Function at 0x140001194
Capabilities:
Connect pipe
Create pipe
Create thread
Get token membership

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf8
mov r13, rcx
mov edx, dword [0x14001d5fc]
xor r14d, r14d
movzx r8d, word [0x14001d600]
lea rcx, str.advapi32
mov rax, qword [0x140024c20]
xor r12d, r12d
xor rax, rsp
movabs rbx, 0xffffffffffffffff
mov qword [rsp + 0xe8], rax
xor esi, esi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0xd0], r12
mov dword [rsp + 0x60], edx
mov word [rsp + 0x64], r8w
mov qword [rsp + 0xe0], r12
call qword [sym.imp.orauts.dll_GetModuleHandleA]
test rax, rax
je 0x14000163c
mov rcx, rax
lea rdx, str.IsWellKnownSid
call qword [sym.imp.orauts.dll_GetProcAddress]
mov rdi, rax
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], esi
mov edx, 2
mov dword [rsp + 0x30], esi
mov r8d, 0x20
mov r9d, 0x220
lea rax, [rsp + 0xc8]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000161e
mov dword [rsp + 0x70], esi
mov ecx, 1
mov dword [rsp + 0x84], esi
lea rdx, [rsp + 0x68]
mov rsi, qword [rsp + 0xc8]
xor r8d, r8d
mov eax, 2
lea r9, [rsp + 0xd0]
mov dword [rsp + 0x68], 0x1fffff
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x88], eax
mov qword [rsp + 0x90], rsi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x140001600
mov ecx, 0x40
mov edx, 0x28
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x1400015e2
mov rcx, rax
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1400015c4
mov rcx, qword [rsp + 0xe0]
mov edx, 1
mov r8, qword [rsp + 0xd0]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1400015a6
mov rax, qword [rsp + 0xe0]
lea r14, [rsp + 0x98]
mov dword [rsp + 0x98], 0x18
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0xc0], r15
lea rcx, str..pipe_srvmremotexecpipev2
mov edx, 3
mov r8d, 6
mov r9d, 0xff
mov dword [rsp + 0x20], 0x213c
mov dword [rsp + 0x28], 0x216c
mov dword [rsp + 0x30], 0x4e20
mov qword [rsp + 0x38], r14
call qword [sym.imp.orauts.dll_CreateNamedPipeA]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x14000157b
mov rcx, r13
lea rdx, str.__s:_d__Created_Named_Pipe
lea r8, str.sprvmrex.c
mov r9d, 0x128
call fcn.140005720
mov edx, 1
mov rcx, rbx
mov r8d, edx
lea r9, [rsp + 0xd8]
mov qword [rsp + 0x20], r12
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rax
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x14000154f
test rdi, rdi
je 0x14000153a
mov edx, 0x1a
mov rcx, qword [rsp + 0xd8]
call rdi
test eax, eax
je 0x140001517
mov rcx, rbx
xor edx, edx
call qword [sym.imp.orauts.dll_ConnectNamedPipe]
test eax, eax
je 0x1400014e8
mov rcx, rbx
mov r15, qword [rsp + 0xc8]
mov dword [rsp + 0xbc], 0
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
je 0x1400014ca
call qword [sym.imp.orauts.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf01ff
mov r8d, 1
lea r9, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x1400014ac
mov rcx, qword [rsp + 0xb0]
mov rdx, r15
lea r8, [rsp + 0xbc]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140001484
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x140001327
call qword [sym.imp.orauts.dll_CloseHandle]
cmp dword [rsp + 0xbc], 0
jne 0x14000134e
mov rcx, rbx
call qword [sym.imp.orauts.dll_CloseHandle]
mov rcx, r13
lea rdx, str._n_rejecting_non_admin_user_message_n
call fcn.140005720
jmp 0x1400011ca
mov ecx, 1
mov edx, 8
call qword [sym.imp.MSVCR100.dll_calloc]
mov rsi, rax
mov rcx, r13
lea rdx, str._n_Client_established_connection
mov qword [rsi], rbx
call fcn.140005720
xor ecx, ecx
lea r8, [0x140001680]
xor edx, edx
mov r9, rsi
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
call qword [sym.imp.orauts.dll_CreateThread]
mov r15, rax
test r15, r15
je 0x1400013c1
mov rcx, r13
lea rdx, str._n_sprmrex:_Closing_handle_for_this_thread
call fcn.140005720
mov rcx, r15
call qword [sym.imp.orauts.dll_CloseHandle]
jmp 0x1400011ca
mov rcx, r13
lea rdx, str._n_sprmrex:_Unable_to_create_thread_for_this_client
mov r15, qword [rsp + 0xc0]
call fcn.140005720
mov r14d, 4
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.OS_Error___d_
mov r8d, eax
call fcn.1400059f0
nop
test rsi, rsi
je 0x140001405
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_free]
cmp rbx, 0xffffffffffffffff
je 0x140001414
mov rcx, rbx
call qword [sym.imp.orauts.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140001427
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14000143a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14000144d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x140001460
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.14001c150
mov eax, r14d
add rsp, 0xf8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.checking_pipes_membership_failed__u_n
mov r8d, eax
call fcn.1400058d0
mov dword [rsp + 0xbc], 0
jmp 0x14000130d
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.open_current_thread_token_failed__u
mov r8d, eax
call fcn.1400058d0
nop
jmp 0x140001331
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.impersonate_named_pipe_client_failed__u
mov r8d, eax
call fcn.1400058d0
nop
jmp 0x140001331
call qword [sym.imp.orauts.dll_GetLastError]
cmp eax, 0x217
je 0x14000129e
mov rcx, r13
lea rdx, str._n_sprmrex:_The_client_could_not_connect__so_closing_handle_for_this_pipe
call fcn.140005720
mov rcx, rbx
call qword [sym.imp.orauts.dll_CloseHandle]
nop
jmp 0x1400011ca
mov rcx, r13
lea rdx, str.pipe_was_already_created_by_a_non_admin_user_n
mov r15, qword [rsp + 0xc0]
mov r14d, 7
call fcn.140005720
nop
jmp 0x1400013f7
mov rcx, r13
lea rdx, str.handle_not_checked_for_ownership
call fcn.140005720
nop
jmp 0x14000128b
mov r15, qword [rsp + 0xc0]
call qword [sym.imp.orauts.dll_GetLastError]
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.error_while_getting_pipe_owner___d_n
mov r8d, eax
call fcn.140005720
nop
jmp 0x1400013d8
mov r15, qword [rsp + 0xc0]
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.Failed_to_create_Named_Pipe__d
mov r8d, eax
call fcn.1400059f0
mov r14d, 7
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.Set_security_descriptor_DACL_failed_with_error__u_n
mov r8d, eax
call fcn.1400058d0
nop
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.Initialize_security_descriptor_failed_with_error__u_n
mov r8d, eax
call fcn.1400058d0
nop
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.alloc_failed_error__u_n
mov r8d, eax
call fcn.140005720
nop
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.Set_entries_in_ACL_failed_with_error__u_n
mov r8d, eax
call fcn.140005720
nop
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.Allocate_and_initialize_sid_failed_with_error__u_n
mov r8d, eax
call fcn.140005720
nop
jmp 0x1400013f7
call qword [sym.imp.orauts.dll_GetLastError]
mov rcx, r13
lea rdx, str.error_while_getting_handle_for_advapi32___d_n
mov r8d, eax
call fcn.140005720
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.14001c150
xor eax, eax
add rsp, 0xf8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret