Function at 0x140001070
Capabilities:
Create process on windows
Create process suspended
Get file size
Parse pe header
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xb050]
mov eax, 0xb150
call fcn.140002280
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb020], rax
cmp ecx, 3
jge 0x1400010b3
lea rcx, str.Usage:_DumpPEFromMemoryMemory.exe__Native_EXE___Dump_File__nE.g._ReadPEInMemory.exe_mimikatz.exe_mimikatz.bin_n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001577
mov qword [rsp + 0xb160], rbx
xor r9d, r9d
mov qword [rsp + 0xb170], rsi
xor r8d, r8d
mov qword [rsp + 0xb178], rdi
xor edi, edi
mov qword [rsp + 0xb148], r12
mov esi, edi
mov r12, qword [rdx + 0x10]
mov qword [rsp + 0xb140], r13
mov r13, qword [rdx + 8]
mov edx, 0x80000000
mov qword [rsp + 0x30], rdi
mov rcx, r13
mov qword [rsp + 0xb138], r14
mov r14d, edi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0xb130], r15
mov dword [rbp - 0x60], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140001148
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateFileA_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x140001203
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
test eax, eax
jne 0x140001173
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetFileSize_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x1400011fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1400011a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d__n
call fcn.140001010
jmp 0x1400011fe
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rdi
mov r8d, r14d
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400011d8
cmp r14d, dword [rbp - 0x60]
jne 0x1400011d8
lea rcx, str.___DONE__n
call fcn.140001010
jmp 0x1400011fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____ReadFile_Failed_With_Error_:__d__n
call fcn.140001010
mov edx, dword [rbp - 0x60]
lea rcx, str.____Bytes_Read_:__d_of_:__d__n
mov r8d, r14d
call fcn.140001010
test r15, r15
je 0x14000120c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14000153a
test r14d, r14d
je 0x14000153a
mov eax, 0x5a4d
cmp word [rsi], ax
je 0x140001232
mov ebx, 0xffffffff
jmp 0x1400012f7
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
je 0x14000124b
mov ebx, 0xffffffff
jmp 0x1400012f7
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rbp + 0x20]
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
mov eax, 0x20b
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
cmp word [rbp + 0x20], ax
je 0x1400012e6
mov ebx, 0xffffffff
jmp 0x1400012f7
mov ebx, dword [rbp + 0x58]
lea rcx, str.___Size_Of_The_Image_:_0x_x__n
mov edx, ebx
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x68
xor eax, eax
xor r9d, r9d
mov dword [rbp + 0x14], eax
xor r8d, r8d
mov qword [rsp + 0x68], rax
xor edx, edx
lea rax, [rsp + 0x58]
mov rcx, r13
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001398
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001010
mov eax, 1
jmp 0x14000153f
mov edx, dword [rsp + 0x68]
lea rcx, str.Process_PID:__lu_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x70]
mov r9d, 0x30
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jne 0x14000151d
mov rdx, qword [rsp + 0x78]
lea rcx, str.PEB_Address:_p_n
call fcn.140001010
mov rdx, qword [rsp + 0x78]
lea rax, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
add rdx, 0x10
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x50]
lea rcx, str.Image_Base_Address:_p_n
call fcn.140001010
mov r15d, ebx
movabs rax, 0x2e8ba2e8ba2e8ba3
mul r15
mov esi, edi
mov rcx, r12
shr rdx, 0xd
imul rax, rdx, 0xb000
cmp r15, rax
setne sil
add esi, edx
lea rdx, [0x1400034a0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
test rax, rax
jne 0x14000146f
mov rdx, r12
lea rcx, str.Failed_to_open__s_for_writing_n
call fcn.140001010
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ebx, edi
test esi, esi
jle 0x1400014f1
mov r13d, 0xb000
nop dword [rax + rax]
mov rdx, qword [rsp + 0x50]
lea r8, [rbp + 0x20]
movsxd rax, ebx
mov r9, r15
imul rcx, rax, 0xb000
lea rax, [rbp - 0x60]
sub r9, rcx
mov qword [rsp + 0x20], rax
cmp r9, r13
cmova r9, r13
add rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400014dd
mov r8, qword [rbp - 0x60]
lea rcx, [rbp + 0x20]
mov r9, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rdi, qword [rbp - 0x60]
inc ebx
cmp ebx, esi
jl 0x140001480
jmp 0x1400014f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_reading_memory:__d_n
call fcn.140001010
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, rdi
lea rcx, str.Data_successfully_written_to__s._Total_bytes_read:_0x_x_n
mov rdx, r12
call fcn.140001010
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x14000153f
lea rcx, str.Error
call fcn.140001010
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x14000153f
mov eax, 0xffffffff
mov r14, qword [rsp + 0xb138]
mov r13, qword [rsp + 0xb140]
mov r12, qword [rsp + 0xb148]
mov rdi, qword [rsp + 0xb178]
mov rsi, qword [rsp + 0xb170]
mov rbx, qword [rsp + 0xb160]
mov r15, qword [rsp + 0xb130]
mov rcx, qword [rbp + 0xb020]
xor rcx, rsp
call fcn.1400015a0
add rsp, 0xb150
pop rbp
ret