According to `Process Monitor`, Cryptbase is loaded from `C:\Windows\system32\cryptbase.dll` when `sysprep` is invoked. It doesn't load `C:\Windows\system32\sysprep\cryptbase.dll`. This could be a bit of a deal-breaker for BypassUAC on Windows 8.1+ eh?