Function at 0x1400c1840
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x160], xmm6
mov qword [rbp + 0x158], 0xfffffffffffffffe
call fcn.1400c1660
test al, al
je 0x1400c1908
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400c1bff
lea rax, str.Already_running_as_an_administrator._No_need_to_elevate.
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 1
mov qword [rbp + 0xb8], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
lea rcx, str.src_admin.rs
call fcn.1401a7c10
lea rcx, str.ICBM::adminsrcml.rs
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], 0xb
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], 0xb
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0xa8]
lea r8, [rbp + 0x38]
mov edx, 3
xor r9d, r9d
call fcn.1401a7b20
jmp 0x1400c1bff
xor ecx, ecx
mov edx, 2
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0x144], eax
test eax, eax
je 0x1400c198f
lea rax, [rbp + 0x144]
mov qword [rbp + 0x38], rax
lea rax, [0x140204820]
mov qword [rbp + 0x40], rax
lea rax, [0x14031afe8]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 1
mov qword [rbp + 0xc8], 0
lea rax, [rbp + 0x38]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], 1
lea rsi, [rbp - 0x50]
lea rdx, [rbp + 0xa8]
mov rcx, rsi
call fcn.14022fac0
mov rcx, rsi
call fcn.14022f750
jmp 0x1400c1c01
lea rax, str.3E5FC7F9_9A51_4367_9063_A120244FBEC73E000D72_A845_4CD9_BD83_80C07C3B881FBA126F01_2166_11D1_B1D0_00805FC1270E3AD05575_8857_4850_9277_11B85BDB8E09Failed_to_elevate_process_using_any_of_the_provided_CLSIDs.Elevation:Administrator_new:
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0x24
lea rax, [0x14031aedc]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0x24
lea rax, [0x14031af00]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x24
lea rax, [0x14031af24]
mov qword [rbp - 8], rax
mov qword [rbp], 0x24
xor edi, edi
lea rsi, [rbp + 0x38]
lea rbx, [rbp + 0xa8]
lea r12, [rbp + 8]
movabs r14, 0x10000000070
xorps xmm6, xmm6
mov r15, qword [sym.imp.shell32.dll_ShellExecuteExW]
jmp 0x1400c1a14
add rdi, 0x10
cmp rdi, 0x40
je 0x1400c1c1c
lea rax, [rdi + rbp]
add rax, 0xffffffffffffffc8
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0x38], rax
lea rax, [0x14003b610]
mov qword [rbp + 0x40], rax
lea rax, [0x14031afa8]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 2
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], 1
lea rcx, [rbp + 0x20]
mov rdx, rbx
call fcn.14022fac0
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x150], rax
mov rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x118]
mov qword [rbp + 0x148], rdx
call fcn.1400c1790
mov r8d, 5
mov rcx, r12
lea rdx, str.runasFailed_to_initialize_COM:
call fcn.1400c1790
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x138], rax
mov r13, qword [rbp + 0x120]
mov rcx, rbx
call fcn.140203500
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 0
mov rcx, qword [rbp + 0x138]
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], r13
lea rax, [rbp + 0x58]
movups xmmword [rax], xmm6
mov dword [rbp + 0x68], 1
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm1
mov eax, dword [rbp + 0x100]
mov dword [rbp + 0x90], eax
movups xmm0, xmmword [rbp + 0x108]
movups xmmword [rbp + 0x98], xmm0
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x1400c1b4d
add rdx, rdx
mov r8d, 2
call fcn.1400fcbd0
mov rcx, rsi
call r15
test eax, eax
jne 0x1400c1bbe
call fcn.140203920
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb0], edx
test edx, edx
je 0x1400c1bbe
test rax, rax
je 0x1400c1b7a
mov rcx, rbx
call fcn.14010c210
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x1400c1b97
add rdx, rdx
mov r8d, 2
mov rcx, r13
call fcn.1400fcbd0
mov rdx, qword [rbp + 0x150]
test rdx, rdx
je 0x1400c1a10
mov r8d, 1
mov rcx, qword [rbp + 0x148]
call fcn.1400fcbd0
jmp 0x1400c1a10
mov rdx, qword [rbp + 0x118]
test rdx, rdx
je 0x1400c1bdb
add rdx, rdx
mov r8d, 2
mov rcx, r13
call fcn.1400fcbd0
mov rdx, qword [rbp + 0x150]
test rdx, rdx
je 0x1400c1bf9
mov r8d, 1
mov rcx, qword [rbp + 0x148]
call fcn.1400fcbd0
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
movaps xmm6, xmmword [rbp + 0x160]
add rsp, 0x1f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [0x14031af48]
mov edx, 0x3b
call fcn.14022f800
jmp 0x1400c1c01