Function at 0x14000e0e0
Capabilities:
Accept command line arguments
Bypass uac via icmluautil
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov esi, 5
mov qword [rsp + 0x20], 0
mov edi, esi
mov r14, r9
nop word [rax + rax]
call fcn.1400010ef
sub rdi, 1
jne 0x14000e120
mov ebx, 2
mov edi, ebx
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x14000e152
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x14000e1a9
dec eax
cmp eax, 1
jbe 0x14000e1a3
cmp ecx, 3
jne 0x14000e166
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e1a9
cmp ecx, 4
je 0x14000e193
cmp ecx, esi
jne 0x14000e177
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14000e1a9
cmp ecx, 6
je 0x14000e19b
cmp ecx, 7
jne 0x14000e189
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x14000e1a9
cmp ecx, 8
je 0x14000e19b
cmp ecx, 9
jne 0x14000e1a9
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14000e1a9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x14000e1a9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rdi, 1
jne 0x14000e132
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rdi, rsi
mov dword [rsp + 0x28], 0x30
call fcn.1400010ef
sub rdi, 1
jne 0x14000e1c8
mov rdi, rbx
nop word [rax + rax]
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x14000e200
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x14000e257
dec eax
cmp eax, 1
jbe 0x14000e251
cmp ecx, 3
jne 0x14000e214
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e257
cmp ecx, 4
je 0x14000e241
cmp ecx, esi
jne 0x14000e225
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14000e257
cmp ecx, 6
je 0x14000e249
cmp ecx, 7
jne 0x14000e237
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x14000e257
cmp ecx, 8
je 0x14000e249
cmp ecx, 9
jne 0x14000e257
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14000e257
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x14000e257
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rdi, 1
jne 0x14000e1e0
mov dword [rsp + 0x3c], 4
mov rdi, rsi
call fcn.1400010ef
sub rdi, 1
jne 0x14000e268
mov rdi, rbx
nop word [rax + rax]
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x14000e2a0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x14000e2f7
dec eax
cmp eax, 1
jbe 0x14000e2f1
cmp ecx, 3
jne 0x14000e2b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e2f7
cmp ecx, 4
je 0x14000e2e1
cmp ecx, esi
jne 0x14000e2c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14000e2f7
cmp ecx, 6
je 0x14000e2e9
cmp ecx, 7
jne 0x14000e2d7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x14000e2f7
cmp ecx, 8
je 0x14000e2e9
cmp ecx, 9
jne 0x14000e2f7
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14000e2f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x14000e2f7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rdi, 1
jne 0x14000e280
movups xmm0, xmmword [str.Elevation:Administrator_new:]
movzx eax, word [0x140044318]
lea rcx, [rsp + 0x60]
movups xmm1, xmmword [0x1400442f0]
sub rcx, rbx
mov word [rsp + 0x98], ax
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x140044300]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x80], xmm0
movsd xmm0, qword [0x140044310]
movsd qword [rsp + 0x90], xmm0
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14000e350
movaps xmm0, xmmword [str.3E5FC7F9_9A51_4367_9063_A120244FBEC7]
lea r9, [rsp + 0x20]
movaps xmm1, xmmword [0x140044330]
lea r8, [0x140044410]
mov eax, dword [0x140044368]
lea rdx, [rsp + 0x28]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [0x140044340]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [0x140044350]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [0x140044360]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov dword [rcx + 0x48], eax
movzx eax, word [0x14004436c]
mov word [rcx + 0x4c], ax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoGetObject]
mov ebp, eax
mov rdi, rsi
call fcn.1400010ef
sub rdi, 1
jne 0x14000e3c8
mov rdi, rbx
nop word [rax + rax]
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x14000e400
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x14000e457
dec eax
cmp eax, 1
jbe 0x14000e451
cmp ecx, 3
jne 0x14000e414
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e457
cmp ecx, 4
je 0x14000e441
cmp ecx, esi
jne 0x14000e425
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14000e457
cmp ecx, 6
je 0x14000e449
cmp ecx, 7
jne 0x14000e437
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x14000e457
cmp ecx, 8
je 0x14000e449
cmp ecx, 9
jne 0x14000e457
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14000e457
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x14000e457
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rdi, 1
jne 0x14000e3e0
mov rax, qword [rsp + 0x20]
mov qword [r14], rax
call fcn.1400010ef
sub rsi, 1
jne 0x14000e465
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
test eax, eax
jne 0x14000e48e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x14000e4e7
lea ecx, [rax - 1]
cmp ecx, 1
jbe 0x14000e4e1
cmp eax, 3
jne 0x14000e4a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e4e7
cmp eax, 4
je 0x14000e4d1
cmp eax, 5
jne 0x14000e4b5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14000e4e7
cmp eax, 6
je 0x14000e4d9
cmp eax, 7
jne 0x14000e4c7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x14000e4e7
cmp eax, 8
je 0x14000e4d9
cmp eax, 9
jne 0x14000e4e7
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x14000e4e7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x14000e4e7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x14000e470
mov eax, ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000fa30
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret