Function at 0x44aaa0
Capabilities:
Execute command
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x6c
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x3c]
mov dword [esp], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], eax
call dword [method.QCoreApplication.applicationDirPath__]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x48], edx
mov edx, dword [eax]
test edx, edx
je 0x44b031
cmp edx, 0xffffffff
je 0x44aaf0
lock sub dword [eax], 1
je 0x44b031
lea esi, [esi]
lea eax, [ebp - 0x30]
lea edi, [ebp - 0x48]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4ecbef
mov dword [esp], eax
mov eax, dword [method.QString.fromUtf8_helper_char_const__int_]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], eax
call eax
lea esi, [ebp - 0x30]
mov dword [ebp - 0x4c], edi
mov ecx, edi
mov edi, dword [method.QString.append_QString_const_]
mov dword [esp], esi
call edi
mov eax, dword [ebp - 0x30]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x44b0b1
cmp edx, 0xffffffff
je 0x44ab4b
lock sub dword [eax], 1
mov eax, dword [ebp - 0x30]
je 0x44b0b1
lea esi, [ebp - 0x2c]
mov dword [esp + 8], 0x12
mov dword [esp + 4], str.FirewallDelete.log
mov eax, dword [ebp - 0x50]
mov dword [esp], esi
call eax
mov dword [esp], esi
mov ecx, dword [ebp - 0x4c]
call edi
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov edx, dword [eax]
test edx, edx
je 0x44b0f0
cmp edx, 0xffffffff
je 0x44ab90
lock sub dword [eax], 1
mov eax, dword [ebp - 0x2c]
je 0x44b0f0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call dword [method.QOperatingSystemVersion.current__]
lea ecx, [ebp - 0x44]
mov dword [esp], ebx
call fcn.0044a670
mov eax, dword [method.QString.fromAscii_helper_char_const__int_]
sub esp, 4
mov dword [esp + 4], 0x57
mov dword [esp], str.Deleting_firewall_rules_for_GemUpdater._nThere_will_be__1_popup_windows._n_nPlease_wait...
mov dword [ebp - 0x50], eax
call eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov ecx, 0x20
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
mov word [esp + 0x14], cx
mov dword [esp + 0x10], 0xa
lea ecx, [ebp - 0x40]
mov dword [esp + 0xc], 0
mov dword [esp], esi
mov dword [esp + 4], eax
sar eax, 0x1f
mov dword [esp + 8], eax
call dword [method.QString.arg_long_long__int__int__QChar__const]
mov eax, dword [ebp - 0x2c]
sub esp, 0x18
mov edx, dword [eax]
test edx, edx
je 0x44b0d0
cmp edx, 0xffffffff
je 0x44ac22
lock sub dword [eax], 1
mov eax, dword [ebp - 0x2c]
je 0x44b0d0
mov dword [esp + 4], 0x17
mov dword [esp], str.Deleting_firewall_rules
mov eax, dword [ebp - 0x50]
call eax
mov dword [esp], 0x18
mov dword [ebp - 0x2c], eax
call sub.libstdc_6.dll_operator_new_unsigned_int_
mov dword [esp + 0x10], ebx
lea ebx, [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov dword [esp + 0x14], 0x40000
mov dword [esp + 0xc], 0
mov ecx, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 1
call dword [method.QMessageBox.QMessageBox_QMessageBox::Icon__QString_const__QString_const__QFlags_QMessageBox::StandardButton___QWidget__QFlags_Qt::WindowType__]
mov eax, dword [ebp - 0x2c]
sub esp, 0x18
mov edx, dword [eax]
test edx, edx
je 0x44b070
cmp edx, 0xffffffff
je 0x44ac98
lock sub dword [eax], 1
mov eax, dword [ebp - 0x2c]
je 0x44b070
mov edi, dword [ebp - 0x54]
mov dword [esp], 1
mov ecx, edi
call dword [method.QDialog.setModal_bool_]
sub esp, 4
mov ecx, edi
call dword [method.QWidget.show__]
mov dword [esp], 1
call dword [method.QCoreApplication.processEvents_QFlags_QEventLoop::ProcessEventsFlag__]
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
test eax, eax
jle 0x44aead
xor ebx, ebx
mov edi, dword [method.QString.arg_QString_const__int__QChar__const]
jmp 0x44ad81
cmp edx, 0xffffffff
je 0x44acf2
lock sub dword [eax], 1
mov eax, dword [ebp - 0x2c]
je 0x44ae35
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
test edx, edx
je 0x44ae5b
cmp edx, 0xffffffff
je 0x44ad11
lock sub dword [eax], 1
mov eax, dword [ebp - 0x30]
je 0x44ae5b
lea eax, [ebp - 0x3c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [method.QString.toLatin1_helper_QString_const_]
mov eax, dword [ebp - 0x2c]
add eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
test edx, edx
je 0x44af10
cmp edx, 0xffffffff
je 0x44ad4e
lock sub dword [eax], 1
mov eax, dword [ebp - 0x2c]
je 0x44af10
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
test edx, edx
je 0x44ae80
cmp edx, 0xffffffff
je 0x44ad6d
lock sub dword [eax], 1
mov eax, dword [ebp - 0x3c]
je 0x44ae80
mov edx, dword [ebp - 0x44]
add ebx, 1
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
cmp ebx, eax
jge 0x44aead
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov dword [ebp - 0x3c], eax
mov eax, dword [sym.imp.Qt5Core.dll_QOperatingSystemVersion::Windows7]
mov eax, dword [eax]
cmp dword [ebp - 0x28], eax
je 0x44af51
mov dword [esp + 4], 0x4d
mov dword [esp], str.powershell__windowstyle_hidden_Remove_NetFirewallRule__DisplayName___1______2
mov eax, dword [ebp - 0x50]
call eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov edx, 0x20
mov word [esp + 0xc], dx
mov dword [esp + 8], 0
mov ecx, esi
mov edx, dword [eax + 8]
add edx, ebx
lea eax, [eax + edx*4 + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call edi
sub esp, 0x10
mov eax, 0x20
lea ecx, [ebp - 0x34]
mov word [esp + 0xc], ax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
sub esp, 0x10
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], eax
mov edx, dword [eax]
test edx, edx
je 0x44af30
cmp edx, 0xffffffff
je 0x44ae28
lock sub dword [eax], 1
je 0x44af30
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
test edx, edx
jne 0x44ace0
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 2
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
test edx, edx
jne 0x44acff
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ad11
mov dword [esp], eax
mov dword [esp + 8], 4
add ebx, 1
mov dword [esp + 4], 2
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 8]
cmp ebx, eax
jl 0x44ad81
mov edi, dword [ebp - 0x54]
mov ecx, edi
call dword [method.QWidget.close__]
mov ecx, edi
call dword [method.QObject.deleteLater__]
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
test edx, edx
je 0x44b052
cmp edx, 0xffffffff
je 0x44aedf
lock sub dword [eax], 1
mov eax, dword [ebp - 0x40]
je 0x44b052
lea ecx, [ebp - 0x44]
call fcn.004b5840
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
test edx, edx
je 0x44b090
cmp edx, 0xffffffff
je 0x44af06
lock sub dword [eax], 1
mov eax, dword [ebp - 0x48]
je 0x44b090
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ad4e
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ae28
mov eax, dword [sym.imp.Qt5Core.dll_QOperatingSystemVersion::Windows7]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call dword [method.QOperatingSystemVersion.compare_QOperatingSystemVersion_const__QOperatingSystemVersion_const_]
test eax, eax
jg 0x44ad99
mov dword [esp + 4], 0x36
mov dword [esp], str.netsh_advfirewall_firewall_delete_rule_name__1______2
mov eax, dword [ebp - 0x50]
call eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
mov edx, 0x20
mov word [esp + 0xc], dx
mov dword [esp + 8], 0
mov ecx, esi
mov edx, dword [eax + 8]
add edx, ebx
lea eax, [eax + edx*4 + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov eax, dword [method.QString.arg_QString_const__int__QChar__const]
mov dword [ebp - 0x58], eax
call eax
sub esp, 0x10
mov ecx, 0x20
mov eax, dword [ebp - 0x58]
mov word [esp + 0xc], cx
mov ecx, dword [ebp - 0x4c]
mov dword [esp + 8], 0
mov dword [esp], esi
mov dword [esp + 4], ecx
lea ecx, [ebp - 0x38]
call eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
sub esp, 0x10
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
mov edx, dword [eax]
test edx, edx
je 0x44b010
cmp edx, 0xffffffff
je 0x44ae28
lock sub dword [eax], 1
jne 0x44ae28
nop
lea esi, [esi]
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ae28
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44aaf0
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44aedf
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ac98
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ab4b
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ac22
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x44ab90