Function at 0x140001230
Capabilities:
Acquire debug privileges
Create process memory minidump
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
xor r12d, r12d
mov qword [rbp - 9], r12
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], r12b
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], r12b
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x21], r12
mov ebx, 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x31], r12b
mov r15d, r12d
cmp ecx, 4
jl 0x1400016ab
mov r9, qword [rdx + 0x18]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], r15b
jne 0x1400012c0
lea rcx, [rbp - 0x31]
cmp rbx, 0xf
ja 0x1400012e9
mov qword [rbp - 0x21], rbx
mov r8, rbx
mov rdx, r9
call fcn.140005fb0
mov byte [rbp + rbx - 0x31], r15b
jmp 0x1400012f1
mov rdx, rbx
call fcn.140001830
lea rcx, [rbp - 0x31]
mov rbx, qword [rbp - 0x19]
cmp rbx, 0x10
cmovae rcx, qword [rbp - 0x31]
mov r8, qword [rbp - 0x21]
cmp r8, 7
jne 0x1400016ab
lea rdx, str.xxoo123
call fcn.140015740
test eax, eax
jne 0x1400016ab
mov r9, qword [r14 + 8]
mov rsi, rdi
nop dword [rax + rax]
inc rsi
cmp byte [r9 + rsi], r15b
jne 0x140001330
mov rax, qword [rbp - 0x39]
cmp rsi, rax
ja 0x140001367
lea rbx, [rbp - 0x51]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x51]
mov qword [rbp - 0x41], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.140005fb0
mov byte [rbx + rsi], r15b
jmp 0x140001373
mov rdx, rsi
lea rcx, [rbp - 0x51]
call fcn.140001830
mov r9, qword [r14 + 0x10]
inc rdi
cmp byte [r9 + rdi], r15b
jne 0x140001377
mov rax, qword [rbp + 0xf]
cmp rdi, rax
ja 0x1400013ae
lea rbx, [rbp - 9]
cmp rax, 0x10
cmovae rbx, qword [rbp - 9]
mov qword [rbp + 7], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140005fb0
mov byte [rbx + rdi], r15b
jmp 0x1400013ba
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.140001830
call fcn.140007f0c
mov rdi, rax
lea rbx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rbx, qword [rbp - 9]
mov dword [rax], r12d
mov r8d, 0xa
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.1400082a8
mov r14d, eax
cmp rbx, qword [rbp - 0x59]
je 0x1400017a9
cmp dword [rdi], 0x22
je 0x1400017b6
lea rcx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rcx, qword [rbp - 0x51]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001467
lea rbx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rbx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, str.Failed_to_open_dump_file__s_with_the_last_error__i._n
call fcn.140001010
mov rbx, qword [rbp - 0x19]
jmp 0x1400016ae
mov ecx, 0x10
call fcn.140001c90
mov rbx, rax
mov qword [rbp - 0x11], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 8], r12
mov r8d, r14d
xor edx, edx
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140001970
mov rdi, rax
test rax, rax
jne 0x140001618
lea rcx, str.Failed_to_take_a_snapshot_of_the_target_process._Attempting_to_escalate_debug_privilege..._n
call fcn.140001010
mov edi, r12d
mov qword [rbp - 0x59], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x59]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400014f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_the_token_of_the_current_process_with_the_last_error__i._n
call fcn.140001010
jmp 0x14000157e
lea r8, [rbp - 0x11]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001517
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_lookup_the_current_debug_privilege_with_the_last_error__i._n
jmp 0x14000156d
mov dword [rbp + 0x17], 1
mov rax, qword [rbp - 0x11]
mov qword [rbp + 0x1b], rax
mov dword [rbp + 0x23], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, [rbp + 0x17]
xor edx, edx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001560
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001560
lea edi, [rax + 1]
jmp 0x14000157e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_adjust_debug_privileges_with_the_last_error__i._n
mov edx, eax
call fcn.140001010
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14000158d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400015a2
lea rcx, str.Failed_to_escalate_debug_privileges__are_you_running_ForkDump_as_Administrator__n
call fcn.140001010
jmp 0x14000166b
lea rcx, str.Escalated_debug_privileges__attempting_to_take_another_snapshot._n
call fcn.140001010
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400015cd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r12
mov edx, 0x10
mov rcx, rbx
call fcn.140001ccc
mov ecx, 0x10
call fcn.140001c90
mov rbx, rax
mov qword [rbp - 0x11], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 8], r12
mov r8d, r14d
xor edx, edx
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140001970
mov rdi, rax
test rax, rax
je 0x14000166b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 2
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x14000166b
mov r15d, 1
lea r8, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae r8, qword [rbp - 0x51]
mov edx, r14d
lea rcx, str.Successfully_dumped_process__i_to__s__n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400016a5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001698
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r12
mov edx, 0x10
mov rcx, rbx
call fcn.140001ccc
mov rbx, qword [rbp - 0x19]
jmp 0x1400016ae
mov r15d, r12d
cmp rbx, 0x10
jb 0x1400016e6
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017c3
call fcn.140001ccc
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
mov rdx, qword [rbp - 0x39]
cmp rdx, 0x10
jb 0x140001731
inc rdx
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000172c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017c9
call fcn.140001ccc
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140001778
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001773
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017a3
call fcn.140001ccc
mov eax, r15d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001c70
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140008508
nop
lea rcx, str.invalid_stoi_argument
call fcn.140001bf4
int3
lea rcx, str.stoi_argument_out_of_range
call fcn.140001c3c
nop
call fcn.140008508
nop
call fcn.140008508
int3