Function at 0x404f2a
Capabilities:
Register network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x408a20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea edi, [ebp - 0x4c]
xor eax, eax
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x22], ax
mov esi, 0x407200
mov dword [ebp - 0x2c], ebx
mov eax, 0x406a4a
mov dword [ebp - 0x28], ebx
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x4c]
push eax
push dword [0x408aec]
mov dword [ebp - 0x34], ebx
call sub.fwpkclnt.sys_FwpmSubLayerAdd0
test eax, eax
jne 0x405173
push 0x98
lea eax, [ebp - 0xe4]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov esi, 0x407238
mov byte [ebp - 5], bl
lea edi, [ebp - 0xbc]
add esp, 0xc
lea eax, [ebp - 0x20]
xor ecx, ecx
inc ecx
movsd dword es:[edi], dword [esi]
push 0x408af0
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xd4], 0x406a88
lea edi, [ebp - 0x88]
mov dword [ebp - 0xd0], 0x406ac8
mov esi, 0x4071f0
mov dword [ebp - 0x8c], 0x6004
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], eax
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0xac]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 7], ax
lea eax, [ebp - 0xe4]
push eax
push dword [0x408aec]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x407248
mov dword [ebp - 0x9c], ebx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x94], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], 3
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], bl
call sub.fwpkclnt.sys_FwpmFilterAdd0
test eax, eax
jne 0x405173
push 0x98
lea eax, [ebp - 0xe4]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov esi, 0x407218
lea edi, [ebp - 0xbc]
add esp, 0xc
xor eax, eax
movsd dword es:[edi], dword [esi]
push 7
pop ecx
push 0x408af8
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8c], 0x6004
lea edi, [ebp - 0x88]
mov esi, 0x4071d0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x9c], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xe4]
push eax
push dword [0x408aec]
mov dword [ebp - 0xd4], 0x406b3e
mov dword [ebp - 0xd0], 0x406b6e
call sub.fwpkclnt.sys_FwpmFilterAdd0
test eax, eax
jne 0x405173
push 0x98
lea eax, [ebp - 0xe4]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov esi, 0x407228
lea edi, [ebp - 0xbc]
add esp, 0xc
xor eax, eax
movsd dword es:[edi], dword [esi]
push 7
pop ecx
push 0x408b08
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8c], 0x6004
lea edi, [ebp - 0x88]
mov esi, 0x4071b0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x20]
mov dword [ebp - 0x9c], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xe4]
push eax
push dword [0x408aec]
mov dword [ebp - 0xd4], 0x406ba0
mov dword [ebp - 0xd0], 0x406bd8
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406896
leave
ret