Function at 0x116617f4
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x1177b920
call fcn.116d0630
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x11661b07
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
push str.SeDebugPrivilege
push 0xffffffffffffffff
mov ebx, eax
call fcn.116b7890
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x40
call fcn.11661596
add esp, 0x18
test eax, eax
je 0x11661b07
cmp dword [ebp - 0x20], 0x24
jb 0x11661b07
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ecx]
cmp edx, esi
jbe 0x11661b0a
mov eax, edx
imul eax, eax, 0x1c
add eax, 0x24
cmp eax, dword [ebp - 0x20]
ja 0x11661b0a
cmp edx, esi
jbe 0x11661b0a
lea eax, [ecx + 0x10]
cmp dword [eax - 4], ebx
jne 0x1166189f
mov edi, dword [ebp - 0x1c]
cmp dword [eax], edi
je 0x116618ac
inc esi
add eax, 0x1c
cmp esi, edx
jb 0x11661893
jmp 0x11661b0a
mov di, word [eax + 0xa]
xor esi, esi
cmp di, si
mov dword [ebp - 0x28], edi
je 0x11661b0a
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
cmp dword [ecx], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
jbe 0x11661a02
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
imul eax, eax, 0x1c
cmp word [eax + ecx + 0x1a], di
lea esi, [eax + ecx + 8]
jne 0x116619e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
push dword [esi + 4]
call fcn.116616f2
mov ebx, eax
add esp, 0x14
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x116619e6
cmp dword [ebp + 0x10], 0x3000
jne 0x116619de
push ebx
call fcn.116614d8
cmp eax, 2
pop ecx
jne 0x1166198c
cmp dword [0x117d15f0], 0
je 0x11661959
push dword [ebp + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_T_TokenElevationTypeFull___hReturnToken__08x___dwTargetProcessId___d____hTargetHandle__08x____dwSessionId__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117d0d5c
call fcn.116ce860
add esp, 0x20
xor esi, esi
cmp dword [ebp - 0x40], esi
mov dword [ebp - 0x10], esi
jle 0x1166197e
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0xc
cmp eax, dword [ebp - 0x40]
jl 0x11661963
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11662bdd
jmp 0x116619de
cmp eax, 1
jne 0x116619d0
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 8]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
lea eax, [esi + 1]
push eax
call fcn.11662bdd
mov ecx, dword [ebp - 0x44]
lea eax, [esi + esi*2]
lea esi, [ebp - 0x34]
and dword [ebp - 0x14], 0
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x28]
jmp 0x116619e6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x11661a96
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jb 0x116618d8
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x11661a96
xor ebx, ebx
cmp dword [ebp - 0x40], esi
jle 0x11661a96
and dword [ebp - 0x10], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call fcn.11661346
add esp, 0xc
cmp dword [0x117d15f0], 0
mov edi, eax
je 0x11661a5f
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x10]
push edi
push dword [esi + eax + 8]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_arrReturnToken__i_d____08x___bInGroup__d____bOwner__d____bEnabled__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117d0d5c
call fcn.116ce860
add esp, 0x24
xor eax, eax
cmp edi, eax
je 0x11661a7e
cmp dword [ebp - 0x10], eax
je 0x11661a7e
cmp dword [ebp - 0x24], eax
jne 0x11661a89
cmp dword [ebp - 0x14], eax
jne 0x11661a7e
mov eax, dword [ebp - 0x44]
mov eax, dword [esi + eax + 8]
mov dword [ebp - 0x14], eax
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 0x40]
jl 0x11661a0d
jmp 0x11661a96
mov ecx, dword [ebp - 0x44]
lea eax, [ebx + ebx*2]
mov eax, dword [ecx + eax*4 + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jle 0x11661aef
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
lea esi, [ecx + eax]
mov eax, dword [ecx + eax + 8]
cmp dword [ebp - 0x14], eax
je 0x11661ae0
test ebx, ebx
je 0x11661ad9
mov edi, dword [ebx + 4]
push 0xffffffffffffffff
mov ecx, ebx
lea eax, [edi + 1]
push eax
call fcn.11662bdd
mov ecx, dword [ebx]
lea eax, [edi + edi*2]
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x11661ae0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x24], 0xc
cmp eax, dword [ebp - 0x40]
jl 0x11661aa6
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11662bdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.11662bcf
mov ecx, dword [ebp - 0x18]
xor esi, esi
cmp ecx, esi
je 0x11661b1a
push ecx
call fcn.116d01c0
pop ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
je 0x11661b2b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], esi
cmp dword [0x117d15f0], esi
pop edi
pop esi
pop ebx
je 0x11661b7b
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.11661b8a
pop ecx
pop ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 0x14]
push str.CAdminTokenMgr::GetTokenWithInfo_hReturnToken___08x__SID__s___dwSessionId__d____dwIntegrityLevel__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117d0d5c
call fcn.116ce860
or dword [ebp - 4], 0xffffffff
add esp, 0x20
lea ecx, [ebp + 8]
call fcn.11696540
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
leave
ret