Function at 0x140001a60
Capabilities:
Register network filter via wfp api

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3b8
xor eax, eax
pxor xmm0, xmm0
xor r9d, r9d
xor r8d, r8d
lea rbx, [rsp + 0x1a0]
mov rsi, rcx
mov ecx, 0x41
mov qword [rsp + 0x30], 0
mov rdi, rbx
lea rbp, [rsp + 0xd0]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x80], 0
rep stosq qword [rdi], rax
mov ecx, 0x19
mov rdi, rbp
mov qword [rsp + 0x50], 0
rep stosq qword [rdi], rax
mov qword [rsp + 0x20], rdx
mov edx, 0xffffffff
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
call sym.FwpmEngineOpen0
test eax, eax
jne 0x140001cf0
mov rdx, rbx
mov rcx, rsi
mov r8d, 0x104
call sym.CharArrayToWCharArray
lea rdx, [rsp + 0x38]
mov rcx, rbx
call sym.CustomFwpmGetAppIdFromFileName0
test eax, eax
je 0x140001b60
cmp eax, 5
ja case.0x140001b5b.0
lea rbp, [0x14000d910]
mov esi, eax
movsxd r9, dword [rbp + rsi*4]
add r9, rbp
jmp r9
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x48]
movabs rbx, 0x4ea58644d78e1e87
mov r8, qword [str.Custom_Outbound_Filter]
mov qword [rsp + 0x60], rbx
lea rbx, [rsp + 0x50]
movabs r9, 0x4c3305a7c38d57d1
movabs r10, 0x820ee6eebc7f4f90
mov qword [rsp + 0x80], rcx
mov rcx, qword [section..data]
lea rdi, [rsp + 0x60]
mov rdx, rbx
movabs rax, 0x71c9efec09d83794
mov qword [rsp + 0xe0], r8
mov dword [rsp + 0xf0], 1
mov qword [rsp + 0x110], r9
mov qword [rsp + 0x118], r10
mov dword [rsp + 0x150], 0x1001
mov qword [rsp + 0x48], 0xffffffffffffffff
mov dword [rsp + 0x130], 4
mov qword [rsp + 0x138], r11
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0xc
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x140], 1
call sym.GetProviderGUIDByDescription
test eax, eax
je 0x140001de0
mov qword [rsp + 0xf8], rbx
lea rdi, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rbp
mov r9, rdi
call sym.FwpmFilterAdd0
test eax, eax
je 0x140001d10
mov edx, eax
lea rcx, str.____Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call sym.printf
movabs rdx, 0x44bc319f4a72393b
mov rcx, qword [rsp + 0x30]
mov r9, rdi
movabs r8, 0xb4b6b3dc54bac384
mov qword [rsp + 0x110], rdx
mov rdx, rbp
mov qword [rsp + 0x118], r8
xor r8d, r8d
call sym.FwpmFilterAdd0
test eax, eax
jne 0x140001dc0
mov r8, qword [rsp + 0x40]
mov rdx, rsi
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv6_layer_._n
call sym.printf
mov rcx, qword [rsp + 0x38]
call sym.FreeAppId
mov rcx, qword [rsp + 0x30]
call sym.FwpmEngineClose0
nop
add rsp, 0x3b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, eax
lea rcx, section..rdata
call sym.printf
nop
add rsp, 0x3b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8, qword [rsp + 0x40]
mov rdx, rsi
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv4_layer_._n
call sym.printf
jmp 0x140001c6f
mov rdx, rbx
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call sym.printf
jmp case.0x140001b5b.0
mov rdx, rbx
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call sym.printf
jmp case.0x140001b5b.0
mov rdx, rbx
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call sym.printf
jmp case.0x140001b5b.0
mov rdx, rbx
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call sym.printf
jmp case.0x140001b5b.0
mov rdx, rbx
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call sym.printf
jmp case.0x140001b5b.0
mov edx, eax
lea rcx, str.____Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call sym.printf
jmp 0x140001cc2
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
movq xmm1, qword [str.Microsoft_Corporation]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0xb0], 1
movhps xmm1, qword [section..data]
movups xmmword [rsp + 0xa0], xmm1
call sym.FwpmProviderAdd0
test eax, eax
je 0x140001e30
mov edx, eax
lea rcx, str.____FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call sym.printf
jmp 0x140001c41
mov rcx, qword [section..data]
mov rdx, rbx
call sym.GetProviderGUIDByDescription
test eax, eax
jne 0x140001c39
jmp 0x140001c41