Function at 0x10001df0
Capabilities:
Create thread
Delete network filter via wfp api
Enumerate network filters via wfp api
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x100b5004]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
push 0x5c
call fcn.1007bcba
mov esi, eax
add esp, 4
xorps xmm0, xmm0
mov ecx, esi
mov dword [esi + 0x58], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi], 0x44
movups xmmword [esi + 0x44], xmm0
mov dword [esi + 0x54], 0
call fcn.10010bc0
mov edi, eax
test edi, edi
jne 0x10001ec0
mov ecx, esi
call fcn.10011080
mov edi, eax
test edi, edi
jne 0x10001ec0
mov ecx, esi
call fcn.100112c0
mov edi, eax
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10001ee9
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x44]
test eax, eax
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10001f01
push eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x10001f12
push eax
call ecx
mov dword [esi + 0x48], 0
push 0x5c
push esi
call fcn.1007bcac
push 1
call fcn.1007bcba
add esp, 0xc
mov dword [esp + 0xc], eax
call fcn.10011770
test edi, edi
jne 0x1000200e
push 0x5058
call fcn.1007bcba
add esp, 4
mov esi, eax
push 0x5058
push edi
push esi
call fcn.1007d2d0
add esp, 0xc
mov ecx, esi
call fcn.10001950
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0
push 0
push edi
push 0x10002fa0
push 0
push 0
call esi
push 0
push 0
push edi
push 0x100030b0
push 0
push 0
mov dword [edi + 0x503c], eax
call esi
push 0xffffffffffffffff
push dword [edi + 4]
mov dword [edi + 0x5040], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0x5044]
test ecx, ecx
je 0x10001fa8
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [edi + 0x5048]
test ecx, ecx
je 0x10001fb7
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi + 4]
test eax, eax
je 0x10001fcc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov ecx, dword [edi + 0x5044]
test ecx, ecx
je 0x10001fe6
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x5044], 0
mov ecx, dword [edi + 0x5048]
test ecx, ecx
je 0x10002000
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x5048], 0
push 0x5058
push edi
call fcn.1007bcac
add esp, 8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x2c], 0
movaps xmmword [esp + 0x34], xmm0
mov dword [esp + 0x30], 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
jne 0x1000213c
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x18]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterCreateEnumHandle0]
test eax, eax
jne 0x1000213c
mov edi, dword [sym.imp.fwpuclnt.dll_FwpmFilterEnum0]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push dword [esp + 0x20]
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x10002124
nop
cmp dword [esp + 0x1c], 0
je 0x10002106
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
mov eax, str.local_outbound_filter_rules
mov ecx, dword [esi + 0x10]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100020cb
test dx, dx
je 0x100020c7
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100020cb
add ecx, 4
add eax, 4
test dx, dx
jne 0x100020a5
xor eax, eax
jmp 0x100020d0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100020ea
push dword [esi + 0x8c]
push dword [esi + 0x88]
push dword [esp + 0x18]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDeleteById0]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push dword [esp + 0x20]
push dword [esp + 0x20]
call edi
test eax, eax
je 0x10002090
jmp 0x10002124
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.10011de0
test eax, eax
jne 0x10002124
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
call dword [sym.imp.fwpuclnt.dll_FwpmProviderDeleteByKey0]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDestroyEnumHandle0]
push dword [esp + 0x10]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
push 1
push dword [esp + 0x10]
call fcn.1007bcac
mov ecx, dword [esp + 0x44]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.1007bc9e
mov esp, ebp
pop ebp
ret