Function at 0x140001070
Capabilities:
Create process memory minidump
Delete file
Encode data using xor
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov rdi, rcx
mov edx, dword [r8 + 0x10]
lea rcx, str.___Dumping_PID__d_via_MiniDumpWriteDump_n
mov rbx, r8
call fcn.140001010
xor r14d, r14d
mov dword [rbp - 9], r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r14 + 8]
mov r8d, 0x4b00000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x11], rax
test rax, rax
jne 0x14000113e
lea rcx, str.____Failed_to_allocate_heap_memory_for_the_minidump_callback_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
mov r9d, 0x800
mov ebx, eax
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x19]
mov qword [rbp - 0x19], r14
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rbp - 0x19]
lea rdx, [0x1400044b0]
mov r8d, ebx
lea rcx, str.____The_function__S_failed_with_error_code__d____S
call fcn.140001010
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x140001436
lea rax, [0x140001450]
mov r9d, 2
mov qword [rbp - 1], rax
xor r8d, r8d
lea rax, [rbp - 0x11]
xor edx, edx
mov qword [rbp + 7], rax
mov rcx, rdi
lea rax, [rbp - 1]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
jne 0x1400011da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
mov r9d, 0x800
mov ebx, eax
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x19]
mov qword [rbp - 0x19], r14
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rdx, [0x1400044c8]
mov r9, qword [rbp - 0x19]
lea rcx, str.____The_function__S_failed_with_error_code__d____S
mov r8d, ebx
call fcn.140001010
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400013f1
lea rcx, str.___Target_process_has_been_dumped_to_memory_successfully_n
call fcn.140001010
cmp dword [rbx + 4], r14d
je 0x140001214
mov ecx, r14d
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x11]
lea rdx, [rdx + 1]
inc ecx
xor byte [rdx + rax - 1], 0x1d
cmp ecx, dword [rbp - 9]
jbe 0x140001200
cmp dword [rbx], r14d
je 0x140001254
lea rcx, str.___Transferring_process_dump_to_the_remote_machine_n
call fcn.140001010
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400014c0
test eax, eax
je 0x140001248
mov edx, esi
lea rcx, str.___Process_dump_of_PID__d_transfered_remotely__n
call fcn.140001010
jmp 0x14000141c
lea rcx, str.____Failed_to_send_the_dmp_remotly_n
call fcn.140001010
xor eax, eax
xorps xmm0, xmm0
xor ecx, ecx
mov dword [rbp + 0x1f], eax
movups xmmword [rbp + 0xf], xmm0
mov word [rbp + 0x23], ax
call sub.api_ms_win_crt_time_l1_1_0.dll__time32
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rbx, r14
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x34
sub r8d, ecx
movsxd rax, r8d
movsx eax, byte [rax + rdi]
mov word [rbp + rbx*2 + 0xf], ax
inc rbx
cmp rbx, 6
jl 0x140001280
lea r8, str..dmp
mov edx, 0xb
lea rcx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0xf]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000134c
lea rcx, str.____Failed_to_create_the_output_file_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
mov r9d, 0x800
mov ebx, eax
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x19]
mov qword [rbp - 0x19], r14
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rdx, str.CreateFile
jmp 0x1400011b8
lea rcx, str.___Writing_process_dump_to_disk_n
call fcn.140001010
mov r8d, dword [rbp - 9]
xor r9d, r9d
mov rdx, qword [rbp - 0x11]
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000140a
lea rcx, str.____Failed_to_write_dump_to_outfile_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
mov r9d, 0x800
mov ebx, eax
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x19]
mov qword [rbp - 0x19], r14
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rbp - 0x19]
lea rdx, [0x140004658]
mov r8d, ebx
lea rcx, str.____The_function__S_failed_with_error_code__d____S
call fcn.140001010
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x11]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x140001436
lea r8, [rbp + 0xf]
mov edx, esi
lea rcx, str.___Process_dump_of_PID__d_written_to_outfile:__S_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x11]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140002fb0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret