Function at 0x180001fc0
Capabilities:
Acquire debug privileges
Create process memory minidump
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [rdx + 4]
lea r13, [rdx + 8]
xor edi, edi
mov qword [rsp + 0x50], r8
mov r12d, edi
mov dword [rsp + 0x40], edi
mov r15d, edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rsi, [rdi - 1]
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x60], rax
mov ebp, edi
mov r14d, edi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ebx, [rdi + 1]
test eax, eax
je 0x18000209e
lea r8, [rsp + 0x70]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x18000209e
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x88], 3
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x18000209e
mov r12d, dword [rsp + 0x68]
mov r14d, ebx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800020ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x180002175
test r12d, r12d
jne 0x1800020e9
lea rcx, [rsp + 0x48]
call fcn.180001b90
test eax, eax
je 0x180002175
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x180002175
mov r15d, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, r13
mov dword [rsp + 0x20], ebx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180002175
mov r12d, dword [rsp + 0x44]
xor edx, edx
mov r8d, r12d
mov dword [rsp + 0x40], ebx
mov ecx, 0x410
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x180002175
mov qword [rsp + 0x30], rdi
mov r9d, 2
mov qword [rsp + 0x28], rdi
mov r8, rsi
mov edx, r12d
mov qword [rsp + 0x20], rdi
mov rcx, rax
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x180002175
mov rax, qword [rsp + 0x50]
mov dword [rax], 2
mov qword [rax + 4], rbx
jmp 0x1800021a2
mov eax, dword [rsp + 0x40]
mov ebx, edi
mov r14, qword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov qword [r14], 2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 8], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, dword [rsp + 0x40]
mov edi, eax
mov dword [rsp + 0x28], ebx
lea rdx, str.Server::DoDumpProcessMemory
mov r9d, esi
mov dword [rsp + 0x20], edi
mov r8, r13
lea rcx, str._PPLmedic___ws__Dump_file:__ws__Handle:_0x_04x__LE:__d__Result:__d_r_n
call fcn.180001010
test r15d, r15d
je 0x1800021ce
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test rbp, rbp
je 0x1800021dc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800021ef
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180002201
test r14d, r14d
je 0x180002201
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180002ad0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret