Function at 0x4010c0
Capabilities:
Enumerate processes
Register network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54c
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x540]
mov dword [ebp - 0x230], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x548], eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x401136
push eax
push str.____FwpmEngineOpen0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
call fcn.00402180
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401171
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____CreateToolhelp32Snapshot__of_processes__failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x540]
mov dword [ebp - 0x540], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4011b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Process32First_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea ecx, [ebp - 0x51c]
call fcn.00401050
test eax, eax
je 0x401547
push dword [ebp - 0x538]
mov dword [ebp - 0x548], 1
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40152c
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
xorps xmm0, xmm0
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x310]
movq qword [ebp - 0x238], xmm0
movups xmmword [ebp - 0x248], xmm0
push 0x98
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], 0
xorps xmm0, xmm0
mov dword [ebp - 0x544], 0
movups xmmword [ebp - 0x274], xmm0
push eax
lea eax, [ebp - 0x210]
movq qword [ebp - 0x254], xmm0
push eax
push 0
push edi
movups xmmword [ebp - 0x264], xmm0
movq qword [ebp - 0x228], xmm0
movlpd qword [ebp - 0x218], xmm0
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea edx, [ebp - 0x544]
lea ecx, [ebp - 0x210]
call fcn.00402440
test eax, eax
je 0x401360
dec eax
cmp eax, 4
ja case.default.0x4012cd
jmp dword [eax*4 + 0x401594]
lea eax, [ebp - 0x210]
push eax
push str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call fcn.00401010
add esp, 8
push edi
call esi
jmp 0x401547
lea eax, [ebp - 0x210]
push eax
push str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call fcn.00401010
add esp, 8
push edi
call esi
jmp 0x401547
lea eax, [ebp - 0x210]
push eax
push str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call fcn.00401010
add esp, 8
push edi
call esi
jmp 0x401547
lea eax, [ebp - 0x210]
push eax
push str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call fcn.00401010
add esp, 8
push edi
call esi
jmp 0x401547
lea eax, [ebp - 0x210]
push eax
push str.________CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call fcn.00401010
add esp, 8
push edi
call esi
jmp 0x401547
movups xmm0, xmmword [0x4054c8]
mov esi, dword [ebp - 0x544]
lea eax, [ebp - 0x24c]
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x300], str.Custom_Outbound_Filter
movups xmmword [ebp - 0x2e8], xmm0
mov dword [ebp - 0x2f8], 1
movups xmm0, xmmword [0x4053cc]
mov dword [ebp - 0x2b8], 0x1001
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x238], 0xc
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2c0], 1
call fcn.00402540
test eax, eax
je 0x4013ed
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x2f4], eax
jmp 0x401454
push 0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x264], str.Microsoft_Corporation
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x260], str.Microsoft_Windows_WFP_Built_in_custom_provider.
mov dword [ebp - 0x25c], 1
call dword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
test eax, eax
je 0x401434
push eax
push str.________FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
jmp 0x401454
lea edx, [ebp - 0x22c]
call fcn.00402540
test eax, eax
lea ecx, [ebp - 0x22c]
cmove ecx, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f4], ecx
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x401496
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push dword [ebp - 0x218]
push eax
push str.____Added_WFP_filter_for___S___Filter_id:__d__IPv4_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x4014a4
push eax
push str.________Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
movups xmm0, xmmword [str._9rJ]
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x230]
movups xmmword [ebp - 0x2e8], xmm0
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x4014f4
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push dword [ebp - 0x218]
push eax
push str.____Added_WFP_filter_for___S___Filter_id:__d__IPv6_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x401502
push eax
push str.________Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
test esi, esi
je 0x401521
mov eax, dword [esi + 4]
test eax, eax
je 0x401517
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
jmp 0x401547
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x51c]
push eax
push str.________Could_not_open_process___s__with_error_code:_0x_x._n
call fcn.00401010
add esp, 0xc
lea eax, [ebp - 0x540]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4011c0
mov eax, dword [ebp - 0x548]
test eax, eax
jne 0x401574
push str.____No_EDR_process_was_detected._Please_double_check_the_edrProcess_list_or_add_the_filter_manually_using_block_command._n
call fcn.00401010
add esp, 4
push ebx
call esi
push dword [ebp - 0x230]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004026a0
mov esp, ebp
pop ebp
ret