Function at 0x1400585e0
Capabilities:
Execute command
Terminate process

Disassembly:
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3c8], 0xfffffffffffffffe
mov dword [rbp + 0x214], 0
call fcn.140056e50
call fcn.14005d6d0
test al, 1
jne 0x1400588e9
xor eax, eax
mov ecx, eax
lea rdx, [rbp + 0x110]
mov r8d, 0x104
call qword [0x14007b1f8]
mov rax, qword [0x14007b2a0]
mov qword [rbp + 0x40], rax
lea rax, str.runas
mov qword [rbp + 0x220], rax
lea rax, [rbp + 0x104]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x228], rax
mov dword [rax], 2
mov rcx, rax
add rcx, 4
mov qword [rbp + 0x88], rcx
mov rcx, qword [rbp + 0x220]
mov cl, byte [rcx]
mov qword [rbp + 0x2b0], 0
mov byte [rbp + 0x2af], cl
mov qword [rbp + 0x2a0], rax
mov rcx, qword [rbp + 0x2a0]
movsx eax, byte [rbp + 0x2af]
mov dword [rbp + 0x48], eax
mov rdx, qword [rbp + 0x2b0]
call fcn.140054720
mov edx, dword [rbp + 0x48]
mov rcx, qword [rbp + 0x88]
mov r8b, al
mov rax, qword [rbp + 0x80]
movsx r8d, r8b
xor edx, r8d
mov byte [rax + 4], dl
add rcx, 1
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbp + 0x220]
mov cl, byte [rcx + 1]
mov qword [rbp + 0x298], 1
mov byte [rbp + 0x297], cl
mov qword [rbp + 0x288], rax
mov rcx, qword [rbp + 0x288]
movsx eax, byte [rbp + 0x297]
mov dword [rbp + 0x4c], eax
mov rdx, qword [rbp + 0x298]
call fcn.140054720
mov edx, dword [rbp + 0x4c]
mov rcx, qword [rbp + 0x50]
mov r8b, al
mov rax, qword [rbp + 0x80]
movsx r8d, r8b
xor edx, r8d
mov byte [rax + 5], dl
add rcx, 1
mov qword [rbp + 0x60], rcx
mov rcx, qword [rbp + 0x220]
mov cl, byte [rcx + 2]
mov qword [rbp + 0x280], 2
mov byte [rbp + 0x27f], cl
mov qword [rbp + 0x270], rax
mov rcx, qword [rbp + 0x270]
movsx eax, byte [rbp + 0x27f]
mov dword [rbp + 0x5c], eax
mov rdx, qword [rbp + 0x280]
call fcn.140054720
mov edx, dword [rbp + 0x5c]
mov rcx, qword [rbp + 0x60]
mov r8b, al
mov rax, qword [rbp + 0x80]
movsx r8d, r8b
xor edx, r8d
mov byte [rax + 6], dl
add rcx, 1
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x220]
mov cl, byte [rcx + 3]
mov qword [rbp + 0x268], 3
mov byte [rbp + 0x267], cl
mov qword [rbp + 0x258], rax
mov rcx, qword [rbp + 0x258]
movsx eax, byte [rbp + 0x267]
mov dword [rbp + 0x6c], eax
mov rdx, qword [rbp + 0x268]
call fcn.140054720
mov edx, dword [rbp + 0x6c]
mov rcx, qword [rbp + 0x70]
mov r8b, al
mov rax, qword [rbp + 0x80]
movsx r8d, r8b
xor edx, r8d
mov byte [rax + 7], dl
add rcx, 1
mov qword [rbp + 0x90], rcx
mov rcx, qword [rbp + 0x220]
mov cl, byte [rcx + 4]
mov qword [rbp + 0x250], 4
mov byte [rbp + 0x24f], cl
mov qword [rbp + 0x240], rax
mov rcx, qword [rbp + 0x240]
movsx eax, byte [rbp + 0x24f]
mov dword [rbp + 0x7c], eax
mov rdx, qword [rbp + 0x250]
call fcn.140054720
mov r8d, dword [rbp + 0x7c]
mov rdx, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x88]
mov r9b, al
mov rax, qword [rbp + 0x90]
movsx r9d, r9b
xor r8d, r9d
mov byte [rdx + 8], r8b
add rax, 1
add rcx, 6
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0x98]
mov byte [rax], 0
add rax, 1
cmp rax, rcx
mov qword [rbp + 0xa0], rax
jne 0x140058887
lea rcx, [rbp + 0x104]
call fcn.140058f10
mov rdx, rax
mov rax, qword [rbp + 0x40]
xor ecx, ecx
mov r9d, ecx
lea r8, [rbp + 0x110]
mov rcx, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0xe0]
mov qword [rbp + 0x30], rcx
call fcn.140058ff0
mov rcx, qword [rbp + 0x30]
call fcn.14005fda0
mov dword [rbp + 0x3c], eax
jmp 0x140058911
lea rcx, [rbp + 0xe0]
call fcn.140059070
mov eax, dword [rbp + 0x3c]
mov dword [rbp + 0x100], eax
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0x20], rcx
call fcn.1400590a0
mov rdx, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x100]
call fcn.140057dd0
mov byte [rbp + 0x2f], al
jmp 0x14005894d
mov al, byte [rbp + 0x2f]
test al, 1
jne 0x14005895d
jmp 0x140058e72
lea rax, str.User_running_as:
mov qword [rbp + 0x238], rax
lea rax, [rbp + 0xae]
mov qword [rbp + 8], rax
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x10], rax
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx]
mov byte [rbp + 0x3c7], cl
mov qword [rbp + 0x3b8], rax
mov rcx, qword [rbp + 0x3b8]
movzx eax, byte [rbp + 0x3c7]
mov dword [rbp - 0x40], eax
mov dl, 0x63
mov byte [rbp + 3], dl
call fcn.140054b00
mov ecx, dword [rbp - 0x40]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 1]
mov byte [rbp + 0x3b7], cl
mov qword [rbp + 0x3a8], rax
mov rcx, qword [rbp + 0x3a8]
movzx eax, byte [rbp + 0x3b7]
mov dword [rbp - 0x3c], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x3c]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 1], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 2]
mov byte [rbp + 0x3a7], cl
mov qword [rbp + 0x398], rax
mov rcx, qword [rbp + 0x398]
movzx eax, byte [rbp + 0x3a7]
mov dword [rbp - 0x38], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x38]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 2], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 3]
mov byte [rbp + 0x397], cl
mov qword [rbp + 0x388], rax
mov rcx, qword [rbp + 0x388]
movzx eax, byte [rbp + 0x397]
mov dword [rbp - 0x34], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x34]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 3], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 4]
mov byte [rbp + 0x387], cl
mov qword [rbp + 0x378], rax
mov rcx, qword [rbp + 0x378]
movzx eax, byte [rbp + 0x387]
mov dword [rbp - 0x30], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x30]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 4], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 5]
mov byte [rbp + 0x377], cl
mov qword [rbp + 0x368], rax
mov rcx, qword [rbp + 0x368]
movzx eax, byte [rbp + 0x377]
mov dword [rbp - 0x2c], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x2c]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 5], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 6]
mov byte [rbp + 0x367], cl
mov qword [rbp + 0x358], rax
mov rcx, qword [rbp + 0x358]
movzx eax, byte [rbp + 0x367]
mov dword [rbp - 0x28], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x28]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 6], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 7]
mov byte [rbp + 0x357], cl
mov qword [rbp + 0x348], rax
mov rcx, qword [rbp + 0x348]
movzx eax, byte [rbp + 0x357]
mov dword [rbp - 0x24], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x24]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 7], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 8]
mov byte [rbp + 0x347], cl
mov qword [rbp + 0x338], rax
mov rcx, qword [rbp + 0x338]
movzx eax, byte [rbp + 0x347]
mov dword [rbp - 0x20], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x20]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 8], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 9]
mov byte [rbp + 0x337], cl
mov qword [rbp + 0x328], rax
mov rcx, qword [rbp + 0x328]
movzx eax, byte [rbp + 0x337]
mov dword [rbp - 0x1c], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x1c]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 9], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xa]
mov byte [rbp + 0x327], cl
mov qword [rbp + 0x318], rax
mov rcx, qword [rbp + 0x318]
movzx eax, byte [rbp + 0x327]
mov dword [rbp - 0x18], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x18]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xa], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xb]
mov byte [rbp + 0x317], cl
mov qword [rbp + 0x308], rax
mov rcx, qword [rbp + 0x308]
movzx eax, byte [rbp + 0x317]
mov dword [rbp - 0x14], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x14]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xb], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xc]
mov byte [rbp + 0x307], cl
mov qword [rbp + 0x2f8], rax
mov rcx, qword [rbp + 0x2f8]
movzx eax, byte [rbp + 0x307]
mov dword [rbp - 0x10], eax
call fcn.140054b00
mov ecx, dword [rbp - 0x10]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xc], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xd]
mov byte [rbp + 0x2f7], cl
mov qword [rbp + 0x2e8], rax
mov rcx, qword [rbp + 0x2e8]
movzx eax, byte [rbp + 0x2f7]
mov dword [rbp - 0xc], eax
call fcn.140054b00
mov ecx, dword [rbp - 0xc]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xd], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xe]
mov byte [rbp + 0x2e7], cl
mov qword [rbp + 0x2d8], rax
mov rcx, qword [rbp + 0x2d8]
movzx eax, byte [rbp + 0x2e7]
mov dword [rbp - 8], eax
call fcn.140054b00
mov ecx, dword [rbp - 8]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xe], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0xf]
mov byte [rbp + 0x2d7], cl
mov qword [rbp + 0x2c8], rax
mov rcx, qword [rbp + 0x2c8]
movzx eax, byte [rbp + 0x2d7]
mov dword [rbp - 4], eax
call fcn.140054b00
mov ecx, dword [rbp - 4]
mov dl, byte [rbp + 3]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add ecx, r8d
mov byte [rax + 0xf], cl
mov rcx, qword [rbp + 0x238]
mov cl, byte [rcx + 0x10]
mov byte [rbp + 0x2c7], cl
mov qword [rbp + 0x2b8], rax
mov rcx, qword [rbp + 0x2b8]
movzx eax, byte [rbp + 0x2c7]
mov dword [rbp + 4], eax
call fcn.140054b00
mov edx, dword [rbp + 4]
mov rcx, qword [rbp + 8]
mov r8b, al
mov rax, qword [rbp + 0x10]
movzx r8d, r8b
add edx, r8d
mov byte [rax + 0x10], dl
mov byte [rax + 0x11], 0
call fcn.1400594c0
mov qword [rbp + 0x18], rax
jmp 0x140058e22
mov rdx, qword [rbp + 0x18]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140059150
mov qword [rbp - 0x48], rax
jmp 0x140058e3b
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp + 0xc0]
call fcn.1400590d0
mov qword [rbp - 0x50], rax
jmp 0x140058e54
mov rcx, qword [rbp - 0x50]
lea rdx, [0x140059580]
mov rax, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call rax
jmp 0x140058e6d
jmp 0x140058e72
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp + 0x214], 0
lea rcx, [rbp + 0xc0]
call fcn.1400579a0
mov eax, dword [rbp + 0x214]
add rsp, 0x450
pop rbp
ret