Function at 0x140005390
Capabilities:
Accept command line arguments
Get hostname
Get session user name
Get token privileges
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x140022218]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor ebx, ebx
mov r15d, r8d
mov r14, rcx
lea r13, [0x14001c67c]
test dl, dl
je 0x1400053f5
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.________________________________________________________________________________________________________________________________________________________________r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 0x400
mov byte [rbp - 0x80], bl
mov ecx, esi
lea rdi, [rbp - 0x80]
lea r8, [rbp - 0x80]
mov r9d, ebx
mov rdx, rbx
lea r10, [0x140000000]
nop
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x140005469
movzx eax, byte [rdx + r10 + 0x1c728]
test al, al
je 0x140005469
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140005440
jmp 0x14000546e
test rcx, rcx
jne 0x14000547a
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rsi
mov byte [r8], bl
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x140005496
cmp r9d, 0x8007007a
jne 0x14000549c
mov rdi, rcx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov r12d, 0x7ffffffe
test rdi, rdi
jne 0x1400054b6
test rsi, rsi
jne 0x140005548
cmp rsi, 0x7fffffff
ja 0x140005548
test rax, rax
lea r9, [0x14001b9c8]
mov r8, rdi
cmovne r9, rax
mov rcx, rsi
test rsi, rsi
jne 0x1400054e8
cmp byte [r9], bl
je 0x140005542
test rdi, rdi
je 0x140005548
jmp 0x140005542
mov r10, r12
mov r11d, ebx
mov rdx, rbx
sub r10, rsi
lea rax, [r10 + rcx]
test rax, rax
je 0x140005516
movzx eax, byte [rdx + r9]
test al, al
je 0x140005516
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x1400054f4
jmp 0x14000551b
test rcx, rcx
jne 0x140005527
dec r8
mov r11d, 0x8007007a
dec rdx
mov rcx, rsi
mov byte [r8], bl
lea r8, [rdx + rdi]
sub rcx, rdx
test r11d, r11d
jns 0x140005542
cmp r11d, 0x8007007a
jne 0x140005548
mov rdi, r8
mov rsi, rcx
cmp byte [rbp - 0x80], 0
lea rbx, [rbp - 0x80]
je 0x140005594
nop word [rax + rax]
lea rdx, str.password
mov r8d, 8
mov rcx, rbx
call fcn.14000d2fc
test eax, eax
jne 0x14000558c
add rbx, 8
cmp byte [rbx], al
je 0x14000558c
mov byte [rbx], 0x2a
inc rbx
cmp byte [rbx], 0
jne 0x140005581
inc rbx
cmp byte [rbx], 0
jne 0x140005560
test rdi, rdi
jne 0x14000559e
test rsi, rsi
jne 0x1400055e8
cmp rsi, 0x7fffffff
ja 0x1400055e8
test rsi, rsi
je 0x1400055e8
mov rcx, r12
mov rdx, r13
sub rcx, rsi
sub rdx, rdi
nop dword [rax + rax]
lea rax, [rsi + rcx]
test rax, rax
je 0x1400055dd
movzx eax, byte [rdi + rdx]
test al, al
je 0x1400055dd
mov byte [rdi], al
inc rdi
dec rsi
jne 0x1400055c0
jmp 0x1400055e2
test rsi, rsi
jne 0x1400055e5
dec rdi
mov byte [rdi], 0
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor esi, esi
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov byte [rbp - 0x80], sil
mov qword [rsp + 0x58], 0x400
mov ecx, 0x400
lea r8, [rbp - 0x80]
mov r9d, esi
mov edx, esi
lea r10, [0x140000000]
nop dword [rax]
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x140005669
movzx eax, byte [rdx + r10 + 0x1c748]
test al, al
je 0x140005669
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140005640
jmp 0x14000566e
test rcx, rcx
jne 0x14000567a
dec r8
mov r9d, 0x8007007a
dec rdx
mov eax, 0x400
mov byte [r8], sil
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x140005698
cmp r9d, 0x8007007a
jne 0x1400056a2
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140004f00
mov rcx, qword [rsp + 0x60]
mov r11, qword [rsp + 0x58]
test rcx, rcx
jne 0x1400056c5
test r11, r11
jne 0x140005709
cmp r11, 0x7fffffff
ja 0x140005709
test r11, r11
je 0x140005709
mov rdx, r12
mov r8, r13
sub rdx, r11
sub r8, rcx
nop
lea rax, [r11 + rdx]
test rax, rax
je 0x1400056fe
movzx eax, byte [rcx + r8]
test al, al
je 0x1400056fe
mov byte [rcx], al
inc rcx
dec r11
jne 0x1400056e0
jmp 0x140005703
test r11, r11
jne 0x140005706
dec rcx
mov byte [rcx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [rbp - 0x80], sil
lea rdi, str.Unknown
mov ebx, 1
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbx + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000579f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
lea r9d, [rbx + 3]
lea r8, [rsp + 0x70]
lea edx, [rbx + 0x11]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x74], esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140005794
cmp dword [rsp + 0x74], 4
cmove ebx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec ebx
je 0x1400057bd
dec ebx
je 0x1400057b4
dec ebx
jne 0x1400057c4
lea rdi, str.Limited
jmp 0x1400057c4
lea rdi, str.Full
jmp 0x1400057c4
lea rdi, str.Default
mov dword [rsp + 0x50], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
lea rax, str.Version:_24.1.4.51782____u_Bit__Session:__u__Elevation:__s_r_n
mov qword [rsp + 0x30], 0x40
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x80]
mov edx, 0x400
mov dword [rsp + 0x20], 0x100
call fcn.140009490
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 0x400
mov byte [rbp - 0x80], sil
mov ecx, edi
lea rbx, [rbp - 0x80]
lea r8, [rbp - 0x80]
mov r9d, esi
mov rdx, rsi
nop
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x14000588f
lea rax, [0x140000000]
movzx eax, byte [rdx + rax + 0x1c798]
test al, al
je 0x14000588f
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140005860
jmp 0x140005894
test rcx, rcx
jne 0x1400058a0
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], sil
lea rcx, [rbp + rdx - 0x80]
sub rax, rdx
test r9d, r9d
jns 0x1400058bc
cmp r9d, 0x8007007a
jne 0x1400058c2
mov rbx, rcx
mov rdi, rax
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, 7
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x1400058f5
test rdi, rdi
jne 0x140005984
cmp rdi, 0x7fffffff
ja 0x140005984
mov rcx, rbx
mov rax, rdi
test rdi, rdi
jne 0x140005914
test rbx, rbx
je 0x140005984
jmp 0x14000597e
mov r9, r12
mov rcx, rdi
mov r8, rbx
mov r10d, esi
mov rdx, rsi
sub r9, rdi
lea rax, [rcx + r9]
test rax, rax
je 0x140005952
lea rax, [0x140000000]
movzx eax, byte [rdx + rax + 0x1c7a8]
test al, al
je 0x140005952
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x140005926
jmp 0x140005957
test rcx, rcx
jne 0x140005963
dec r8
mov r10d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], sil
lea rcx, [rdx + rbx]
sub rax, rdx
test r10d, r10d
jns 0x14000597e
cmp r10d, 0x8007007a
jne 0x140005984
mov rbx, rcx
mov rdi, rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x1400059ae
test rdi, rdi
jne 0x1400059f8
cmp rdi, 0x7fffffff
ja 0x1400059f8
test rdi, rdi
je 0x1400059f8
mov rcx, r12
mov rdx, r13
sub rcx, rdi
sub rdx, rbx
nop dword [rax + rax]
lea rax, [rdi + rcx]
test rax, rax
je 0x1400059ed
movzx eax, byte [rbx + rdx]
test al, al
je 0x1400059ed
mov byte [rbx], al
inc rbx
dec rdi
jne 0x1400059d0
jmp 0x1400059f2
test rdi, rdi
jne 0x1400059f5
dec rbx
mov byte [rbx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x60], rax
mov eax, r15d
lea r10, [0x140000000]
and eax, 7
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov rax, qword [r10 + rax*8 + 0x1c470]
lea rcx, [rbp - 0x80]
mov edx, 0x400
mov qword [rsp + 0x30], rax
lea rax, str.LogLevel:__hs___i_
mov byte [rbp - 0x80], sil
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
mov qword [rsp + 0x58], 0x400
call fcn.140009490
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov r11, qword [rsp + 0x50]
movabs rax, 0xd6bf94d5e57a42bd
sub r11, qword [rsp + 0x68]
movabs r8, 0x8888888888888889
imul r11
lea rcx, [r11 + rdx]
sar rcx, 0x17
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov rax, r8
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 5
mov rcx, rbx
shr rcx, 0x3f
add rbx, rcx
sets cl
test cl, cl
je 0x140005aed
neg rbx
mov rax, r8
imul rbx
add rdx, rbx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, edx
test cl, cl
je 0x140005b0c
neg eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x30], eax
imul edx, edx, 0x3c
lea rax, str.__Timezone:_UTC_i
sub ebx, edx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x100
call fcn.140009490
test ebx, ebx
je 0x140005b77
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rax, str.:_02i
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x100
call fcn.140009490
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
test rcx, rcx
jne 0x140005b8b
test rdx, rdx
jne 0x140005bc9
cmp rdx, 0x7fffffff
ja 0x140005bc9
test rdx, rdx
je 0x140005bc9
sub r12, rdx
sub r13, rcx
nop
lea rax, [rdx + r12]
test rax, rax
je 0x140005bbe
movzx eax, byte [rcx + r13]
test al, al
je 0x140005bbe
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140005ba0
jmp 0x140005bc3
test rdx, rdx
jne 0x140005bc6
dec rcx
mov byte [rcx], sil
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.________________________________________________________________________________________________________________________________________________________________r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.local_DateTime_____________PID___TID___Lvl_Type__ExitCode___Message_Sourcefile_Line_r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str.local_DateTime_____________PID___TID___Lvl_Type__ExitCode___Message_Sourcefile_Line_r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str._______r_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x50]
lea rdx, str._______r_n
mov rcx, r14
mov r8d, eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14000c410
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret