Function at 0x180001480
Capabilities:
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xca8
mov rax, qword [0x180028240]
xor rax, rsp
mov qword [rsp + 0xc90], rax
mov r15, qword [rsp + 0xd10]
mov r14, r8
mov r12, qword [rsp + 0xd18]
mov esi, edx
mov r13, qword [rsp + 0xd20]
mov rbp, rcx
mov dword [rsp + 0x30], r9d
mov r9d, edx
mov qword [rsp + 0x28], r8
mov edx, 0x400
mov qword [rsp + 0x20], rcx
lea r8, str.MiniDumpWriteDump_called_with:_n__ProcessId:__d_n__hProcess:_0x_p_n__hFile:_0x_p_n__DumpType:_0x_x_n
lea rcx, [rsp + 0x280]
call fcn.180001070
cmp byte [0x180029ee0], 0
jne 0x180001507
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, [rsp + 0x280]
lea rcx, [0x180024840]
call fcn.180001010
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800015c8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000157d
nop
lea rdx, str.lsass.exe
lea rcx, [rsp + 0x6c]
call fcn.180007d04
test eax, eax
je 0x180001579
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180001550
jmp 0x18000157d
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1800015c8
mov r9d, edi
lea r8, str.ProcessId_changed_to_LSASS__PID:__d__n
mov edx, 0x400
lea rcx, [rsp + 0x280]
mov esi, edi
call fcn.180001070
cmp byte [0x180029ee0], 0
jne 0x1800015be
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, [rsp + 0x280]
jmp 0x1800015e5
cmp byte [0x180029ee0], 0
jne 0x1800015de
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, str.Failed_to_get_LSASS_process_ID_n
lea rcx, [0x180024840]
call fcn.180001010
lea rcx, str.C:WindowsSystem32DbgCore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x180001635
cmp byte [0x180029ee0], al
jne 0x18000161b
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, str.Failed_to_load_DbgHelp.dll_n
lea rcx, [0x180024840]
call fcn.180001010
xor eax, eax
jmp 0x1800017e5
mov r8d, 0x104
lea rdx, [rsp + 0xa80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180001691
lea r9, [rsp + 0xa80]
mov edx, 0x400
lea r8, str.Loaded_DbgHelp.dll_from:__s_n
lea rcx, [rsp + 0x280]
call fcn.180001070
cmp byte [0x180029ee0], 0
jne 0x180001687
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, [rsp + 0x280]
jmp 0x1800016ae
cmp byte [0x180029ee0], 0
jne 0x1800016a7
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, str.Failed_to_get_DbgHelp.dll_path_n
lea rcx, [0x180024840]
call fcn.180001010
cmp qword [0x180029ed0], 0
jne 0x18000170f
lea rdx, [0x180024cc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180029ed0], rax
test rax, rax
jne 0x18000170f
cmp byte [0x180029ee0], al
jne 0x1800016f5
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, str.Failed_to_get_address_of_MiniDumpWriteDump_n
lea rcx, [0x180024840]
call fcn.180001010
xor eax, eax
jmp 0x1800017e5
mov dword [rsp + 0x30], 0x41026
lea r8, str.Calling_original_with:_n__ProcessId:__d_n__hProcess:_0x_p_n__hFile:_0x_p_n__DumpType:_0x_x_n
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x280]
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov edx, 0x400
call fcn.180001070
cmp byte [0x180029ee0], 0
jne 0x180001753
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, [rsp + 0x280]
lea rcx, [0x180024840]
call fcn.180001010
mov qword [rsp + 0x30], r13
mov r9d, 0x41026
mov qword [rsp + 0x28], r12
mov r8, r14
mov edx, esi
mov qword [rsp + 0x20], r15
mov rcx, rbp
call qword [0x180029ed0]
lea r9, str.Failure
mov edx, 0x400
mov ebx, eax
lea r8, str.MiniDumpWriteDump_result:__s_n
lea rax, str.Success
test ebx, ebx
lea rcx, [rsp + 0x280]
cmovne r9, rax
call fcn.180001070
cmp byte [0x180029ee0], 0
jne 0x1800017cf
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov byte [0x180029ee0], 1
lea rdx, [rsp + 0x280]
lea rcx, [0x180024840]
call fcn.180001010
mov eax, ebx
mov rcx, qword [rsp + 0xc90]
xor rcx, rsp
call fcn.180003470
add rsp, 0xca8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret