Function at 0x140011505
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x140017900
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x288]
mov rax, qword [0x140027040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14002e0f5]
call fcn.14001171c
nop
call fcn.1400113a7
mov qword [rbp + 8], rax
lea rcx, str.SeDebugPrivilege
call fcn.1400115f0
nop
lea rcx, str.TrustedInstaller
call fcn.140011113
nop
lea rdx, str.TrustedInstaller.exe
lea rcx, [rbp + 0x1f8]
call fcn.14001124e
nop
lea rcx, [rbp + 0x1f8]
call fcn.14001136b
mov r8d, eax
mov edx, 1
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x1f8]
call fcn.140011677
nop
mov rcx, qword [rbp + 0x28]
call fcn.140011302
mov rcx, rax
call fcn.14001164a
nop
mov qword [rbp + 0x48], 0
lea r8, [rbp + 0x48]
mov edx, 0xf01ff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rbp + 0xb4], 0
lea rax, [rbp + 0x118]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 1
je 0x140017a7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x224], eax
lea rdx, str.DuplicateTokenEx_failed_with:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d2
mov ecx, dword [rbp + 0x224]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140023040]
mov rcx, rax
call fcn.1400110d2
nop
mov eax, 1
jmp 0x140017b8a
lea rax, [rbp + 0xd4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0xb4]
mov edx, 0xc
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 1
je 0x140017aff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x224], eax
lea rdx, str.GetTokenInformation_failed_with:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d2
mov ecx, dword [rbp + 0x224]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140023040]
mov rcx, rax
call fcn.1400110d2
nop
mov eax, 1
jmp 0x140017b8a
mov r9d, 4
lea r8, [rbp + 0xb4]
mov edx, 0xc
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 1
je 0x140017b74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x224], eax
lea rdx, str.SetTokenInformation_failed_with:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110d2
mov ecx, dword [rbp + 0x224]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140023040]
mov rcx, rax
call fcn.1400110d2
nop
mov eax, 1
jmp 0x140017b8a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
mov rcx, qword [rbp + 0x118]
call fcn.140011280
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140022620]
call fcn.140011627
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140011389
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret