Function at 0x1400184c0
Capabilities:
Accept command line arguments
Get hostname
Get session user name
Get token privileges
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14002f198]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor ebx, ebx
mov r15d, r8d
mov r14, rcx
lea r13, [0x14002bb9c]
test dl, dl
je 0x140018525
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.________________________________________________________________________________________________________________________________________________________________r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x400
mov byte [rbp - 0x80], bl
mov ecx, esi
lea rdi, [rbp - 0x80]
lea r8, [rbp - 0x80]
mov r9d, ebx
mov rdx, rbx
lea r10, [0x140016000]
nop
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x140018599
movzx eax, byte [rdx + r10 + 0x15c48]
test al, al
je 0x140018599
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140018570
jmp 0x14001859e
test rcx, rcx
jne 0x1400185aa
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rsi
mov byte [r8], bl
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x1400185c6
cmp r9d, 0x8007007a
jne 0x1400185cc
mov rdi, rcx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov r12d, 0x7ffffffe
test rdi, rdi
jne 0x1400185e6
test rsi, rsi
jne 0x140018678
cmp rsi, 0x7fffffff
ja 0x140018678
test rax, rax
lea r9, [0x14002c208]
mov r8, rdi
cmovne r9, rax
mov rcx, rsi
test rsi, rsi
jne 0x140018618
cmp byte [r9], bl
je 0x140018672
test rdi, rdi
je 0x140018678
jmp 0x140018672
mov r10, r12
mov r11d, ebx
mov rdx, rbx
sub r10, rsi
lea rax, [r10 + rcx]
test rax, rax
je 0x140018646
movzx eax, byte [rdx + r9]
test al, al
je 0x140018646
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140018624
jmp 0x14001864b
test rcx, rcx
jne 0x140018657
dec r8
mov r11d, 0x8007007a
dec rdx
mov rcx, rsi
mov byte [r8], bl
lea r8, [rdx + rdi]
sub rcx, rdx
test r11d, r11d
jns 0x140018672
cmp r11d, 0x8007007a
jne 0x140018678
mov rdi, r8
mov rsi, rcx
cmp byte [rbp - 0x80], 0
lea rbx, [rbp - 0x80]
je 0x1400186c4
nop word [rax + rax]
lea rdx, str.password
mov r8d, 8
mov rcx, rbx
call fcn.14001d7a8
test eax, eax
jne 0x1400186bc
add rbx, 8
cmp byte [rbx], al
je 0x1400186bc
mov byte [rbx], 0x2a
inc rbx
cmp byte [rbx], 0
jne 0x1400186b1
inc rbx
cmp byte [rbx], 0
jne 0x140018690
test rdi, rdi
jne 0x1400186ce
test rsi, rsi
jne 0x140018718
cmp rsi, 0x7fffffff
ja 0x140018718
test rsi, rsi
je 0x140018718
mov rcx, r12
mov rdx, r13
sub rcx, rsi
sub rdx, rdi
nop dword [rax + rax]
lea rax, [rsi + rcx]
test rax, rax
je 0x14001870d
movzx eax, byte [rdi + rdx]
test al, al
je 0x14001870d
mov byte [rdi], al
inc rdi
dec rsi
jne 0x1400186f0
jmp 0x140018712
test rsi, rsi
jne 0x140018715
dec rdi
mov byte [rdi], 0
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor esi, esi
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov byte [rbp - 0x80], sil
mov qword [rsp + 0x58], 0x400
mov ecx, 0x400
lea r8, [rbp - 0x80]
mov r9d, esi
mov edx, esi
lea r10, [0x140016000]
nop dword [rax]
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x140018799
movzx eax, byte [rdx + r10 + 0x15c68]
test al, al
je 0x140018799
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140018770
jmp 0x14001879e
test rcx, rcx
jne 0x1400187aa
dec r8
mov r9d, 0x8007007a
dec rdx
mov eax, 0x400
mov byte [r8], sil
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x1400187c8
cmp r9d, 0x8007007a
jne 0x1400187d2
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140018030
mov rcx, qword [rsp + 0x60]
mov r11, qword [rsp + 0x58]
test rcx, rcx
jne 0x1400187f5
test r11, r11
jne 0x140018839
cmp r11, 0x7fffffff
ja 0x140018839
test r11, r11
je 0x140018839
mov rdx, r12
mov r8, r13
sub rdx, r11
sub r8, rcx
nop
lea rax, [r11 + rdx]
test rax, rax
je 0x14001882e
movzx eax, byte [rcx + r8]
test al, al
je 0x14001882e
mov byte [rcx], al
inc rcx
dec r11
jne 0x140018810
jmp 0x140018833
test r11, r11
jne 0x140018836
dec rcx
mov byte [rcx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [rbp - 0x80], sil
lea rdi, str.Unknown
mov ebx, 1
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbx + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400188cf
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
lea r9d, [rbx + 3]
lea r8, [rsp + 0x70]
lea edx, [rbx + 0x11]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x74], esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400188c4
cmp dword [rsp + 0x74], 4
cmove ebx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec ebx
je 0x1400188ed
dec ebx
je 0x1400188e4
dec ebx
jne 0x1400188f4
lea rdi, str.Limited
jmp 0x1400188f4
lea rdi, str.Full
jmp 0x1400188f4
lea rdi, str.Default
mov dword [rsp + 0x50], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
lea rax, str.Version:_23.2.3.47720____u_Bit__Session:__u__Elevation:__s_r_n
mov qword [rsp + 0x30], MsiGetPropertyW
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x80]
mov edx, 0x400
mov dword [rsp + 0x20], 0x100
call fcn.14001c060
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x400
mov byte [rbp - 0x80], sil
mov ecx, edi
lea rbx, [rbp - 0x80]
lea r8, [rbp - 0x80]
mov r9d, esi
mov rdx, rsi
nop
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x1400189bf
lea rax, [0x140016000]
movzx eax, byte [rdx + rax + 0x15cb8]
test al, al
je 0x1400189bf
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140018990
jmp 0x1400189c4
test rcx, rcx
jne 0x1400189d0
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], sil
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x1400189ec
cmp r9d, 0x8007007a
jne 0x1400189f2
mov rbx, rcx
mov rdi, rax
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, 7
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x140018a25
test rdi, rdi
jne 0x140018ab4
cmp rdi, 0x7fffffff
ja 0x140018ab4
mov rcx, rbx
mov rax, rdi
test rdi, rdi
jne 0x140018a44
test rbx, rbx
je 0x140018ab4
jmp 0x140018aae
mov r9, r12
mov rcx, rdi
mov r8, rbx
mov r10d, esi
mov rdx, rsi
sub r9, rdi
lea rax, [rcx + r9]
test rax, rax
je 0x140018a82
lea rax, [0x140016000]
movzx eax, byte [rdx + rax + 0x15cc8]
test al, al
je 0x140018a82
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140018a56
jmp 0x140018a87
test rcx, rcx
jne 0x140018a93
dec r8
mov r10d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], sil
lea rcx, [rdx + rbx]
sub rax, rdx
test r10d, r10d
jns 0x140018aae
cmp r10d, 0x8007007a
jne 0x140018ab4
mov rbx, rcx
mov rdi, rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x140018ade
test rdi, rdi
jne 0x140018b28
cmp rdi, 0x7fffffff
ja 0x140018b28
test rdi, rdi
je 0x140018b28
mov rcx, r12
mov rdx, r13
sub rcx, rdi
sub rdx, rbx
nop dword [rax + rax]
lea rax, [rdi + rcx]
test rax, rax
je 0x140018b1d
movzx eax, byte [rbx + rdx]
test al, al
je 0x140018b1d
mov byte [rbx], al
inc rbx
dec rdi
jne 0x140018b00
jmp 0x140018b22
test rdi, rdi
jne 0x140018b25
dec rbx
mov byte [rbx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x60], rax
mov eax, r15d
lea r10, [0x140016000]
and eax, 7
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov rax, qword [r10 + rax*8 + 0x15990]
lea rcx, [rbp - 0x80]
mov edx, 0x400
mov qword [rsp + 0x30], rax
lea rax, str.LogLevel:__hs___i_
mov byte [rbp - 0x80], sil
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
mov qword [rsp + 0x58], 0x400
call fcn.14001c060
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov r11, qword [rsp + 0x50]
movabs rax, 0xd6bf94d5e57a42bd
sub r11, qword [rsp + 0x68]
movabs r8, 0x8888888888888889
imul r11
lea rcx, [r11 + rdx]
sar rcx, 0x17
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov rax, r8
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 5
mov rcx, rbx
shr rcx, 0x3f
add rbx, rcx
sets cl
test cl, cl
je 0x140018c1d
neg rbx
mov rax, r8
imul rbx
add rdx, rbx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, edx
test cl, cl
je 0x140018c3c
neg eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x30], eax
imul edx, edx, 0x3c
lea rax, str.__Timezone:_UTC_i
sub ebx, edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x100
call fcn.14001c060
test ebx, ebx
je 0x140018ca7
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rax, str.:_02i
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x100
call fcn.14001c060
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
test rcx, rcx
jne 0x140018cbb
test rdx, rdx
jne 0x140018cf9
cmp rdx, 0x7fffffff
ja 0x140018cf9
test rdx, rdx
je 0x140018cf9
sub r12, rdx
sub r13, rcx
nop
lea rax, [rdx + r12]
test rax, rax
je 0x140018cee
movzx eax, byte [rcx + r13]
test al, al
je 0x140018cee
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140018cd0
jmp 0x140018cf3
test rdx, rdx
jne 0x140018cf6
dec rcx
mov byte [rcx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.________________________________________________________________________________________________________________________________________________________________r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.local_DateTime_____________PID___TID___Lvl_Type__ExitCode___Message_Sourcefile_Line_r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.local_DateTime_____________PID___TID___Lvl_Type__ExitCode___Message_Sourcefile_Line_r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str._______r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str._______r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14001cea0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret