Function at 0x140052a70
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
jmp 0x14005de50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x14013a908]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x14014d784]
call fcn.1400529c1
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x2a8]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005def3
mov r8d, 1
lea rdx, str.SeDebugPrivilege
mov rcx, qword [rbp + 0x2a8]
call fcn.140051530
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, 2
call fcn.140050b58
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14005df27
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_impossible_to_get_snapshot_of_the_systems_processes__CreateToolhelp32Snapshot__n
call fcn.14004f249
mov eax, 1
jmp 0x14005e133
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.1400512d8
test eax, eax
jne 0x14005df66
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_obtained_invalid_process_handle_n
call fcn.14004f249
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14005e133
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x14005dfab
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_could_not_load_dbghelp.dll_n
call fcn.14004f249
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14005e133
lea rdx, str.MiniDumpWriteDump
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2e8], rax
mov rdx, qword [rbp + 0x4e0]
lea rcx, [rbp + 0x7c]
call fcn.140050c1b
test eax, eax
je 0x14005dfdf
jmp 0x14005e112
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14005e002
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x14005e028
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_couldnt_open_process_memory__OpenProcesswith_error_0x_x__n
call fcn.14004f249
mov eax, 1
jmp 0x14005e133
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
jne 0x14005e087
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_couldnt_create_dump_file__CreateFile__n
call fcn.14004f249
mov eax, 1
jmp 0x14005e133
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, qword [rbp + 0x308]
mov edx, dword [rbp + 0x58]
mov rcx, qword [rbp + 0x28]
call qword [rbp + 0x2e8]
mov dword [rbp + 0x324], eax
cmp dword [rbp + 0x324], 0
jne 0x14005e0ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x4e0]
lea rcx, str._____s_dump_failed:_couldnt_dump_process__MiniDumpWriteDump_with_error_0x_x__n
call fcn.14004f249
mov eax, 1
jmp 0x14005e133
mov r8, qword [rbp + 0x4e8]
mov rdx, qword [rbp + 0x4e0]
lea rcx, str.____s_sucessfully_dumped_to:__s_n
call fcn.14004f249
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.14005213d
test eax, eax
jne 0x14005dfc6
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140051f80
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.140050bd0
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret