Function at 0x11651810
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, 0x1176af80
call fcn.116bfcd0
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x11651b23
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
push str.SeDebugPrivilege
push 0xffffffffffffffff
mov ebx, eax
call fcn.116a68c0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x40
call fcn.116515b2
add esp, 0x18
test eax, eax
je 0x11651b23
cmp dword [ebp - 0x20], 0x24
jb 0x11651b23
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ecx]
cmp edx, esi
jbe 0x11651b26
mov eax, edx
imul eax, eax, 0x1c
add eax, 0x24
cmp eax, dword [ebp - 0x20]
ja 0x11651b26
cmp edx, esi
jbe 0x11651b26
lea eax, [ecx + 0x10]
cmp dword [eax - 4], ebx
jne 0x116518bb
mov edi, dword [ebp - 0x1c]
cmp dword [eax], edi
je 0x116518c8
inc esi
add eax, 0x1c
cmp esi, edx
jb 0x116518af
jmp 0x11651b26
mov di, word [eax + 0xa]
xor esi, esi
cmp di, si
mov dword [ebp - 0x28], edi
je 0x11651b26
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
cmp dword [ecx], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
jbe 0x11651a1e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
imul eax, eax, 0x1c
cmp word [eax + ecx + 0x1a], di
lea esi, [eax + ecx + 8]
jne 0x11651a02
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
push dword [esi + 4]
call fcn.1165170e
mov ebx, eax
add esp, 0x14
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x11651a02
cmp dword [ebp + 0x10], 0x3000
jne 0x116519fa
push ebx
call fcn.116514f4
cmp eax, 2
pop ecx
jne 0x116519a8
cmp dword [0x117bf398], 0
je 0x11651975
push dword [ebp + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_T_TokenElevationTypeFull___hReturnToken__08x___dwTargetProcessId___d____hTargetHandle__08x____dwSessionId__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117beb04
call fcn.116bdf00
add esp, 0x20
xor esi, esi
cmp dword [ebp - 0x40], esi
mov dword [ebp - 0x10], esi
jle 0x1165199a
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0xc
cmp eax, dword [ebp - 0x40]
jl 0x1165197f
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11652bf9
jmp 0x116519fa
cmp eax, 1
jne 0x116519ec
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 8]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
lea eax, [esi + 1]
push eax
call fcn.11652bf9
mov ecx, dword [ebp - 0x44]
lea eax, [esi + esi*2]
lea esi, [ebp - 0x34]
and dword [ebp - 0x14], 0
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x28]
jmp 0x11651a02
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x14], 0
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x11651ab2
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jb 0x116518f4
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x11651ab2
xor ebx, ebx
cmp dword [ebp - 0x40], esi
jle 0x11651ab2
and dword [ebp - 0x10], 0
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x44]
push dword [esi + eax + 8]
call fcn.11651362
add esp, 0xc
cmp dword [0x117bf398], 0
mov edi, eax
je 0x11651a7b
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x10]
push edi
push dword [esi + eax + 8]
push ebx
push str.CAdminTokenMgr::GetTokenWithInfo_arrReturnToken__i_d____08x___bInGroup__d____bOwner__d____bEnabled__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117beb04
call fcn.116bdf00
add esp, 0x24
xor eax, eax
cmp edi, eax
je 0x11651a9a
cmp dword [ebp - 0x10], eax
je 0x11651a9a
cmp dword [ebp - 0x24], eax
jne 0x11651aa5
cmp dword [ebp - 0x14], eax
jne 0x11651a9a
mov eax, dword [ebp - 0x44]
mov eax, dword [esi + eax + 8]
mov dword [ebp - 0x14], eax
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 0x40]
jl 0x11651a29
jmp 0x11651ab2
mov ecx, dword [ebp - 0x44]
lea eax, [ebx + ebx*2]
mov eax, dword [ecx + eax*4 + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x40], eax
mov dword [ebp - 0x10], eax
jle 0x11651b0b
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
lea esi, [ecx + eax]
mov eax, dword [ecx + eax + 8]
cmp dword [ebp - 0x14], eax
je 0x11651afc
test ebx, ebx
je 0x11651af5
mov edi, dword [ebx + 4]
push 0xffffffffffffffff
mov ecx, ebx
lea eax, [edi + 1]
push eax
call fcn.11652bf9
mov ecx, dword [ebx]
lea eax, [edi + edi*2]
lea edi, [ecx + eax*4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x11651afc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x24], 0xc
cmp eax, dword [ebp - 0x40]
jl 0x11651ac2
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44]
call fcn.11652bf9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.11652beb
mov ecx, dword [ebp - 0x18]
xor esi, esi
cmp ecx, esi
je 0x11651b36
push ecx
call fcn.116bf860
pop ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
je 0x11651b47
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], esi
cmp dword [0x117bf398], esi
pop edi
pop esi
pop ebx
je 0x11651b97
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.11651ba6
pop ecx
pop ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 0x14]
push str.CAdminTokenMgr::GetTokenWithInfo_hReturnToken___08x__SID__s___dwSessionId__d____dwIntegrityLevel__d_
push str.AdminToken
push 0xffffffffffffffff
push 0x117beb04
call fcn.116bdf00
or dword [ebp - 4], 0xffffffff
add esp, 0x20
lea ecx, [ebp + 8]
call fcn.11685570
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
leave
ret