Function at 0x1001c100
Capabilities:
Access firewall policy via inetfwpolicy2
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x1005602c]
xor eax, ebp
mov dword [ebp - 4], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
je 0x1001c1f6
push str.RtlInitUnicodeString
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057e24], eax
cmp dword [0x10057e24], 0
jne 0x1001c158
push 0
call fcn.1002a8f5
push str.RtlEnterCriticalSection
mov ecx, dword [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057e18], eax
cmp dword [0x10057e18], 0
jne 0x1001c17f
push 0
call fcn.1002a8f5
push str.RtlLeaveCriticalSection
mov edx, dword [ebp - 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057e14], eax
cmp dword [0x10057e14], 0
jne 0x1001c1a6
push 0
call fcn.1002a8f5
push str.LdrEnumerateLoadedModules
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057e1c], eax
cmp dword [0x10057e1c], 0
jne 0x1001c1cd
push 0
call fcn.1002a8f5
push str.NtAllocateVirtualMemory
mov ecx, dword [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10057e20], eax
cmp dword [0x10057e20], 0
jne 0x1001c1f4
push 0
call fcn.1002a8f5
jmp 0x1001c1fd
push 0
call fcn.1002a8f5
call fcn.1001c030
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2c4], 0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x80010106
je 0x1001c276
cmp dword [ebp - 0x2f0], 0
jge 0x1001c276
cmp dword [ebp - 0x2c4], 0
je 0x1001c262
mov edx, dword [ebp - 0x2c4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c4]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x2f0], 0
jl 0x1001c271
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1001c481
lea eax, [ebp - 0x2c4]
push eax
call fcn.10004c00
add esp, 4
push eax
push 0x1005236c
push 0x17
push 0
push 0x1005237c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jge 0x1001c2b0
push 0
call fcn.1002a8f5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2fc], 0
push 0x32
lea ecx, [ebp - 0x68]
push ecx
push 0x1005237c
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea edx, [ebp - 0x68]
push edx
push str.Elevation:Administrator_new:_s
push 0x12c
lea eax, [ebp - 0x2c0]
push eax
call fcn.1001be70
add esp, 0x10
mov dword [ebp - 0x2ec], eax
xor ecx, ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2dc], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2e8], 0x24
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x2c8], edx
mov dword [ebp - 0x2d4], 4
lea eax, [ebp - 0x2c4]
push eax
call fcn.10004c00
add esp, 4
push eax
push 0x1005236c
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2c0]
push edx
call dword [sym.imp.ole32.dll_CoGetObject]
mov dword [ebp - 0x2ec], eax
push 0
push 1
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c4]
push edx
mov eax, dword [ecx + 0x24]
call eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jge 0x1001c3d9
cmp dword [ebp - 0x2c4], 0
je 0x1001c3c5
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x2c4]
push eax
mov ecx, dword [edx + 8]
call ecx
cmp dword [ebp - 0x2f0], 0
jl 0x1001c3d4
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1001c481
push 0
push 2
mov edx, dword [ebp - 0x2c4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c4]
push ecx
mov edx, dword [eax + 0x24]
call edx
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jge 0x1001c42e
cmp dword [ebp - 0x2c4], 0
je 0x1001c41d
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x2c4]
push edx
mov eax, dword [ecx + 8]
call eax
cmp dword [ebp - 0x2f0], 0
jl 0x1001c42c
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1001c481
push 0
push 4
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x2c4]
push eax
mov ecx, dword [edx + 0x24]
call ecx
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jge 0x1001c481
cmp dword [ebp - 0x2c4], 0
je 0x1001c472
mov edx, dword [ebp - 0x2c4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c4]
push ecx
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0x2f0], 0
jl 0x1001c481
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001deaa
mov esp, ebp
pop ebp
ret