Function at 0x1800111a4
Capabilities:
Create process memory minidump
Get common file path
Terminate process

Disassembly:
jmp 0x180011910
push rbp
push rsi
push rdi
sub rsp, 0xb30
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x1f4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xac8], rax
lea rcx, [0x1800250a5]
call fcn.1800113d4
nop
xor eax, eax
test eax, eax
je 0x180011961
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
call fcn.180011159
test eax, eax
jne 0x180011976
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
call fcn.18001118b
nop
mov edx, 0x40
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x1800119d1
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x30]
call qword [rbp + 0x168]
nop
mov rax, qword [rbp + 8]
mov ecx, dword [rbp + 0x38]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0x34]
lea r8, str._u._u
mov edx, 8
mov rcx, rax
call fcn.180011136
nop
mov rax, qword [rbp + 8]
mov ecx, dword [rbp + 0x3c]
mov dword [rax + 0x10], ecx
mov rax, qword [rbp + 8]
lea rdx, str.10.0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x180011a5c
lea rax, [0x18001123a]
mov qword [0x18001f770], rax
lea rax, [0x1800111f9]
mov qword [0x18001f1d8], rax
lea rax, [0x1800110c3]
mov qword [0x18001f750], rax
mov rax, qword [rbp + 8]
mov dword [rax + 0x38], 0x3f
jmp 0x180011b61
mov rax, qword [rbp + 8]
lea rdx, [0x18001c208]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x180011ab7
cmp dword [rbp + 0x3c], 0x1db1
jne 0x180011ab7
lea rax, [0x18001141a]
mov qword [0x18001f770], rax
lea rax, [0x180011311]
mov qword [0x18001f1d8], rax
lea rax, [0x1800112e9]
mov qword [0x18001f750], rax
mov rax, qword [rbp + 8]
mov dword [rax + 0x38], 0x3c
jmp 0x180011b61
mov rax, qword [rbp + 8]
lea rdx, [0x18001c218]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x180011b06
lea rax, [0x180011370]
mov qword [0x18001f770], rax
lea rax, [0x180011406]
mov qword [0x18001f1d8], rax
lea rax, [0x180011320]
mov qword [0x18001f750], rax
mov rax, qword [rbp + 8]
mov dword [rax + 0x38], 0x3d
jmp 0x180011b61
mov rax, qword [rbp + 8]
lea rdx, [0x18001c228]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x180011b55
lea rax, [0x18001133e]
mov qword [0x18001f770], rax
lea rax, [0x18001120d]
mov qword [0x18001f1d8], rax
lea rax, [0x1800112bc]
mov qword [0x18001f750], rax
mov rax, qword [rbp + 8]
mov dword [rax + 0x38], 0x3e
jmp 0x180011b61
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0
jne 0x180011b9b
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rax, qword [rbp + 8]
add rax, 0x18
lea rdx, str.lsass.exe
mov rcx, rax
call qword [rbp + 0x188]
nop
mov rcx, qword [rbp + 8]
call fcn.18001106e
test eax, eax
jne 0x180011bcd
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rax, qword [rbp + 8]
lea rcx, str.NtReadVirtualMemory
mov qword [rax + 0x30], rcx
mov rcx, qword [rbp + 8]
call fcn.180011082
test eax, eax
jne 0x180011bf5
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov qword [rbp + 0x1a8], 0
mov dword [rbp + 0x1c8], 0x30
mov qword [rbp + 0x1d0], 0
mov dword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f0], 0
lea rax, [rbp + 0x218]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x220], 0
lea r9, [rbp + 0x218]
lea r8, [rbp + 0x1c8]
mov edx, 0x1fffff
lea rcx, [rbp + 0x1a8]
call qword [0x18001f770]
mov dword [rbp + 0x244], eax
cmp qword [rbp + 0x1a8], 0
jne 0x180011ca9
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x270]
lea rcx, str.___
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x27a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop
lea r8, [rbp + 0x4a0]
mov edx, 0x104
lea rcx, [rbp + 0x270]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
lea r8, str.Tempdumpert.dmp
mov edx, 0x104
lea rcx, [rbp + 0x270]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x6c8]
call qword [rbp + 0x188]
nop
mov qword [rbp + 0x6f8], 0
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0x718]
call fcn.180011307
nop
mov dword [rbp + 0x748], 0x30
mov qword [rbp + 0x750], 0
mov dword [rbp + 0x760], 0x40
lea rax, [rbp + 0x6c8]
mov qword [rbp + 0x758], rax
mov qword [rbp + 0x768], 0
mov qword [rbp + 0x770], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x718]
lea r8, [rbp + 0x748]
mov edx, 0x120116
lea rcx, [rbp + 0x6f8]
call qword [0x18001f750]
mov dword [rbp + 0x244], eax
cmp qword [rbp + 0x6f8], 0xffffffffffffffff
jne 0x180011e1a
mov rcx, qword [rbp + 0x1a8]
call qword [0x18001f1d8]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbp + 0x794], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, qword [rbp + 0x6f8]
mov edx, dword [rbp + 0x794]
mov rcx, qword [rbp + 0x1a8]
call fcn.1800112f3
mov dword [rbp + 0x7b4], eax
mov rcx, qword [rbp + 0x6f8]
call qword [0x18001f1d8]
nop
mov rcx, qword [rbp + 0x1a8]
call qword [0x18001f1d8]
nop
lea rcx, [rbp - 0x60]
lea rdx, [0x18001c140]
call fcn.180011357
mov rcx, qword [rbp + 0xac8]
xor rcx, rbp
call fcn.1800111d1
lea rsp, [rbp + 0xad0]
pop rdi
pop rsi
pop rbp
ret