Function at 0x14004cca4
Capabilities:
Create pipe
Create two anonymous pipes
Impersonate user

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r12d, r9d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], r8
mov r13, qword [rbp + 0x130]
mov r15, qword [rbp + 0x140]
mov rax, qword [rbp + 0x148]
mov qword [rbp - 0x80], rax
xor r14d, r14d
call fcn.1400497c4
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
xor edx, edx
lea r8d, [r14 + 0x64]
lea rcx, [rbp + 0x34]
call fcn.1400522a0
mov dword [rbp + 0x30], 0x68
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
test r15, r15
je 0x14004cdd0
mov dword [rbp - 0x40], SafeArrayCopy
mov dword [rbp - 0x30], 1
mov qword [rbp - 0x38], r14
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14004d00b
xor r9d, r9d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14004d00b
xor r8d, r8d
lea edx, [r14 + 1]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14004d00b
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x88], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x80], rax
bts dword [rbp + 0x6c], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], r14
xor r8d, r8d
lea rdx, [0x1400647ac]
lea rcx, [rbp + 0xa0]
call fcn.140001bf0
nop
lea rdx, [0x1400647b0]
mov rcx, rbx
call fcn.1400048f8
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x14004cf92
lea rdx, [0x1400647c4]
mov rcx, rbx
call fcn.1400048f8
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
cmp qword [rbx + 0x10], rax
cmovb rax, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004ce4f
mov rdx, qword [rbx]
mov r8, rax
lea rcx, [rbp - 0x40]
call fcn.140001bf0
lea rcx, [rbp + 0xa0]
call fcn.1400016f0
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
lea rcx, [rbp - 0x40]
call fcn.1400016f0
lea rdx, [0x1400647c8]
mov rcx, rbx
call fcn.1400048f8
lea rcx, [rax + 1]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov rax, qword [rbx + 0x10]
cmp rax, rcx
jb 0x14004d41e
sub rax, rcx
or rdx, 0xffffffffffffffff
mov r8, rdx
cmp rax, rdx
cmovb r8, rax
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004cee7
mov rax, qword [rbx]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x60]
call fcn.140001bf0
lea rax, [rsp + 0x60]
cmp rbx, rax
je 0x14004cf2c
mov rcx, rbx
call fcn.1400016f0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbx + 0x10], xmm1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rcx, [rsp + 0x60]
call fcn.1400016f0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
mov r14, qword [rbp + 0xb0]
cmp r14, 1
jne 0x14004cf99
mov r8, r14
lea rcx, [0x1400647bc]
test r14, r14
je 0x14004cf7f
sub rdx, rcx
movzx eax, word [rdx + rcx]
cmp ax, word [rcx]
jne 0x14004cf99
add rcx, 2
sub r8, 1
jne 0x14004cf6c
lea rdx, [0x1400647c0]
lea rcx, [rbp + 0xa0]
call fcn.14000374c
mov r14, qword [rbp + 0xb0]
lea rcx, [0x140072d28]
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0xf
cmova rcx, qword [0x140072d28]
mov r8, qword [0x140072d38]
cmp r8, 6
jne 0x14004d1e3
lea rdx, str.System
call fcn.1400526e0
xor r9d, r9d
test eax, eax
jne 0x14004d1e3
mov qword [rbp - 0x50], r9
mov qword [rbp - 0x48], r9
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14004cfed
mov r8, qword [rsi]
test r14, r14
je 0x14004d032
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
jmp 0x14004d035
call fcn.140042720
nop
mov rcx, rbx
call fcn.1400016f0
nop
mov rcx, rsi
call fcn.1400016f0
nop
mov rcx, rdi
call fcn.1400016f0
xor al, al
jmp 0x14004d3f4
mov rdx, r9
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004d042
mov rcx, qword [rbx]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9d, 8
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
xor r14d, r14d
test eax, eax
je 0x14004d37e
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9d, [r14 + 2]
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rcx, qword [rbp - 0x50]
test eax, eax
jne 0x14004d0a1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004d37e
call fcn.14004e1b8
mov rcx, qword [rbp - 0x48]
call fcn.14004e1b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004d0cb
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x40]
call fcn.140001ce8
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.14004c3bc
mov r14, rax
cmp rdi, rax
je 0x14004d118
mov rcx, rdi
call fcn.1400016f0
movups xmm0, xmmword [r14]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rdi + 0x10], xmm1
xor r9d, r9d
mov qword [r14 + 0x10], r9
mov qword [r14 + 0x18], 7
mov word [r14], r9w
lea rcx, [rbp - 0x70]
call fcn.1400016f0
mov rcx, qword [rdi + 0x10]
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000c318
mov r14, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004d153
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea r8, [r8*2 + 2]
mov rcx, r14
call fcn.140051c00
xor eax, eax
mov ecx, eax
test r15, r15
setne cl
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], ecx
mov r8, r14
mov rcx, qword [rbp - 0x48]
call fcn.140048c74
mov rcx, qword [rbp - 0x50]
test eax, eax
jne 0x14004d1b5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004d376
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14000c2e4
test r13, r13
je 0x14004d395
mov rax, qword [rbp]
mov qword [r13], rax
jmp 0x14004d39f
mov rcx, qword [rdi + 0x10]
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000c318
mov r14, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004d215
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea r8, [r8*2 + 2]
mov rcx, r14
call fcn.140051c00
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14004d236
mov r8, qword [rsi]
xor eax, eax
cmp qword [rbp + 0xb0], rax
je 0x14004d25a
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
jmp 0x14004d25d
mov rdx, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004d26a
mov rcx, qword [rbx]
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r14
mov r9d, 1
call fcn.140049a18
xor ecx, ecx
test eax, eax
jne 0x14004d1c5
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14004d2a8
mov r8, qword [rsi]
cmp qword [rbp + 0xb0], rcx
je 0x14004d2ca
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
jmp 0x14004d2cd
mov rdx, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004d2da
mov rcx, qword [rbx]
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r14
mov r9d, 2
call fcn.140049a18
xor ecx, ecx
test eax, eax
jne 0x14004d1c5
mov r8, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14004d318
mov r8, qword [rsi]
cmp qword [rbp + 0xb0], rcx
je 0x14004d33a
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
jmp 0x14004d33d
mov rdx, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14004d34a
mov rcx, qword [rbx]
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r14
xor r9d, r9d
call fcn.140049a18
test eax, eax
jne 0x14004d1c5
mov rcx, r14
call fcn.14000c2e4
call fcn.140042720
nop
lea rcx, [rbp + 0xa0]
call fcn.1400016f0
jmp 0x14004d011
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14004d3b5
mov rax, qword [rbp - 0x20]
mov qword [r15], rax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14004d3c5
mov rax, qword [rbp - 8]
mov qword [rcx], rax
call fcn.140042720
nop
lea rcx, [rbp + 0xa0]
call fcn.1400016f0
nop
mov rcx, rbx
call fcn.1400016f0
nop
mov rcx, rsi
call fcn.1400016f0
nop
mov rcx, rdi
call fcn.1400016f0
mov al, 1
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14000c280
mov rbx, qword [rsp + 0x228]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400049d0
nop
int3