Function at 0x401350
Capabilities:
Enumerate processes
Register network filter via wfp api

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x98
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x310]
movlpd qword [ebp - 0x25c], xmm0
push 0
push eax
mov dword [ebp - 0x254], 0
movaps xmmword [ebp - 0x250], xmm0
movq qword [ebp - 0x240], xmm0
mov dword [ebp - 0x238], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x53c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x218], xmm0
push 0x228
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push str._i__Getting_WFP_engine_handle_n
call fcn.00401010
add esp, 4
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x401438
push eax
push str._X__FwpmEngineOpen0_failed_with_code_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str._i__Creating_provider_n
call fcn.00401010
movups xmm0, xmmword [0x403be8]
add esp, 4
mov dword [ebp - 0x268], str.Alex_WFPMDE
lea eax, [ebp - 0x278]
mov dword [ebp - 0x264], str.Alex_WFPMDE_process_passed_in_params
movups xmmword [ebp - 0x278], xmm0
mov dword [ebp - 0x260], 1
push 0
push eax
push dword [ebp - 0x220]
call dword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
cmp eax, 0x80320009
jne 0x4014e5
push str.______Provider_already_exists_n
call fcn.00401010
add esp, 4
push str._i__Get_system_process_list_n
call fcn.00401010
add esp, 4
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x544], esi
cmp esi, 0xffffffff
jne 0x40150a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___X__CreateToolhelp32Snapshot__of_processes__failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test eax, eax
je 0x40149a
push eax
push str.___X__FwpmProviderAdd0_failed_with_code_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x540]
mov dword [ebp - 0x540], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x401554
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___X__Process32First_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str._i__Add_filters_for_MDE_processes_n
call fcn.00401010
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
add esp, 4
nop word [eax + eax]
xor esi, esi
push dword [esi + 0x403bd0]
lea eax, [ebp - 0x51c]
push eax
call edi
test eax, eax
je 0x401592
add esi, 4
cmp esi, 0x18
jb 0x401572
jmp 0x401742
push dword [ebp - 0x538]
lea eax, [ebp - 0x51c]
push eax
push str.___i__Detected_MDE_process:__ls___d___opening_handle_to_read_full_path..._n
call fcn.00401010
add esp, 0xc
push dword [ebp - 0x538]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40172e
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmGetAppIdFromFileName0]
test eax, eax
jne 0x40177c
movups xmm0, xmmword [0x403150]
mov esi, dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x2bc], eax
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x310]
mov dword [ebp - 0x300], str.Alex_WFPMDE_filter
movups xmmword [ebp - 0x2e8], xmm0
push eax
movups xmm0, xmmword [0x403170]
mov dword [ebp - 0x2f8], 1
push dword [ebp - 0x220]
mov dword [ebp - 0x2b8], 0x1001
movups xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x23c], 0xc
mov dword [ebp - 0x2c0], 1
call esi
test eax, eax
jne 0x4016cc
push dword [ebp - 0x218]
lea eax, [ebp - 0x210]
push dword [ebp - 0x214]
push eax
push str._______Added_WFP_filter_for___ls___Filter_id:_0x_x_x__IPv4_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x4016da
push eax
push str._____X__Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
movups xmm0, xmmword [str._9rJ]
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x220]
movups xmmword [ebp - 0x2e8], xmm0
call esi
test eax, eax
jne 0x401726
push dword [ebp - 0x218]
lea eax, [ebp - 0x210]
push dword [ebp - 0x214]
push eax
push str._______Added_WFP_filter_for___ls___Filter_id:_0x_x_x__IPv6_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x401742
push eax
push str._____X__Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
jmp 0x40173a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___X__Error_opening_handle:_0x_x_n
call fcn.00401010
add esp, 8
lea eax, [ebp - 0x540]
push eax
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401570
push dword [ebp - 0x220]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
push str._____X__FwpmGetAppIdFromFileName0_failed_with_code_0x_x._n
call fcn.00401010
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
call fcn.00401cf3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret