Function at 0x140001a30
Capabilities:
Register network filter via wfp api

Disassembly:
sub rsp, 0x3c8
mov qword [rsp + 0x3c0], rcx
mov dword [rsp + 0x3bc], 0
mov qword [rsp + 0x3b0], 0
lea rcx, [rsp + 0x1a0]
xor edx, edx
mov r8d, 0x208
call sym.memset
mov dword [rsp + 0x19c], 0x104
lea rcx, [rsp + 0x170]
xor edx, edx
mov r8d, 0x28
call sym.memset
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, 0xc8
call sym.memset
lea rcx, [rsp + 0x68]
xor edx, edx
mov r8d, 0x40
call sym.memset
lea rcx, [rsp + 0x58]
xor edx, edx
mov r8d, 0x10
call sym.memset
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
xor eax, eax
mov r9d, eax
mov edx, 0xffffffff
lea rax, [rsp + 0x3b0]
mov rcx, r9
mov r8, r9
mov qword [rsp + 0x20], rax
call sym.FwpmEngineOpen0
mov dword [rsp + 0x3bc], eax
cmp dword [rsp + 0x3bc], 0
je 0x140001b29
mov edx, dword [rsp + 0x3bc]
lea rcx, [0x14000c4c4]
call dbg.__mingw_printf
jmp 0x140001e68
mov rcx, qword [rsp + 0x3c0]
lea rdx, [rsp + 0x1a0]
mov r8d, 0x104
call sym.CharArrayToWCharArray
lea rcx, [rsp + 0x1a0]
lea rdx, [rsp + 0x50]
call sym.CustomFwpmGetAppIdFromFileName0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140001c05
mov eax, dword [rsp + 0x44]
dec eax
mov ecx, eax
mov qword [rsp + 0x30], rcx
sub eax, 4
ja 0x140001bfe
mov rax, qword [rsp + 0x30]
lea rcx, [0x14000c0a4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rdx, [rsp + 0x1a0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call dbg.__mingw_printf
jmp 0x140001c00
lea rdx, [rsp + 0x1a0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call dbg.__mingw_printf
jmp 0x140001c00
lea rdx, [rsp + 0x1a0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call dbg.__mingw_printf
jmp 0x140001c00
lea rdx, [rsp + 0x1a0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call dbg.__mingw_printf
jmp 0x140001c00
lea rdx, [rsp + 0x1a0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call dbg.__mingw_printf
jmp 0x140001c00
jmp 0x140001c00
jmp 0x140001e68
mov rax, qword [str.Custom_Outbound_Filter]
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc8], 1
mov rax, qword [0x14000d274]
mov qword [rsp + 0xe8], rax
mov rax, qword [0x14000d27c]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x128], 0x1001
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x108], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x110], rax
mov rax, qword [0x14000d264]
mov qword [rsp + 0x170], rax
mov rax, qword [0x14000d26c]
mov qword [rsp + 0x178], rax
mov dword [rsp + 0x180], 0
mov dword [rsp + 0x188], 0xc
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x118], 1
mov rcx, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
lea rdx, [rsp + 0x58]
call sym.GetProviderGUIDByDescription
cmp eax, 0
je 0x140001ced
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
jmp 0x140001d77
mov rax, qword [str.Microsoft_Corporation]
mov qword [rsp + 0x78], rax
mov rax, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 1
mov rcx, qword [rsp + 0x3b0]
lea rdx, [rsp + 0x68]
xor eax, eax
mov r8d, eax
call sym.FwpmProviderAdd0
mov dword [rsp + 0x3bc], eax
cmp dword [rsp + 0x3bc], 0
je 0x140001d50
mov edx, dword [rsp + 0x3bc]
lea rcx, str.____FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call dbg.__mingw_printf
jmp 0x140001d75
mov rcx, qword [str.Microsoft_Windows_WFP_Built_in_custom_provider.]
lea rdx, [rsp + 0x58]
call sym.GetProviderGUIDByDescription
cmp eax, 0
je 0x140001d73
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
jmp 0x140001d75
jmp 0x140001d77
mov rcx, qword [rsp + 0x3b0]
lea rdx, [rsp + 0xa8]
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x48]
call sym.FwpmFilterAdd0
mov dword [rsp + 0x3bc], eax
cmp dword [rsp + 0x3bc], 0
jne 0x140001dc2
mov rdx, qword [rsp + 0x3c0]
mov r8, qword [rsp + 0x48]
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv4_layer_._n
call dbg.__mingw_printf
jmp 0x140001dd5
mov edx, dword [rsp + 0x3bc]
lea rcx, str.____Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call dbg.__mingw_printf
mov rax, qword [str._9rJ]
mov qword [rsp + 0xe8], rax
mov rax, qword [0x14000d28c]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0x3b0]
lea rdx, [rsp + 0xa8]
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x48]
call sym.FwpmFilterAdd0
mov dword [rsp + 0x3bc], eax
cmp dword [rsp + 0x3bc], 0
jne 0x140001e3e
mov rdx, qword [rsp + 0x3c0]
mov r8, qword [rsp + 0x48]
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv6_layer_._n
call dbg.__mingw_printf
jmp 0x140001e51
mov edx, dword [rsp + 0x3bc]
lea rcx, str.____Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call dbg.__mingw_printf
mov rcx, qword [rsp + 0x50]
call sym.FreeAppId
mov rcx, qword [rsp + 0x3b0]
call sym.FwpmEngineClose0
nop
add rsp, 0x3c8
ret