Function at 0x16378
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rcx, qword [0x0001ad38]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
xor esi, esi
cmp eax, esi
jl 0x16959
lea edi, [rsi + 0x48]
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rdi
call fcn.00018340
mov rcx, qword [0x0001ad38]
lea rax, [0x00018c40]
movdqu xmm5, xmmword [0x0001aca0]
movdqu xmmword [rsp + 0xa0], xmm5
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], esi
mov word [rsp + 0xe0], si
call sub.fwpkclnt.sys_FwpmSubLayerAdd0
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea rcx, [rsp + 0x50]
mov r8, rdi
xor edx, edx
call fcn.00018340
lea rax, [0x00018c60]
lea rcx, [0x00018990]
movdqu xmm5, xmmword [0x0001ac90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], esi
movdqu xmmword [rsp + 0x50], xmm5
mov qword [rsp + 0x38], rsi
mov edi, 0xc738
call fcn.00016304
cmp al, sil
jne 0x164c8
lea rcx, [0x00018a00]
call fcn.00016304
cmp al, sil
jne 0x164c8
lea rcx, [0x00018a80]
call fcn.00016304
cmp al, sil
jne 0x164c8
lea rcx, [0x00018af0]
call fcn.00016304
cmp al, sil
jne 0x164c8
lea rcx, [0x00018b60]
call fcn.00016304
cmp al, sil
jne 0x164c8
lea rcx, [0x00018bd0]
call fcn.00016304
cmp al, sil
je 0x164cd
mov edi, 0x33
mov rcx, qword [0x0001ad38]
lea r8, [rsp + 0x38]
xor edx, edx
movzx ebx, di
call sub.fwpkclnt.sys_FwpmSubLayerCreateEnumHandle0
mov ebp, 1
cmp eax, esi
jne 0x16568
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x16534
cmp dword [rsp + 0x30], ebp
jb 0x16551
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
movzx eax, di
movzx edx, word [rcx + 0x40]
sub eax, 0x32
cmp edx, eax
jle 0x16520
cmp dx, di
ja 0x16520
cmp dx, bx
cmovb bx, dx
lea rcx, [rsp + 0x40]
call sub.fwpkclnt.sys_FwpmFreeMemory0
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x0001ad38]
lea r9, [rsp + 0x40]
mov r8d, ebp
call sub.fwpkclnt.sys_FwpmSubLayerEnum0
cmp eax, esi
je 0x164f8
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x0001ad38]
call sub.fwpkclnt.sys_FwpmSubLayerDestroyEnumHandle0
sub bx, bp
mov di, bx
mov rcx, qword [0x0001ad38]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov word [rsp + 0x90], di
call sub.fwpkclnt.sys_FwpmSubLayerAdd0
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019330]
lea rcx, [0x0001ab60]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019340]
lea rcx, [0x0001ab70]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x000192f0]
lea rcx, [0x0001ab80]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x000192f0]
lea rcx, [0x0001ab90]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x00019300]
lea rcx, [0x0001aba0]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019300]
lea rcx, [0x0001abb0]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
xor edx, edx
lea rcx, [rsp + 0x120]
lea r8d, [rdx + 0x58]
call fcn.00018340
mov rcx, qword [0x0001ad38]
lea r11, [0x000188c0]
movaps xmm0, xmmword [0x0001abc0]
movdqu xmmword [rsp + 0x120], xmm0
movdqu xmm0, xmmword [0x00019330]
mov qword [rsp + 0x48], r11
lea rdi, [0x00018900]
lea rdx, [rsp + 0x120]
movdqu xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x40], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x140], esi
movdqu xmm1, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x130], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
cmp eax, esi
mov ebx, eax
jl 0x167bc
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0xc8
call fcn.00018340
xor edx, edx
lea rax, [rsp + 0xf0]
movaps xmm0, xmmword [0x0001abc0]
movdqu xmm5, xmmword [0x00019330]
lea rcx, [rsp + 0xf0]
lea r8d, [rdx + 0x28]
mov qword [rsp + 0x190], rdi
movdqu xmmword [rsp + 0x204], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movdqu xmmword [rsp + 0x1c0], xmm5
mov qword [rsp + 0x198], rdi
mov dword [rsp + 0x200], 0x5003
mov qword [rsp + 0x1f8], rax
movdqu xmmword [rsp + 0x1d0], xmm0
mov dword [rsp + 0x1e0], esi
mov dword [rsp + 0x1f0], ebp
call fcn.00018340
movdqu xmm5, xmmword [0x00019390]
mov rcx, qword [0x0001ad38]
lea rdx, [rsp + 0x180]
xor r9d, r9d
movdqu xmmword [rsp + 0xf0], xmm5
xor r8d, r8d
mov dword [rsp + 0x100], esi
mov dword [rsp + 0x108], ebp
mov byte [rsp + 0x110], 0x11
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ebx, eax
cmp ebx, esi
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x00019340]
lea rcx, [0x0001abd0]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x00019310]
lea rcx, [0x0001abe0]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x00019320]
lea rcx, [0x0001abf0]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x000192d0]
lea rcx, [0x0001ac00]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0xa0]
lea rdx, [0x000192e0]
lea rcx, [0x0001ac10]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x000192b0]
lea rcx, [0x0001ac20]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x000192c0]
lea rcx, [0x0001ac30]
call fcn.000161b8
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019370]
lea rcx, [0x0001ac40]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019380]
lea rcx, [0x0001ac50]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019350]
lea rcx, [0x0001ac60]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
lea r8, [rsp + 0x50]
lea rdx, [0x00019360]
lea rcx, [0x0001ac70]
call fcn.00016030
cmp eax, esi
mov ebx, eax
jl 0x1694b
mov rcx, qword [0x0001ad38]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
cmp eax, esi
mov ebx, eax
jge 0x16957
mov rcx, qword [0x0001ad38]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.00018060
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret