Function at 0x180004cc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov r14, rcx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov dword [rbp + 0x2c0], 5
mov byte [rsp + 0x50], 0
call fcn.1800084f0
lea rcx, [rbp + 0x181]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x180], 0
call fcn.1800084f0
lea rcx, [rbp + 0x64]
xor r15d, r15d
xor edx, edx
mov r8d, 0x118
mov dword [rbp + 0x60], r15d
call fcn.1800084f0
lea rcx, [0x180019a70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180004d76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss:_Failed_to_resolve_RtlGetVersion
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov dword [rbp + 0x2c0], eax
call fcn.180004430
mov eax, dword [rbp + 0x2c0]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004d3e
lea rcx, [rbp + 0x60]
call rax
test eax, eax
je 0x180004dcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss:_RtlGetVersion_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov dword [rbp + 0x2c0], eax
call fcn.180004430
mov eax, dword [rbp + 0x2c0]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret
mov eax, dword [rbp + 0x64]
cmp eax, 6
jb 0x1800050d7
jne 0x180004de5
cmp dword [rbp + 0x68], 3
jb 0x1800050d7
mov qword [rsp + 0x3b0], rbx
mov qword [rsp + 0x3b8], rsi
mov qword [rsp + 0x3c8], rdi
call fcn.18000871c
mov ebx, eax
shl ebx, 0x10
call fcn.18000871c
mov esi, eax
or esi, ebx
call fcn.18000871c
mov ebx, eax
shl ebx, 0x10
call fcn.18000871c
mov edx, 0x104
mov edi, eax
lea r9, str..pipe_08x_08x
lea rcx, [rsp + 0x50]
or edi, ebx
mov r8d, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.180007d44
mov edx, 0x104
lea r9, str.localhostpipe_08x_08x
lea rcx, [rbp + 0x180]
mov r8d, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.180007d44
lea rdx, [rsp + 0x50]
lea rcx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._using_pipename:__s
call fcn.180004430
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov r10, qword [0x180025ea8]
lea r9, [rsp + 0x40]
mov rsi, rax
lea rax, [0x180004ab0]
lea rdx, [rsp + 0x50]
lea rcx, [0x180002520]
mov r8, rsi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
call qword [r10 + 0x168]
mov rbx, rax
test rax, rax
jne 0x180004ef2
mov r9d, 6
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._met_api__thread.create_failed
lea rcx, [0x180018d60]
mov r8d, r9d
mov dword [rbp + 0x2c0], 6
call fcn.180004430
jmp 0x18000509e
mov rcx, rax
mov rax, qword [0x180025ea8]
call qword [rax + 0x158]
test eax, eax
jne 0x180004f31
mov r9d, 5
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._met_api__thread.run_failed
lea rcx, [0x180018d60]
mov r8d, r9d
mov dword [rbp + 0x2c0], 5
call fcn.180004430
jmp 0x18000508e
test rsi, rsi
je 0x180004f73
mov edx, 0x1f4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180004f7e
mov r9d, 5
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._WaitForSingleObject_failed
lea rcx, [0x180018d60]
mov r8d, r9d
mov dword [rbp + 0x2c0], 5
call fcn.180004430
jmp 0x18000508e
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x180]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180004fdb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._CreateFile_failed
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov dword [rbp + 0x2c0], eax
call fcn.180004430
jmp 0x180005085
xor r9d, r9d
lea rdx, [0x18001ae64]
mov rcx, rax
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180005016
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._WriteFile_failed
mov dword [rbp + 0x2c0], eax
mov r9d, eax
mov r8d, eax
jmp 0x180005074
mov rcx, qword [rbx + 8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x180025ea8]
mov rcx, rbx
call qword [rax + 0x160]
mov rax, qword [0x180025ea8]
mov rcx, rbx
call qword [rax + 0x148]
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x180005080
mov r9d, 6
mov dword [rbp + 0x2c0], 6
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss._GetExitCodeThread_failed
mov r8d, r9d
lea rcx, [0x180018d60]
call fcn.180004430
test rdi, rdi
je 0x18000508e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180025ea8]
mov rcx, rbx
call qword [rax + 0x140]
mov rdi, qword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x3b0]
test rsi, rsi
je 0x1800050bc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x2c0]
mov rsi, qword [rsp + 0x3b8]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret
mov ecx, 0x78
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._ELEVATE__elevate_via_service_namedpipe_rpcss:_Windows_versions_older_than_6.3_are_unsupported
lea rcx, [0x180018d60]
mov r9d, eax
mov r8d, eax
mov dword [rbp + 0x2c0], eax
call fcn.180004430
mov eax, dword [rbp + 0x2c0]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret