Function at 0x4015b0
Capabilities:
Register network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 0x22c], 0
push 0
push eax
mov edi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x248], 0
xorps xmm0, xmm0
lea eax, [ebp - 0x308]
movups xmmword [ebp - 0x244], xmm0
push 0x98
push 0
push eax
movq qword [ebp - 0x234], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x30c], 0
movups xmmword [ebp - 0x270], xmm0
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
movups xmmword [ebp - 0x260], xmm0
movq qword [ebp - 0x250], xmm0
movq qword [ebp - 0x224], xmm0
movlpd qword [ebp - 0x218], xmm0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x401697
push eax
push str.____FwpmEngineOpen0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4016d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____MultiByteToWideChar_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
xor eax, eax
mov word [ebp - 0x210], ax
lea edx, [ebp - 0x30c]
lea ecx, [ebp - 0x210]
call fcn.00402440
test eax, eax
je 0x4017b2
dec eax
cmp eax, 4
ja case.default.0x4016f7
jmp dword [eax*4 + 0x401984]
lea eax, [ebp - 0x210]
push eax
push str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
push eax
push str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call fcn.00401010
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004026a0
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [0x4054c8]
mov esi, dword [ebp - 0x30c]
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x228]
mov dword [ebp - 0x2f8], str.Custom_Outbound_Filter
movups xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x2f0], 1
movups xmm0, xmmword [0x4053cc]
mov dword [ebp - 0x2b0], 0x1001
mov dword [ebp - 0x238], 0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x234], 0xc
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 0x2b8], 1
call fcn.00402540
test eax, eax
je 0x40183f
lea eax, [ebp - 0x228]
mov dword [ebp - 0x2ec], eax
jmp 0x4018a6
push 0
lea eax, [ebp - 0x270]
mov dword [ebp - 0x260], str.Microsoft_Corporation
push eax
push dword [ebp - 0x22c]
mov dword [ebp - 0x25c], str.Microsoft_Windows_WFP_Built_in_custom_provider.
mov dword [ebp - 0x258], 1
call dword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
test eax, eax
je 0x401886
push eax
push str.____FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
jmp 0x4018a6
lea edx, [ebp - 0x228]
call fcn.00402540
test eax, eax
lea ecx, [ebp - 0x228]
cmove ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2ec], ecx
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x4018e2
push dword [ebp - 0x214]
push dword [ebp - 0x218]
push edi
push str.Added_WFP_filter_for___s___Filter_id:__d__IPv4_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x4018f0
push eax
push str.____Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
movups xmm0, xmmword [str._9rJ]
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x22c]
movups xmmword [ebp - 0x2e0], xmm0
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x40193a
push dword [ebp - 0x214]
push dword [ebp - 0x218]
push edi
push str.Added_WFP_filter_for___s___Filter_id:__d__IPv6_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x401948
push eax
push str.____Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
test esi, esi
je 0x401965
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x40195f
push eax
call edi
add esp, 4
push esi
call edi
add esp, 4
push dword [ebp - 0x22c]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004026a0
mov esp, ebp
pop ebp
ret