Function at 0x41f830
Capabilities:
Create thread
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46795b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x408
mov eax, dword [0x4b6100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x400]
push edi
push 0x3e8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
cmp dword [0x4b8eb4], 0
je 0x41f94b
mov ecx, dword [0x4b9a40]
sub esp, 8
mov eax, esp
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
movq xmm0, qword [ebp - 0x418]
push 2
sub esp, 0xc
mov dword [eax], str.deleting_old_filter
mov dword [eax + 4], 0x13
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00402270
push dword [0x4b8eb4]
call dword [sym.imp.WinDivert.dll_WinDivertClose]
add esp, 4
test eax, eax
jne 0x41f94b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x4b9a40]
call eax
push 0x24
mov dword [ebp - 0x404], eax
mov ecx, esi
push str.Failed_to_close_WinDivert_device__
lea eax, [ebp - 0x404]
mov dword [ebp - 0x418], 0
push eax
push 4
sub esp, 0xc
mov dword [ebp - 0x414], 0
movq xmm0, qword [ebp - 0x418]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00421320
mov ecx, dword [0x4b9a40]
sub esp, 8
mov eax, esp
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
movq xmm0, qword [ebp - 0x418]
push 2
sub esp, 0xc
mov dword [eax], str.creating_new_filter
mov dword [eax + 4], 0x13
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00402270
push 0
push 0
push 0x3e8
lea eax, [ebp - 0x400]
push 0
push eax
call dword [sym.imp.WinDivert.dll_WinDivertOpen]
add esp, 0x14
mov dword [0x4b8eb4], eax
cmp eax, 0xffffffff
jne 0x41fa38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41fa02
push 0
push 0x4b8eb0
push 0
push 0
push 0
push edi
call dword [sym.imp.WinDivert.dll_WinDivertHelperCompileFilter]
add esp, 0x18
test eax, eax
jne 0x41fa02
push 0x12
push str.Invalid_filter__
push ecx
mov ecx, 0x4b9a40
call fcn.00404ea0
mov ecx, eax
call fcn.00420be0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, 0x4b9a40
call fcn.00404ea0
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push 0x23
mov dword [ebp - 0x404], eax
mov ecx, esi
push str.Failed_to_open_WinDivert_device__
lea eax, [ebp - 0x404]
push eax
call fcn.00420ba0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp byte [0x4b8eb8], 0
jne 0x41fafa
mov ecx, dword [0x4b9a40]
sub esp, 8
mov eax, esp
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
movq xmm0, qword [ebp - 0x418]
push 2
sub esp, 0xc
mov dword [eax], str.Starting_windivert_thread
mov dword [eax + 4], 0x19
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00402270
push 4
call fcn.004640b5
add esp, 4
mov dword [ebp - 0x404], eax
mov dword [eax], 0x4b9a28
lea ecx, [ebp - 0x408]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x421020
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x41fb22
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x408]
test ecx, ecx
je 0x41fb1a
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x41fb1a
mov byte [0x4b8eb8], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004640a7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x408], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3