Function at 0x1400022a0
Capabilities:
Acquire debug privileges
Create process memory minidump
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x14003b020]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, ecx
mov rdi, rdx
mov ecx, 0x42
call fcn.14000c0c8
cmp ebx, 3
jne 0x14000268c
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x70], r14
call fcn.14000e3d8
mov rcx, qword [rdi + 0x10]
mov qword [0x14003d970], rcx
mov dword [0x14003d978], eax
cmp eax, 1
jne 0x140002578
xor esi, esi
mov ebx, esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000235e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9d, [rsi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], esi
lea edx, [rsi + 0x14]
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000236e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400023ac
lea rcx, str.not_admin_n
call fcn.140001120
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005d20
add rsp, 0x78
pop rdi
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x54], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002406
lea r8, [rsp + 0x54]
mov dword [rsp + 0x50], 1
lea rdx, str.SeDebugPrivilege
mov dword [rsp + 0x5c], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x140002412
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.no_SeDebugPrivs_n
jmp 0x140002379
mov qword [rsp + 0x28], rsi
lea r8, [rsp + 0x50]
mov r9d, 0x10
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140002400
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, str.dbgcore.dll
mov qword [0x14003d948], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [0x14003d948]
lea r8, [0x14003bc30]
mov r9d, 0xd
mov qword [rsp + 0x20], rsi
lea rdx, [rax + 0xe430]
lea rax, [0x1400021c0]
mov qword [0x14003d958], rdx
mov qword [0x14003bc32], rax
movsd xmm0, qword [rdx]
movsd qword [0x14003d960], xmm0
mov eax, dword [rdx + 8]
mov dword [0x14003d968], eax
movzx eax, byte [rdx + 0xc]
mov byte [0x14003d96c], al
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.140001180
mov rcx, qword [0x14003d970]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov dword [rsp + 0x20], 2
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14003d950], rax
test rax, rax
jne 0x14000250c
lea rcx, str.No_dump_for_you._Wrong_file_n
jmp 0x140002556
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8, qword [0x14003d950]
mov r9d, 2
mov qword [rsp + 0x30], rsi
mov edx, eax
mov qword [rsp + 0x28], rsi
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, qword [0x14003d950]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000255b
lea rcx, str.No_dump_for_you._Minidump_failed_n
call fcn.140001120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14003d948]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002383
cmp eax, 2
jne 0x140002671
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
lea edx, [rsi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov r8d, edi
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, edi
mov rcx, rbx
call fcn.140003570
mov qword [rsp + 0x30], rsi
lea rcx, str.sec.dmp
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r8d, edi
mov rdx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002658
lea rdx, str.Error_writing_to_file
call fcn.140002910
mov rcx, rax
call fcn.140002c00
lea eax, [rsi + 1]
jmp 0x140002383
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002383
lea rdx, str.erro_args
call fcn.140002910
mov rcx, rax
call fcn.140002c00
xor eax, eax
jmp 0x140002383
mov eax, 0xffffffff
jmp 0x140002398