Function at 0x116717f4
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x1178bb70
call fcn.116e0880
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x11671b07
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
push str.SeDebugPrivilege
push 0xffffffffffffffff
mov ebx, eax
call fcn.116c7ae0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x40
call fcn.11671596
add esp, 0x18
test eax, eax
je 0x11671b07
cmp dword [ebp - 0x20], 0x24
jb 0x11671b07
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ecx]
cmp edx, esi
jbe 0x11671b0a
mov eax, edx
imul eax, eax, 0x1c
add eax, 0x24
cmp eax, dword [ebp - 0x20]
ja 0x11671b0a
cmp edx, esi
jbe 0x11671b0a
lea eax, [ecx + 0x10]
cmp dword [eax - 4], ebx
jne 0x1167189f
mov edi, dword [ebp - 0x1c]
cmp dword [eax], edi
je 0x116718ac
inc esi
add eax, 0x1c
cmp esi, edx
jb 0x11671893
jmp 0x11671b0a
mov di, word [eax + 0xa]
xor esi, esi
cmp di, si
mov dword [ebp - 0x28], edi
je 0x11671b0a
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
cmp dword [ecx], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
jbe 0x11671a02
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
imul eax, eax, 0x1c
cmp word [eax + ecx + 0x1a], di
lea esi, [eax + ecx + 8]
jne 0x116719e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
push dword [esi + 4]
call fcn.116716f2
mov ebx, eax
add esp, 0x14
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x116719e6
cmp dword [ebp + 0x10], 0x3000
jne 0x116719de
push ebx
call fcn.116714d8
cmp eax, 2
pop ecx
jne 0x1167198c
cmp dword [0x117e1700], 0
je 0x11671959
push dword [ebp + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_T_TokenElevationTypeFull___hReturnToken__08x___dwTargetProcessId___d____hTargetHandle__08x____dwSessionId__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117e0e6c
call fcn.116deab0
add esp, 0x20
xor esi, esi
cmp dword [ebp - 0x40], esi
mov dword [ebp - 0x10], esi
jle 0x1167197e
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0xc
cmp eax, dword [ebp - 0x40]
jl 0x11671963
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11672bdd
jmp 0x116719de
cmp eax, 1
jne 0x116719d0
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 8]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
lea eax, [esi + 1]
push eax
call fcn.11672bdd
mov ecx, dword [ebp - 0x44]
lea eax, [esi + esi*2]
lea esi, [ebp - 0x34]
and dword [ebp - 0x14], 0
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x28]
jmp 0x116719e6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x11671a96
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jb 0x116718d8
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x11671a96
xor ebx, ebx
cmp dword [ebp - 0x40], esi
jle 0x11671a96
and dword [ebp - 0x10], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call fcn.11671346
add esp, 0xc
cmp dword [0x117e1700], 0
mov edi, eax
je 0x11671a5f
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x10]
push edi
push dword [esi + eax + 8]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_arrReturnToken__i_d____08x___bInGroup__d____bOwner__d____bEnabled__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117e0e6c
call fcn.116deab0
add esp, 0x24
xor eax, eax
cmp edi, eax
je 0x11671a7e
cmp dword [ebp - 0x10], eax
je 0x11671a7e
cmp dword [ebp - 0x24], eax
jne 0x11671a89
cmp dword [ebp - 0x14], eax
jne 0x11671a7e
mov eax, dword [ebp - 0x44]
mov eax, dword [esi + eax + 8]
mov dword [ebp - 0x14], eax
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 0x40]
jl 0x11671a0d
jmp 0x11671a96
mov ecx, dword [ebp - 0x44]
lea eax, [ebx + ebx*2]
mov eax, dword [ecx + eax*4 + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jle 0x11671aef
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
lea esi, [ecx + eax]
mov eax, dword [ecx + eax + 8]
cmp dword [ebp - 0x14], eax
je 0x11671ae0
test ebx, ebx
je 0x11671ad9
mov edi, dword [ebx + 4]
push 0xffffffffffffffff
mov ecx, ebx
lea eax, [edi + 1]
push eax
call fcn.11672bdd
mov ecx, dword [ebx]
lea eax, [edi + edi*2]
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x11671ae0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x24], 0xc
cmp eax, dword [ebp - 0x40]
jl 0x11671aa6
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11672bdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.11672bcf
mov ecx, dword [ebp - 0x18]
xor esi, esi
cmp ecx, esi
je 0x11671b1a
push ecx
call fcn.116e0410
pop ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
je 0x11671b2b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], esi
cmp dword [0x117e1700], esi
pop edi
pop esi
pop ebx
je 0x11671b7b
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.11671b8a
pop ecx
pop ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 0x14]
push str.CAdminTokenMgr::GetTokenWithInfo_hReturnToken___08x__SID__s___dwSessionId__d____dwIntegrityLevel__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117e0e6c
call fcn.116deab0
or dword [ebp - 4], 0xffffffff
add esp, 0x20
lea ecx, [ebp + 8]
call fcn.116a6790
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
leave
ret