Function at 0x10006fe0
Capabilities:
Bypass uac via icmluautil

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10066040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x10056770
mov dword [ebp - 0x18], 0x10056774
mov dword [ebp - 0x1c], 0x10056778
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0x18], 0
je 0x10007024
mov dword [ebp - 0x1c], 0x1005679c
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ole32.dll_StringFromCLSID]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
push 0x100573a4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x10007064
mov dword [ebp - 0x14], str.CLSID_WbemLocator
jmp 0x1000741f
push 0x10066db4
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007088
mov dword [ebp - 0x14], str.CLSID_WbemAdministrativeLocator
jmp 0x1000741f
push 0x100572d4
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100070ac
mov dword [ebp - 0x14], str.CLSID_WbemLevel1Login
jmp 0x1000741f
push 0x1004de08
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100070d0
mov dword [ebp - 0x14], str.CLSID_MofCompiler
jmp 0x1000741f
push 0x1004c8a8
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100070f4
mov dword [ebp - 0x14], str.CLSID_XMLHTTPRequest
jmp 0x1000741f
push 0x10066de4
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007118
mov dword [ebp - 0x14], str.CLSID_ShellLink
jmp 0x1000741f
push 0x10057284
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x1000713c
mov dword [ebp - 0x14], str.CLSID_FileOperation
jmp 0x1000741f
push 0x100572f4
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007160
mov dword [ebp - 0x14], str.CLSID_TaskScheduler
jmp 0x1000741f
push 0x10066da4
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007184
mov dword [ebp - 0x14], str.CLSID_ICMLuaUtil
jmp 0x1000741f
push 0x10057354
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100071a8
mov dword [ebp - 0x14], str.CLSID_FilterGraph
jmp 0x1000741f
push 0x100572e4
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100071cc
mov dword [ebp - 0x14], str.CLSID_NullRenderer
jmp 0x1000741f
push 0x10057244
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100071f4
mov dword [ebp - 0x14], str.CLSID_VideoInputDeviceCategory
mov byte [ebp - 0xd], 1
jmp 0x1000741f
push 0x10057324
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x1000721c
mov dword [ebp - 0x14], str.CLSID_CaptureGraphBuilder2
mov byte [ebp - 0xd], 1
jmp 0x1000741f
push 0x10057304
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007240
mov dword [ebp - 0x14], str.CLSID_SystemDeviceEnum
jmp 0x1000741f
push 0x10057264
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007264
mov dword [ebp - 0x14], str.CLSID_VideoEffects1Category
jmp 0x1000741f
push 0x10057334
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x10007288
mov dword [ebp - 0x14], str.CLSID_VideoEffects2Category
jmp 0x1000741f
push 0x100572b4
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100072ac
mov dword [ebp - 0x14], str.CLSID_AudioEffects1Category
jmp 0x1000741f
push 0x10057374
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100072d0
mov dword [ebp - 0x14], str.CLSID_AudioEffects2Category
jmp 0x1000741f
push 0x10066cf4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100072f4
mov dword [ebp - 0x14], str.CLSID_XMLHTTP
jmp 0x1000741f
push 0x10066d14
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007318
mov dword [ebp - 0x14], str.CLSID_XMLHTTP26
jmp 0x1000741f
push 0x10066d44
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x1000733c
mov dword [ebp - 0x14], str.CLSID_XMLHTTP30
jmp 0x1000741f
push 0x10066dc4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x10007360
mov dword [ebp - 0x14], str.CLSID_XMLHTTP60
jmp 0x1000741f
push 0x1004c878
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007384
mov dword [ebp - 0x14], str.CLSID_ActiveDesktop
jmp 0x1000741f
push 0x10066d74
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100073a9
mov dword [ebp - 0x14], str.CLSID_IAMCameraControl
mov byte [ebp - 0xd], 1
jmp 0x1000741f
push 0x1006a5e0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100073ce
mov dword [ebp - 0x14], str.CLSID_AudioCaptureFilter
mov byte [ebp - 0xd], 1
jmp 0x1000741f
push 0x10066d34
mov eax, dword [ebp + 8]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100073f3
mov dword [ebp - 0x14], str.CLSID_Location
mov byte [ebp - 0xd], 1
jmp 0x1000741f
push 0x10066d24
mov edx, dword [ebp + 8]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007418
mov dword [ebp - 0x14], str.CLSID_DefaultLocation
mov byte [ebp - 0xd], 1
jmp 0x1000741f
mov dword [ebp - 0x14], 0x10056c60
push 0x10066d54
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x10007443
mov dword [ebp - 0x18], str.IID_IWbemLocator
jmp 0x100076ae
push 0x100572c4
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007467
mov dword [ebp - 0x18], 0x10056c94
jmp 0x100076ae
push 0x10057344
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x1000748b
mov dword [ebp - 0x18], str.IID_IShellLink
jmp 0x100076ae
push 0x10057254
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100074af
mov dword [ebp - 0x18], str.IID_IFileOperation
jmp 0x100076ae
push 0x10057274
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100074d3
mov dword [ebp - 0x18], str.IID_ITaskService
jmp 0x100076ae
push 0x10057314
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100074f7
mov dword [ebp - 0x18], str.IID_IWbemLevel1Login
jmp 0x100076ae
push 0x10066d84
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x1000751b
mov dword [ebp - 0x18], str.IID_ICMLuaUtil
jmp 0x100076ae
push 0x100572a4
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1000753f
mov dword [ebp - 0x18], str.IID_IMarshal
jmp 0x100076ae
push 0x10057294
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007563
mov dword [ebp - 0x18], str.IID_IRpcHelper
jmp 0x100076ae
push 0x10057394
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x10007587
mov dword [ebp - 0x18], str.IID_ICaptureGraphBuilder2
jmp 0x100076ae
push 0x10057364
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100075ab
mov dword [ebp - 0x18], str.IID_ICreateDevEnum
jmp 0x100076ae
push 0x10057384
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100075cf
mov dword [ebp - 0x18], str.IID_IBaseFilter
jmp 0x100076ae
push 0x10066ce4
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x100075f3
mov dword [ebp - 0x18], str.IID_IXMLHTTPRequest
jmp 0x100076ae
push 0x10066df4
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007617
mov dword [ebp - 0x18], str.IID_IUnknown
jmp 0x100076ae
push 0x1004c868
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x10007638
mov dword [ebp - 0x18], str.IID_IActiveDesktop
jmp 0x100076ae
push 0x10066d64
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10006f80
add esp, 8
movzx edx, al
test edx, edx
je 0x1000765d
mov dword [ebp - 0x18], str.IID_ILocation
mov byte [ebp - 0xd], 1
jmp 0x100076ae
push 0x10066dd4
mov eax, dword [ebp + 0x14]
push eax
call fcn.10006f80
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10007682
mov dword [ebp - 0x18], str.IID_ILocationEvents
mov byte [ebp - 0xd], 1
jmp 0x100076ae
push 0x10066d94
mov edx, dword [ebp + 0x14]
push edx
call fcn.10006f80
add esp, 8
movzx eax, al
test eax, eax
je 0x100076a7
mov dword [ebp - 0x18], str.IID_ILocationManager
mov byte [ebp - 0xd], 1
jmp 0x100076ae
mov dword [ebp - 0x18], 0x10056f00
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push str.OP__ws__rclsid__ws__dwClsContext_d_riid__ws__rclsidName__ws__riidName__ws_
push 0
movzx ecx, byte [ebp - 0xd]
push ecx
call fcn.10026520
add esp, 0x24
cmp dword [ebp - 8], 0
je 0x100076ea
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0xc], 0
je 0x100076fa
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029475
mov esp, ebp
pop ebp
ret