Function at 0x1400509a3
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
jmp 0x14005b4b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4e8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x508]
mov rax, qword [0x140131878]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1401430d4]
call fcn.1400508f4
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x2a8]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005b553
mov r8d, 1
lea rdx, str.SeDebugPrivilege
mov rcx, qword [rbp + 0x2a8]
call fcn.14004f4b8
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, 2
call fcn.14004eafe
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14005b587
mov rdx, qword [rbp + 0x4c0]
lea rcx, str._____s_dump_failed:_impossible_to_get_snapshot_of_the_systems_processes__CreateToolhelp32Snapshot__n
call fcn.14004d24e
mov eax, 1
jmp 0x14005b757
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.14004f260
test eax, eax
jne 0x14005b5c6
mov rdx, qword [rbp + 0x4c0]
lea rcx, str._____s_dump_failed:_obtained_invalid_process_handle_n
call fcn.14004d24e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14005b757
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x2c8], rax
mov rdx, qword [rbp + 0x4c0]
lea rcx, [rbp + 0x7c]
call fcn.14004ebc1
test eax, eax
je 0x14005b603
jmp 0x14005b736
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14005b626
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x14005b64c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x4c0]
lea rcx, str._____s_dump_failed:_couldnt_open_process_memory__OpenProcesswith_error_0x_x__n
call fcn.14004d24e
mov eax, 1
jmp 0x14005b757
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x2e8], rax
cmp qword [rbp + 0x2e8], 0xffffffffffffffff
jne 0x14005b6ab
mov rdx, qword [rbp + 0x4c0]
lea rcx, str._____s_dump_failed:_couldnt_create_dump_file__CreateFile__n
call fcn.14004d24e
mov eax, 1
jmp 0x14005b757
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, qword [rbp + 0x2e8]
mov edx, dword [rbp + 0x58]
mov rcx, qword [rbp + 0x28]
call qword [rbp + 0x2c8]
mov dword [rbp + 0x304], eax
cmp dword [rbp + 0x304], 0
jne 0x14005b712
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x4c0]
lea rcx, str._____s_dump_failed:_couldnt_dump_process__MiniDumpWriteDump_with_error_0x_x__n
call fcn.14004d24e
mov eax, 1
jmp 0x14005b757
mov r8, qword [rbp + 0x4c8]
mov rdx, qword [rbp + 0x4c0]
lea rcx, str.____s_sucessfully_dumped_to:__s_n
call fcn.14004d24e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 8]
call fcn.140050084
test eax, eax
jne 0x14005b5ea
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14004fed6
mov rax, rdi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.14004eb76
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret