Function at 0x140001a88
Capabilities:
Capture process snapshot data
Create process memory minidump
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0x2b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x250], rcx
mov dword [rbp + 0x22c], 0xffffffff
mov qword [rbp + 0x220], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x218], rax
mov dword [rbp + 0xe0], 0x130
mov rbx, qword [0x140009010]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [0x14000e080], rax
mov rax, qword [0x14000e080]
test rax, rax
jne 0x140001b96
mov rax, qword [0x140009010]
mov rdx, rax
lea rax, str._Debug__Failed_to_allocate_memory___d_bytes__n
mov rcx, rax
call sym.printf
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001ff4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edx
mov edx, 0
mov ecx, 0x1200
mov rax, qword [sym.imp.KERNEL32.dll_FormatMessageA]
call rax
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str._Debug__Failed_to_allocate_memory_with_error:__s_n
mov rcx, rax
call sym.printf
jmp 0x140001ff4
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001bcb
lea rax, str._Debug__Allocated_memory_for_the_memory_dump_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x250]
mov rdx, rax
lea rax, str._Debug__Attempting_to_find_PID_of__s_n
mov rcx, rax
call sym.printf
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x140001cc1
lea rax, [rbp + 0xe0]
lea rdx, [rax + 0x2c]
mov rax, qword [rbp + 0x250]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001c15
mov eax, dword [rbp + 0xe8]
mov dword [rbp + 0x22c], eax
jmp 0x140001c2f
lea rdx, [rbp + 0xe0]
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140001be9
cmp dword [rbp + 0x22c], 0xffffffff
jne 0x140001c9f
lea rax, str.Process_not_found_n
mov rcx, rax
call sym.printf
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001c63
lea rax, str._Debug__Freeing_allocated_memory_and_closing_snapshot_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x218]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rbx, qword [0x14000e080]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
jmp 0x140001ff5
mov edx, dword [rbp + 0x22c]
mov rax, qword [rbp + 0x250]
mov r8d, edx
mov rdx, rax
lea rax, str.____s_PID_d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x218]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001cfa
mov rax, qword [rbp + 0x250]
mov rdx, rax
lea rax, str._Debug__Attempting_to_open_handle_to_the___s__process_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x22c]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x220], rax
cmp qword [rbp + 0x220], 0
jne 0x140001db8
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001d8f
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edx
mov edx, 0
mov ecx, 0x1200
mov rax, qword [sym.imp.KERNEL32.dll_FormatMessageA]
call rax
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str._Debug__Failed_to_open_process_handle_with_error:__s_n
mov rcx, rax
call sym.printf
mov rbx, qword [0x14000e080]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
jmp 0x140001ff5
mov dword [rbp + 0x214], 0xac0003fd
mov qword [rbp + 0xd8], 0
lea rax, [rbp + 0xc0]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [sym.minidumpCallback]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], 0
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001e26
mov rax, qword [rbp + 0x250]
mov rdx, rax
lea rax, str._Debug__Attempting_to_clone_the___s__process_n
mov rcx, rax
call sym.printf
lea rcx, [rbp + 0xd8]
mov edx, dword [rbp + 0x214]
mov rax, qword [rbp + 0x220]
mov r9, rcx
mov r8d, 0x10001f
mov rcx, rax
call sym.PssCaptureSnapshot
test eax, eax
je 0x140001ef3
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001eb7
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, edx
mov edx, 0
mov ecx, 0x1200
mov rax, qword [sym.imp.KERNEL32.dll_FormatMessageA]
call rax
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str._Debug__Failed_to_clone_process_with_error:__s_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x220]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rbx, qword [0x14000e080]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
jmp 0x140001ff5
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001f19
mov rax, qword [rbp + 0x250]
mov rdx, rax
lea rax, str._Debug__Attempting_to_dump_the___s__process_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0xd8]
mov edx, dword [rbp + 0x22c]
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8d, 0
mov rcx, rax
call sym.MiniDumpWriteDump
mov dword [rbp + 0x210], eax
cmp dword [rbp + 0x210], 0
je 0x140001f7e
mov edx, dword [0x14000e088]
mov rax, qword [0x14000e080]
mov rcx, rax
call sym.reportBytesProcess
jmp 0x140001f97
mov rax, qword [rbp + 0x250]
mov rdx, rax
lea rax, str.___Failed_to_dump_the___s__process__n
mov rcx, rax
call sym.printf
mov rax, qword [0x14000ac30]
mov eax, dword [rax]
test eax, eax
je 0x140001fb3
lea rax, str._Debug__Freeing_allocated_memory_n
mov rcx, rax
call sym.printf
mov rbx, qword [0x14000e080]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapFree]
call rax
mov rbx, qword [rbp + 0xd8]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rdx, rbx
mov rcx, rax
call sym.PssFreeSnapshot
jmp 0x140001ff5
nop
add rsp, 0x2b8
pop rbx
pop rbp
ret