Function at 0x1400260c0
Capabilities:
Delete network filter via wfp api

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x1400358b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 8
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa8]
cmp dword [rax], ecx
je 0x140026126
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov dword [rsp + 0x24], 0xc0000184
jmp 0x140026385
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x280]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x140026161
jmp 0x1400262a9
mov dword [rsp + 0x20], 0
jmp 0x140026175
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc
jae 0x140026288
mov rax, qword [rsp + 0xa0]
add rax, 8
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa8]
cmp dword [rax], ecx
je 0x1400261cf
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
mov dword [rsp + 0x24], 0xc0000184
jmp 0x140026385
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rcx + rax*4 + 0x250]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0xa0]
mov rdi, rcx
lea rsi, [rdx + rax + 0xd0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
lea rcx, [rsp + 0x60]
mov rdx, qword [rsp + 0xa0]
mov rdi, rcx
lea rsi, [rdx + rax + 0x190]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
cmp dword [rsp + 0x28], 0
jne 0x14002624b
jmp 0x14002616b
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmFilterDeleteByKey0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x140026267
jmp 0x140026288
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmCalloutDeleteByKey0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x140026283
jmp 0x140026288
jmp 0x14002616b
cmp dword [rsp + 0x24], 0
jge 0x14002629b
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
jmp 0x1400262a9
mov rcx, qword [rsp + 0x30]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], 0
jmp 0x1400262bd
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc
jae 0x140026385
mov rax, qword [rsp + 0xa0]
add rax, 8
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa8]
cmp dword [rax], ecx
je 0x1400262fa
jmp 0x14002610e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rcx + rax*4 + 0x250]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
lea rcx, [rsp + 0x50]
mov rdx, qword [rsp + 0xa0]
mov rdi, rcx
lea rsi, [rdx + rax + 0xd0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xa0]
mov dword [rcx + rax*4 + 0x250], 0
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
cmp dword [rsp + 0x28], 0
jne 0x140026366
jmp 0x1400262b3
lea rcx, [rsp + 0x50]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterByKey0
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x140026380
jmp 0x1400262b3
jmp 0x1400262b3
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002cd90
add rsp, 0x88
pop rdi
pop rsi
ret