Function at 0x1400019c4
Capabilities:
Bypass uac via rpc

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov r15d, r9d
mov r12d, r8d
mov r13, rdx
mov rsi, rcx
xor edx, edx
mov r14b, dl
mov qword [rax - 0x120], rdx
mov dword [rax + 0x48], edx
mov rbx, qword [rsp + 0x1f8]
test rbx, rbx
je 0x140001a16
mov qword [rbx], rdx
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rdx
lea rdi, [rsp + 0x90]
xor eax, eax
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rsp + 0x140]
lea ecx, [rax + 0x38]
rep stosb byte [rdi], al
mov dword [rsp + 0x164], 1
mov word [rsp + 0x168], dx
lea rdi, [rsp + 0xd0]
lea ecx, [rax + 0x70]
rep stosb byte [rdi], al
mov qword [rsp + 0x1d8], rdx
mov qword [rsp + 0x1f8], rdx
mov dword [rsp + 0x1e8], 0x44
mov qword [rsp + 0x1e0], rdx
lea rdi, [rsp + 0xa8]
lea ecx, [rax + 0x28]
rep stosb byte [rdi], al
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ncalrpc
lea rcx, str.201ef99a_7fa0_444c_9399_19ba84f12a1a
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov edi, eax
test eax, eax
jne 0x140001bb2
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov edi, eax
lea rcx, [rsp + 0x1d8]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test edi, edi
jne 0x140001bb2
mov edx, dword [rsp + 0x1e8]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
xor edi, edi
test rax, rax
je 0x140001ba5
lea r9, [rsp + 0x1e8]
mov r8, rax
xor edx, edx
lea ecx, [rdi + 0x16]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140001b92
lea eax, [rdi + 3]
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xb4], eax
mov qword [rsp + 0xac], 1
mov qword [rsp + 0xc8], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r9d, [rdi + 0xa]
lea r8d, [rdi + 6]
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov edi, eax
test eax, eax
jne 0x140001b9a
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x1e0], rax
and qword [rsp + 0x1f8], 0
jmp 0x140001b9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001baa
mov edi, 8
mov rsi, qword [rsp + 0x1b0]
cmp qword [rsp + 0x1f8], 0
je 0x140001bcb
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
test edi, edi
jne 0x140001d5d
lea edx, [rdi + 0x70]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncInitializeHandle]
mov edi, eax
test eax, eax
jne 0x140001c1a
mov dword [rsp + 0xfc], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x100], rax
test rax, rax
jne 0x140001c1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x140001d5d
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
or dword [rsp + 0x60], 0xffffffff
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x50], rax
lea rax, str.WinSta0Default
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rsi
mov r9, qword [rsp + 0x1e0]
lea r8, [rsp + 0xd0]
lea rdx, [0x140023fa2]
lea rcx, [0x140023f00]
call qword [sym.imp.RPCRT4.dll_NdrAsyncClientCall]
or edi, 0xffffffff
mov edx, edi
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
jne 0x140001cc5
or ecx, 0xffffffff
call qword [sym.imp.RPCRT4.dll_RpcRaiseException]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncCompleteCall]
test eax, eax
jne 0x140001d25
cmp qword [rsp + 0x88], 0
jne 0x140001d25
test rbx, rbx
je 0x140001d1a
mov rax, qword [rsp + 0x90]
mov qword [rbx], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0xa0]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0xa4]
mov dword [rbx + 0x14], eax
mov r14b, 1
mov byte [rsp + 0x80], r14b
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140001d41
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x100], 0
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
jmp 0x140001d5d
mov al, r14b
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret