Function at 0x14002d220
Capabilities:
Acquire debug privileges
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
push r14
push r15
sub rsp, 0x520
mov rax, qword [0x1402bf200]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov edi, dword [r11 + 8]
mov rsi, rdx
xor r15d, r15d
mov dword [rsp + 0x4a0], 0x39354243
mov dword [rsp + 0x4a4], 0x46414344
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x5c], rax
mov dword [rsp + 0x64], 0xb9
lea rdx, [rsp + 0x50]
call fcn.140034020
mov ebx, r15d
mov qword [rsp + 0x4b0], rbx
mov r8, rsi
mov edx, edi
lea rcx, [rsp + 0x440]
call fcn.14002af50
nop
mov r8d, dword [rsp + 0x444]
test r8d, r8d
jne 0x14002d2f8
lea rcx, [rsp + 0x478]
call fcn.14002adf0
lea rcx, [rsp + 0x458]
call fcn.14002adf0
nop
mov eax, 3
jmp 0x14002df0b
cmp byte [rsp + 0x498], 0
jne 0x14002d30c
cmp r8d, 0xffffffff
jne 0x14002d4cc
mov ecx, 0x20
call fcn.14019af70
mov rbx, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x168], r15
mov r8d, 0x10
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x150]
call fcn.14002a920
mov r8b, 1
lea rdx, [rsp + 0x150]
mov rcx, rbx
call fcn.14002ae60
mov rbx, rax
mov qword [rsp + 0x4b0], rax
mov r8d, dword [rsp + 0x444]
cmp r8d, 0xffffffff
jne 0x14002d4cc
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x440]
mov dword [rsp + 0x1c0], eax
mov edi, r8d
mov dword [rsp + 0x1c4], r8d
mov eax, dword [rsp + 0x448]
mov dword [rsp + 0x1c8], eax
mov eax, dword [rsp + 0x44c]
mov dword [rsp + 0x1cc], eax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x1d0], rax
lea rdx, [rsp + 0x458]
lea rcx, [rsp + 0x1d8]
call fcn.140024420
nop
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x1f8]
call fcn.140024420
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x218], al
movzx eax, byte [rsp + 0x499]
mov byte [rsp + 0x219], al
lea rcx, [rsp + 0x1c0]
call fcn.140065cb0
lea rax, str.Successfully_dumped_kernel_memory_into_
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x4d8], 0x2b
mov dword [rsp + 0x4a0], 0x39354243
mov dword [rsp + 0x4a4], 0x46414344
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0x90], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x9c], rax
mov dword [rsp + 0xa4], 0xc9
movaps xmm0, xmmword [rsp + 0x4d0]
movdqa xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x458]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x90]
lea ecx, [rdi + 3]
call fcn.140034100
jmp 0x14002dd3f
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x4c0], rax
test rax, rax
je 0x14002d6c5
mov dword [rsp + 0x4b8], 0xffffffff
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
lea rcx, str..pipelsass
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002d54d
lea rdx, [rsp + 0x4b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
mov r14d, dword [rsp + 0x4b8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002d555
mov r14d, dword [rsp + 0x4b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, r14d
jne 0x14002d6c5
mov dword [rsp + 0x4a0], 0x39354243
mov dword [rsp + 0x4a4], 0x46414344
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0x110], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x118], eax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x11c], rax
mov dword [rsp + 0x124], 0xd3
xorps xmm0, xmm0
movups xmmword [rsp + 0x4f0], xmm0
lea rcx, [rsp + 0x4f0]
call fcn.140026d50
nop
mov rcx, qword [rsp + 0x4f0]
test rcx, rcx
je 0x14002d625
mov rax, qword [rcx]
lea rdx, str.Lsass_dumping_is_not_supported
mov qword [rsp + 0x4d0], rdx
mov qword [rsp + 0x4d8], 0x1e
movaps xmm0, xmmword [rsp + 0x4d0]
movdqa xmmword [rsp + 0x70], xmm0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x110]
mov edx, 7
mov rax, qword [rax + 0x10]
call qword [case.0x1400617cf.0]
nop
mov rsi, qword [rsp + 0x4f8]
test rsi, rsi
je 0x14002d67c
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14002d66c
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x1400617cf.0]
lock xadd dword [rsi + 0xc], edi
cmp edi, 1
jne 0x14002d66c
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400617cf.0]
mov rdi, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x4b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x478]
call fcn.14002adf0
lea rcx, [rsp + 0x458]
call fcn.14002adf0
nop
test rbx, rbx
je 0x14002d6bb
mov rcx, rbx
call fcn.1400478e0
mov edx, 0x20
mov rcx, rbx
call fcn.14019af20
mov eax, 9
jmp 0x14002df0b
cmp byte [rsp + 0x498], 0
je 0x14002d87b
xorps xmm0, xmm0
movups xmmword [rsp + 0x500], xmm0
mov ecx, 0x90
call fcn.14019af70
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.140002500
mov rsi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x500], xmm0
mov qword [rsp + 0x48], rax
mov ecx, 0x18
call fcn.14019af70
mov qword [rsp + 0x4e0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_struct_asw::crashguard::DebugThreadContext_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rsi
mov qword [rsp + 0x500], rsi
mov qword [rsp + 0x508], rax
mov eax, dword [rsp + 0x440]
mov dword [rsi + 0x28], eax
mov eax, dword [rsp + 0x444]
mov dword [rsi + 0x2c], eax
mov eax, dword [rsp + 0x448]
mov dword [rsi + 0x30], eax
mov eax, dword [rsp + 0x44c]
mov dword [rsi + 0x34], eax
mov rax, qword [rsp + 0x450]
mov qword [rsi + 0x38], rax
lea rcx, [rsi + 0x40]
lea rax, [rsp + 0x458]
cmp rcx, rax
je 0x14002d7b9
lea rdx, [rsp + 0x458]
cmp qword [rsp + 0x470], 7
cmova rdx, qword [rsp + 0x458]
mov r8, qword [rsp + 0x468]
call fcn.14002a5c0
lea rcx, [rsi + 0x60]
lea rax, [rsp + 0x478]
cmp rcx, rax
je 0x14002d7f1
lea rdx, [rsp + 0x478]
cmp qword [rsp + 0x490], 7
cmova rdx, qword [rsp + 0x478]
mov r8, qword [rsp + 0x488]
call fcn.14002a5c0
movzx eax, byte [rsp + 0x498]
mov byte [rsi + 0x80], al
movzx eax, byte [rsp + 0x499]
mov byte [rsi + 0x81], al
lea rcx, [rsp + 0x500]
call fcn.140003290
nop
mov rsi, qword [rsp + 0x508]
test rsi, rsi
je 0x14002dd30
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14002d866
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x1400617cf.0]
lock xadd dword [rsi + 0xc], edi
cmp edi, 1
jne 0x14002d866
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400617cf.0]
mov rbx, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4c0]
jmp 0x14002dd30
lea rax, [rsp + 0x458]
cmp qword [rsp + 0x470], 7
cmova rax, qword [rsp + 0x458]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x468]
mov qword [rsp + 0x138], rax
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x190], xmm0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x280]
call fcn.1400579a0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002d080
lea rcx, [rsp + 0x4e0]
call fcn.1401af58c
movabs rcx, 0x2b6109100
add rcx, qword [rsp + 0x4e0]
imul rdx, rcx, 0x989680
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x80], edx
mov rsi, qword [rsp + 0x80]
sub rsi, qword [rsp + 0x48]
movabs r14, 0x1ca213d840baf7d5
mov rax, r14
imul rsi
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rcx, dword [rsp + 0x44c]
cmp rdx, rcx
jl 0x14002dd7b
lea rax, [rsp + 0x220]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x440]
mov dword [rsp + 0x220], eax
mov eax, dword [rsp + 0x444]
mov dword [rsp + 0x224], eax
mov eax, dword [rsp + 0x448]
mov dword [rsp + 0x228], eax
mov dword [rsp + 0x22c], ecx
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x230], rax
lea rdx, [rsp + 0x458]
lea rcx, [rsp + 0x238]
call fcn.140024420
nop
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x258]
call fcn.140024420
movzx eax, byte [rsp + 0x498]
mov byte [rsp + 0x278], al
movzx eax, byte [rsp + 0x499]
mov byte [rsp + 0x279], al
lea rcx, [rsp + 0x220]
call fcn.140064750
mov eax, dword [rsp + 0x440]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4a0], 0x39354243
mov dword [rsp + 0x4a4], 0x46414344
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0xf8], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0x100], eax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x104], rax
mov dword [rsp + 0x10c], 0xe9
xorps xmm0, xmm0
movups xmmword [rsp + 0x4d0], xmm0
lea rcx, [rsp + 0x4d0]
call fcn.140026d50
nop
mov rsi, qword [rsp + 0x4d0]
test rsi, rsi
je 0x14002db5d
lea rax, str.Successfully_dumped_process__into___dump_level:_:x_
mov qword [rsp + 0x4f0], rax
mov qword [rsp + 0x4f8], 0x3c
mov rax, qword [rsi]
mov edx, 2
mov rcx, rsi
mov rax, qword [rax + 0x78]
call qword [case.0x1400617cf.0]
test al, al
je 0x14002db5d
movaps xmm0, xmmword [rsp + 0x4f0]
movdqa xmmword [rsp + 0xc0], xmm0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x458]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x444]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x2a0]
call fcn.140037940
nop
mov rcx, qword [rsi]
mov r10, qword [rcx + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x14002db11
mov rcx, qword [rax]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x90], xmm0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xf8]
mov edx, 2
mov rcx, rsi
mov rax, r10
call qword [case.0x1400617cf.0]
nop
lea rcx, [rsp + 0x2a0]
call fcn.14002adf0
nop
mov rsi, qword [rsp + 0x4d8]
test rsi, rsi
je 0x14002dbb4
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14002dba4
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x1400617cf.0]
lock xadd dword [rsi + 0xc], edi
cmp edi, 1
jne 0x14002dba4
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400617cf.0]
mov rdi, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x4b0]
lea rax, [rsp + 0x458]
cmp qword [rsp + 0x470], 7
cmova rax, qword [rsp + 0x458]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x468]
mov qword [rsp + 0x148], rax
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x2c0]
call fcn.1400579a0
mov r14, rax
mov qword [rsp + 0x4a0], rax
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x14002dc24
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002dc68
test al, 0x10
je 0x14002dc68
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x14002dc7a
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x14002dc49
mov rax, qword [r14]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14002dc7a
mov r8d, 1
lea rdx, [0x14023d380]
mov rcx, r14
call fcn.140023d10
jmp 0x14002dc7a
xor r8d, r8d
lea rdx, [0x14023d384]
mov rcx, r14
call fcn.14002a5c0
mov rcx, qword [r14 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x14002df34
mov r9, r14
cmp qword [r14 + 0x18], 7
jbe 0x14002dca2
mov r9, qword [r14]
mov qword [rsp + 0x30], 9
lea rax, str.last.dump
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x170]
call fcn.1400230c0
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rcx, qword [rsp + 0x170]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rsp + 0x170]
call fcn.14002adf0
cmp rsi, 0xffffffffffffffff
je 0x14002dd27
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r14
call fcn.14002adf0
nop
test rdi, rdi
je 0x14002dd3f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x478]
call fcn.14002adf0
lea rcx, [rsp + 0x458]
call fcn.14002adf0
nop
test rbx, rbx
je 0x14002dd74
mov rcx, rbx
call fcn.1400478e0
mov edx, 0x20
mov rcx, rbx
call fcn.14019af20
xor eax, eax
jmp 0x14002df0b
mov dword [rsp + 0x4a0], 0x39354243
mov dword [rsp + 0x4a4], 0x46414344
movsd xmm0, qword [str.dump]
movsd qword [rsp + 0xc0], xmm0
mov eax, dword [0x14023c298]
mov dword [rsp + 0xc8], eax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0xcc], rax
mov dword [rsp + 0xd4], 0xef
lea rcx, [rsp + 0x90]
call fcn.140026d50
lea r9, [rsp + 0xc0]
mov r8d, 4
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.140025780
nop
lea rdx, str.Minimum_interval_between_dumps__
lea rcx, [rsp + 0x2e0]
call fcn.140028820
lea rdx, [rsp + 0x44c]
mov rcx, rax
call fcn.1400095a0
lea rdx, str._minutes__was_not_yet_reached
mov rcx, rax
call fcn.140028820
mov rcx, rax
call fcn.140030ff0
mov r8, rax
mov rax, r14
imul rsi
sar rdx, 0x1a
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
mov rcx, r8
call fcn.140031040
mov rcx, rax
call fcn.140031090
nop
lea rcx, [rsp + 0x2e0]
call fcn.140028440
nop
test rdi, rdi
je 0x14002de80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x478]
call fcn.14002adf0
lea rcx, [rsp + 0x458]
call fcn.14002adf0
nop
test rbx, rbx
je 0x14002deb5
mov rcx, rbx
call fcn.1400478e0
mov edx, 0x20
mov rcx, rbx
call fcn.14019af20
mov eax, 8
jmp 0x14002df0b
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.14019acb0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14002a900
nop
int3