Function at 0x14005dafd
Capabilities:
Terminate process

Disassembly:
jmp 0x1400fee80
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x1098
call fcn.14005bb90
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2fa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x10b8]
mov rax, qword [0x14016a048]
xor rax, rbp
mov qword [rbp + 0x1050], rax
lea rcx, [0x14018404a]
call fcn.14005efcf
mov edx, 0x3b8
lea rcx, [rbp + 0x10]
call fcn.14005e37c
lea rax, [rbp + 0xa28]
mov qword [rbp + 0xa68], rax
lea rax, [rbp + 0xa88]
mov qword [rbp + 0xac8], rax
lea rdx, [0x14012e937]
mov rcx, qword [rbp + 0xa68]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str.CoercedPotato_is_an_automated_tool_for_privilege_escalation_exploit_using_SeImpersonatePrivilege_or_SeImpersonatePrimaryToken.
mov rcx, qword [rbp + 0xac8]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r8, qword [rbp + 0x1040]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005cbad
nop
cmp dword [rbp + 0x1080], 1
jne 0x1400fef7f
lea rcx, str.Use___help_to_show_all_usefull_information._r_n
call fcn.14005b235
lea rcx, str.____Exiting..._r_n
call fcn.14005b235
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp + 0x3e8]
call fcn.14005ef75
nop
lea rax, [rbp + 0xae8]
mov qword [rbp + 0xb28], rax
lea rax, [rbp + 0xb48]
mov qword [rbp + 0xb88], rax
lea rdx, str.Program_to_execute_as_SYSTEM__i.e._cmd.exe_
mov rcx, qword [rbp + 0xb28]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str._c___command
mov rcx, qword [rbp + 0xb88]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1040]
lea r8, [rbp + 0x3e8]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005ea98
mov dl, 1
mov rcx, rax
call fcn.14005b523
lea rcx, [rbp + 0x428]
call fcn.14005ef75
nop
lea rax, [rbp + 0xba8]
mov qword [rbp + 0xbe8], rax
lea rax, [rbp + 0xc08]
mov qword [rbp + 0xc48], rax
lea rdx, str.Optionnal_interface_to_use__default_:_ALL___Possible_values_:_ms_rprn__ms_efsr
mov rcx, qword [rbp + 0xbe8]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str._i___interface
mov rcx, qword [rbp + 0xc48]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1040]
lea r8, [rbp + 0x428]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005ea98
mov dword [rbp + 0x464], 0xffffffff
lea rax, [rbp + 0xc68]
mov qword [rbp + 0xca8], rax
lea rax, [rbp + 0xcc8]
mov qword [rbp + 0xd08], rax
lea rdx, str.Optionnal_exploit_ID__Only_usuable_if_interface_is_defined___n____ms_rprn_:__n____0__RpcRemoteFindFirstPrinterChangeNotificationEx___n____1__RpcRemoteFindFirstPrinterChangeNotification___n____ms_efsr__n____0__EfsRpcOpenFileRaw___n____1__EfsRpcEncryptFileSrv___n____2__EfsRpcDecryptFileSrv___n____3__EfsRpcQueryUsersOnFile___n____4__EfsRpcQueryRecoveryAgents___n____5__EfsRpcRemoveUsersFromFile___n____6__EfsRpcAddUsersToFile___n____7__EfsRpcFileKeyInfo____NOT_WORKING_n____8__EfsRpcDuplicateEncryptionInfoFile___n____9__EfsRpcAddUsersToFileEx___n____10__EfsRpcFileKeyInfoEx____NOT_WORKING_n____11__EfsRpcGetEncryptedFileMetadata___n____12__EfsRpcEncryptFileExSrv___n____13__EfsRpcQueryProtectors___n
mov rcx, qword [rbp + 0xca8]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str._n___exploitId
mov rcx, qword [rbp + 0xd08]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1040]
lea r8, [rbp + 0x464]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005c482
mov byte [rbp + 0x484], 0
lea rax, [rbp + 0xd28]
mov qword [rbp + 0xd68], rax
lea rax, [rbp + 0xd88]
mov qword [rbp + 0xdc8], rax
lea rdx, str.Force_all_RPC_functions_even_if_it_says_Exploit_worked___Default_value_:_false_
mov rcx, qword [rbp + 0xd68]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str._f___force
mov rcx, qword [rbp + 0xdc8]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1040]
lea r8, [rbp + 0x484]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005c13f
mov byte [rbp + 0x4a4], 1
lea rax, [rbp + 0xde8]
mov qword [rbp + 0xe28], rax
lea rax, [rbp + 0xe48]
mov qword [rbp + 0xe88], rax
lea rdx, str.Set_wether_the_process_should_be_run_within_the_same_shell_or_open_a_new_window.__Default_value_:_true_
mov rcx, qword [rbp + 0xe28]
call fcn.14005ccca
mov qword [rbp + 0x1038], rax
mov rax, qword [rbp + 0x1038]
mov qword [rbp + 0x1040], rax
lea rdx, str.__interactive
mov rcx, qword [rbp + 0xe88]
call fcn.14005ccca
mov qword [rbp + 0x1048], rax
mov r9, qword [rbp + 0x1040]
lea r8, [rbp + 0x4a4]
mov rdx, qword [rbp + 0x1048]
lea rcx, [rbp + 0x10]
call fcn.14005c13f
nop
mov r8, qword [rbp + 0x1088]
mov edx, dword [rbp + 0x1080]
lea rcx, [rbp + 0x10]
call fcn.14005baa5
nop
jmp 0x1400ff26f
lea rcx, [rbp + 0x3e8]
call fcn.14005b582
mov qword [rbp + 0x4e8], rax
lea rcx, [rbp + 0x3e8]
call fcn.14005ddc8
inc rax
mov qword [rbp + 0x508], rax
mov eax, 2
mul qword [rbp + 0x508]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14005cbb2
mov qword [rbp + 0xec8], rax
mov rax, qword [rbp + 0xec8]
mov qword [rbp + 0x528], rax
mov qword [rbp + 0x548], 0
mov rax, qword [rbp + 0x508]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x4e8]
mov r8, qword [rbp + 0x508]
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 0x548]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
call fcn.14005d472
mov rdx, rax
lea rcx, [rbp + 0x568]
call fcn.14005c504
nop
mov rax, qword [rbp + 0x528]
mov qword [0x14016de70], rax
movzx eax, byte [rbp + 0x4a4]
mov dword [section..data], eax
lea rcx, [rbp + 0x428]
call fcn.14005be88
movzx eax, al
test eax, eax
je 0x1400ff386
cmp dword [rbp + 0x464], 0xffffffff
je 0x1400ff386
mov edx, dword [rbp + 0x464]
lea rcx, [0x1401316e0]
call fcn.14005b235
lea rcx, str.Please_use_rpcInterface_parameter_before_defining_exploitId.__r_n
call fcn.14005b235
lea rcx, str.____Exiting..._r_n
call fcn.14005b235
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp + 0x428]
call fcn.14005be88
movzx eax, al
test eax, eax
je 0x1400ff43d
cmp dword [rbp + 0x464], 0xffffffff
jne 0x1400ff43d
lea rax, [rbp + 0xee8]
mov qword [rbp + 0xf28], rax
lea rdx, [rbp + 0x568]
mov rcx, qword [rbp + 0xf28]
call fcn.14005b0dc
mov qword [rbp + 0x1038], rax
mov r9, qword [rbp + 0x1038]
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.14005bfcd
mov dword [rbp + 0xf44], 0
lea rcx, [rbp + 0x568]
call fcn.14005e5b6
nop
lea rcx, [rbp + 0x428]
call fcn.14005bbcc
nop
lea rcx, [rbp + 0x3e8]
call fcn.14005bbcc
nop
lea rcx, [rbp + 0x10]
call fcn.14005bea1
mov eax, dword [rbp + 0xf44]
jmp 0x1400ff545
lea rdx, str.ms_rprn
lea rcx, [rbp + 0x428]
call fcn.14005c923
movzx eax, al
test eax, eax
je 0x1400ff4a2
lea rax, [rbp + 0xf68]
mov qword [rbp + 0xfa8], rax
lea rdx, [rbp + 0x568]
mov rcx, qword [rbp + 0xfa8]
call fcn.14005b0dc
mov qword [rbp + 0x1038], rax
mov r9, qword [rbp + 0x1038]
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.14005d274
jmp 0x1400ff505
lea rdx, str.ms_efsr
lea rcx, [rbp + 0x428]
call fcn.14005c923
movzx eax, al
test eax, eax
je 0x1400ff505
lea rax, [rbp + 0xfc8]
mov qword [rbp + 0x1008], rax
lea rdx, [rbp + 0x568]
mov rcx, qword [rbp + 0x1008]
call fcn.14005b0dc
mov qword [rbp + 0x1038], rax
mov r9, qword [rbp + 0x1038]
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.14005cc2f
mov dword [rbp + 0x1024], 0
lea rcx, [rbp + 0x568]
call fcn.14005e5b6
nop
lea rcx, [rbp + 0x428]
call fcn.14005bbcc
nop
lea rcx, [rbp + 0x3e8]
call fcn.14005bbcc
nop
lea rcx, [rbp + 0x10]
call fcn.14005bea1
mov eax, dword [rbp + 0x1024]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14012c150]
call fcn.14005e462
mov rax, rdi
mov rcx, qword [rbp + 0x1050]
xor rcx, rbp
call fcn.14005ceaa
lea rsp, [rbp + 0x1068]
pop rdi
pop rbp
ret