Function at 0x42de00
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4703d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x471bf0], 0
push ebx
mov ebx, 1
jne 0x42e0f8
cmp dword [0x471bec], 0
jne 0x42de47
push str.fwpuclnt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x471bec], eax
je 0x42e0f8
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0043c140
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x42de89
jne 0x42de8f
cmp dword [ebp - 0x110], ebx
jb 0x42de8f
mov byte [0x471be8], bl
mov edx, dword [0x471bec]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FwpmEngineOpen0
push edx
call esi
test eax, eax
mov dword [0x471b8c], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmEngineClose0
push eax
call esi
test eax, eax
mov dword [0x471b90], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmTransactionAbort0
push ecx
call esi
test eax, eax
mov dword [0x471b94], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmTransactionBegin0
push edx
call esi
test eax, eax
mov dword [0x471b98], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmTransactionCommit0
push eax
call esi
test eax, eax
mov dword [0x471b9c], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmSubLayerAdd0
push ecx
call esi
test eax, eax
mov dword [0x471ba0], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmSubLayerDeleteByKey0
push edx
call esi
test eax, eax
mov dword [0x471ba4], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmSubLayerGetByKey0
push eax
call esi
test eax, eax
mov dword [0x471ba8], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmFreeMemory0
push ecx
call esi
test eax, eax
mov dword [0x471bac], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmFilterAdd0
push edx
call esi
test eax, eax
mov dword [0x471bb0], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmFilterDeleteByKey0
push eax
call esi
test eax, eax
mov dword [0x471bb8], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmFilterDeleteById0
push ecx
call esi
test eax, eax
mov dword [0x471bb4], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmFilterGetByKey0
push edx
call esi
test eax, eax
mov dword [0x471bbc], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmGetAppIdFromFileName0
push eax
call esi
test eax, eax
mov dword [0x471bc0], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmCalloutAdd0
push ecx
call esi
test eax, eax
mov dword [0x471bc4], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmCalloutDeleteByKey0
push edx
call esi
test eax, eax
mov dword [0x471bc8], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmCalloutGetByKey0
push eax
call esi
test eax, eax
mov dword [0x471bcc], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmProviderAdd0
push ecx
call esi
test eax, eax
mov dword [0x471bd0], eax
je 0x42e0f7
mov edx, dword [0x471bec]
push str.FwpmProviderGetByKey0
push edx
call esi
test eax, eax
mov dword [0x471bd8], eax
je 0x42e0f7
mov eax, dword [0x471bec]
push str.FwpmProviderDeleteByKey0
push eax
call esi
test eax, eax
mov dword [0x471bd4], eax
je 0x42e0f7
mov ecx, dword [0x471bec]
push str.FwpmFilterCreateEnumHandle0
push ecx
call esi
mov edx, dword [0x471bec]
push str.FwpmFilterDestroyEnumHandle0
push edx
mov dword [0x471bdc], eax
call esi
mov dword [0x471be0], eax
mov eax, dword [0x471bec]
push str.FwpmFilterEnum0
push eax
call esi
cmp dword [0x471bdc], 0
mov dword [0x471be4], eax
je 0x42e0f7
cmp dword [0x471be0], 0
je 0x42e0f7
test eax, eax
je 0x42e0f7
mov byte [0x471be9], bl
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x471be9]
mov byte [0x471bf0], bl
xor ecx, ebp
pop ebx
call fcn.0043c015
mov esp, ebp
pop ebp
ret