
xor edx, edx
call rsi
mov ecx, 0xd51740c5
call fcn.6bad9930
mov r8, qword [0x6bb87c80]
mov rcx, qword [0x6bb880f0]
mov rdx, qword [0x6bb87c40]
mov dword [rcx], eax
mov eax, dword [r8]
lea rcx, str.Aspernatur_quas_voluptatem_alias_veritatis_debitis_eos_nulla_eaque
mov dword [rdx], eax
lea rdx, str.MissDeannaKautzerI
call r13
xor ecx, ecx
call rdi
mov rax, qword [0x6bb87d90]
xor edx, edx
xor ecx, ecx
mov r9, qword [rsp + 0x48]
mov dword [rax], 0x2efff0a5
call r9
mov r8, qword [0x6bb87c80]
mov r11, qword [rsp + 0x50]
xor r9d, r9d
mov rax, qword [0x6bb87dd0]
mov rcx, qword [0x6bb87bf0]
mov edx, dword [r8]
lea r8, str.Vel_ducimus_dolor_doloremque
mov dword [rax], edx
mov rax, qword [0x6bb884f0]
lea rdx, str.UbaldoMueller
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.Voluptas_iste_et_alias_in_non_consequatur_itaque_numquam_autem_corrupti_rerum
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r11
mov rax, qword [0x6bb88540]
mov rdx, qword [0x6bb87c10]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rbx
lea rcx, str.MissClaireGulgowskiV
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb882a0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88670]
lea rcx, str.HaroldHeathcote
mov dword [rdx], eax
mov rax, qword [0x6bb884a0]
mov dword [rax], 0xe03549e2
call rbp
mov r10, qword [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call r10
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
lea rdx, str.Est_sed_molestiae_ut_omnis_laborum_quidem
lea rcx, str.Repellat_debitis
call r13
xor edx, edx
lea rcx, str.Esse_nemo_harum_maiores_dolores_atque_est_excepturi_quasi_odit_excepturi_est
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x6bb88690]
lea rcx, str.Eligendi_sequi_alias_placeat_maxime_ut_quas_aut_accusantium_id_repellendus_doloribus
mov edx, dword [rax]
mov rax, qword [0x6bb88360]
mov dword [rax], edx
lea rdx, str.Sint_commodi_deleniti_quia_quia_est_quaerat_rerum_amet_ut_et_illo
call r13
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call rbx
mov r12, qword [0x6bb88070]
mov ecx, dword [r12]
call fcn.6bad9930
mov rdx, qword [0x6bb880a0]
mov rcx, qword [0x6bb87c40]
mov dword [rdx], eax
mov rax, qword [str.32_]
xor edx, edx
mov dword [rax], 0x6befba76
mov rax, qword [0x6bb87cc0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb886e0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88460]
mov ecx, 0x2da181e5
mov dword [rdx], eax
call fcn.6bad9930
mov rdx, qword [0x6bb885d0]
mov dword [rdx], eax
mov rax, qword [0x6bb87fe0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb88630]
mov dword [rcx], eax
mov ecx, 0xf1a6c556
call fcn.6bad9930
mov rdx, qword [0x6bb88280]
lea rcx, str.MrsShakiraHansen
mov dword [rdx], eax
call rbp
xor edx, edx
lea rcx, str.MrWellingtonHilpert
call rsi
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
lea rcx, str.Rerum_molestias_consequatur_quis_soluta_et
call rbp
xor ecx, ecx
call r15
xor ecx, ecx
call r14
xor ecx, ecx
call r15
mov rax, qword [0x6bb88280]
mov rsi, qword [0x6bb883a0]
mov ecx, dword [r12]
mov eax, dword [rax]
mov dword [rsi], eax
call fcn.6bad9930
mov rsi, qword [0x6bb88430]
mov ecx, 0x254bd2ae
mov dword [rsi], eax
call fcn.6bad9930
mov rsi, qword [0x6bb87bf0]
lea rcx, str.Molestiae_et_impedit_blanditiis
mov dword [rsi], eax
call rbp
mov ecx, 0xe7d15c94
call fcn.6bad9930
mov rsi, qword [0x6bb88490]
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [0x6bb882b0]
mov dword [rax], 0xe91cca17
call rdi
mov ecx, 0xfa955f0e
call fcn.6bad9930
mov rdx, qword [0x6bb87d10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb88020]
mov dword [rax], 0xa1cc7a02
mov rax, qword [0x6bb88060]
mov edx, dword [rax]
mov rax, qword [0x6bb88320]
mov dword [rax], edx
xor edx, edx
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rcx, rax
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.6bad3e50
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret