Function at 0x10004998c
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rdi, rcx
lea r14, [0x100153eb8]
mov r13d, 1
lea r15, [0x10001e5a0]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x1000499e7
test byte [rcx + 0x1c], r13b
je 0x1000499e7
mov edx, 0x130
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034784
mov rcx, qword [0x100153eb8]
xor ebp, ebp
cmp dword [rdi + 0x1f0], ebp
jne 0x100049e96
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0xb8], ebp
movdqu xmm0, xmmword [0x10002e8e0]
movdqu xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0x1c]
lea rcx, [rsp + 0x50]
call sub.MFPlat.DLL_MFTEnumEx
mov ebx, eax
lea eax, [rbp + 5]
lea r12d, [rbp + 2]
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x100049a85
test byte [rcx + 0x1c], r12b
je 0x100049a85
movzx r8d, byte [rcx + 0x19]
mov edx, r12d
cmp ebx, ebp
cmovge edx, eax
cmp r8d, edx
jl 0x100049a85
mov edx, 0x131
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.10003be4c
mov sil, 4
cmp ebx, ebp
jl 0x100049aca
mov r9d, ebp
cmp dword [rsp + 0xb8], ebp
seta r9b
mov dword [rdi + 0x1fc], r9d
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x100049aca
test byte [rcx + 0x1c], r12b
je 0x100049aca
cmp byte [rcx + 0x19], sil
jb 0x100049aca
mov edx, 0x132
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x100049b10
mov esi, ebp
cmp dword [rsp + 0xb8], ebp
jbe 0x100049b07
mov rbx, rbp
cmp qword [rbx + rcx], rbp
je 0x100049af7
mov rcx, qword [rbx + rcx]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
add esi, r13d
add rbx, 8
cmp esi, dword [rsp + 0xb8]
jb 0x100049ae2
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov sil, 4
mov dword [rdi + 0x1f4], ebp
mov dword [rdi + 0x1f8], ebp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x100020300]
mov r8d, r13d
xor edx, edx
lea rcx, [0x1000202f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x100049b94
test byte [r10 + 0x1c], r12b
je 0x100049b94
movzx r8d, byte [r10 + 0x19]
mov edx, r12d
cmp eax, ebp
mov eax, 5
cmovge edx, eax
cmp r8d, edx
jl 0x100049b94
mov edx, 0x133
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003be94
mov r10, qword [0x100153eb8]
cmp ebx, ebp
jl 0x100049d3d
mov word [rsp + 0xb0], bp
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
call qword [rax + 0x60]
mov ebx, eax
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x100049c08
test byte [r10 + 0x1c], r12b
je 0x100049c08
movzx edx, byte [r10 + 0x19]
mov ecx, r12d
cmp eax, ebp
mov eax, 5
cmovge ecx, eax
cmp edx, ecx
jl 0x100049c08
movsx eax, word [rsp + 0xb0]
mov edx, 0x134
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003be4c
mov r10, qword [0x100153eb8]
cmp ebx, ebp
jl 0x100049d3d
or eax, 0xffffffff
cmp ax, word [rsp + 0xb0]
jne 0x100049d3d
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [0x1000202e0]
mov r8d, r13d
xor edx, edx
lea rcx, [0x1000202d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x100049ca1
test byte [r10 + 0x1c], r12b
je 0x100049ca1
movzx edx, byte [r10 + 0x19]
mov ecx, r12d
cmp eax, ebp
mov eax, 5
cmovge ecx, eax
cmp edx, ecx
jl 0x100049ca1
mov edx, 0x135
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003be94
mov r10, qword [0x100153eb8]
cmp ebx, ebp
jl 0x100049d23
mov dword [rsp + 0xb0], ebp
lea r8, [rsp + 0xb0]
lea rdx, [0x10001ef00]
mov rcx, qword [rsp + 0xc8]
call fcn.100042c04
cmp eax, ebp
jl 0x100049cdc
cmp dword [rsp + 0xb0], ebp
je 0x100049cdc
mov dword [rdi + 0x1f4], r13d
mov dword [rsp + 0xb0], ebp
lea r8, [rsp + 0xb0]
lea rdx, [0x10001fc38]
mov rcx, qword [rsp + 0xc8]
call fcn.100042c04
cmp eax, ebp
jl 0x100049d1c
cmp dword [rsp + 0xb0], ebp
je 0x100049d1c
mov dword [rdi + 0x1f8], r13d
mov r10, qword [0x100153eb8]
jmp 0x100049d23
mov r10, qword [0x100153eb8]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbp
je 0x100049d3d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x100049d96
test byte [r10 + 0x1c], r12b
je 0x100049d6d
cmp byte [r10 + 0x19], sil
jb 0x100049d6d
mov edx, 0x136
mov r9d, dword [rdi + 0x1f4]
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036510
mov r10, qword [0x100153eb8]
cmp r10, r14
je 0x100049d96
test byte [r10 + 0x1c], r12b
je 0x100049d96
cmp byte [r10 + 0x19], sil
jb 0x100049d96
mov edx, 0x137
mov r9d, dword [rdi + 0x1f8]
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036510
call fcn.1000423ec
mov dword [rdi + 0x200], eax
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x100049dcd
test byte [rcx + 0x1c], r12b
je 0x100049dcd
cmp byte [rcx + 0x19], sil
jb 0x100049dcd
mov edx, 0x138
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov qword [rsp + 0x40], rbp
mov dword [rdi + 0x204], ebp
mov dword [rsp + 0xc0], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000203c0]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x100020390]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebp
jl 0x100049e2e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0xc0]
call qword [rax + 0x18]
cmp eax, ebp
jl 0x100049e2e
cmp dword [rsp + 0xc0], ebp
je 0x100049e2e
mov dword [rdi + 0x204], r13d
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x100049e5e
test byte [rcx + 0x1c], r12b
je 0x100049e5e
cmp byte [rcx + 0x19], sil
jb 0x100049e5e
mov edx, 0x139
mov r9d, dword [rdi + 0x204]
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036510
mov dword [rdi + 0x1f0], r13d
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
je 0x100049e76
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x100049e8f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x100153eb8]
jmp 0x100049e96
mov rcx, qword [0x100153eb8]
cmp rcx, r14
je 0x100049eb2
test byte [rcx + 0x1c], r13b
je 0x100049eb2
mov edx, 0x13a
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034784
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret