Function at 0x140001680
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x54], ebx
mov r8d, 0xc8
mov dword [rsp + 0x5c], ebx
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x38]
mov qword [rbp + 0x80], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0xffffffff
xor ecx, ecx
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp + 0x88], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x14000173d
mov edx, eax
lea rcx, str.____FwpmEngineOpen0_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x1400019b2
lea rax, [rbp + 0xa0]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140001786
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____MultiByteToWideChar_failed_with_error_code:_0x_x._n
call fcn.140001010
mov word [rbp + 0xa0], bx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xa0]
call fcn.140002160
test eax, eax
je 0x140001834
sub eax, 1
je 0x14000181c
sub eax, 1
je 0x140001804
sub eax, 1
je 0x1400017ec
sub eax, 1
je 0x1400017d4
cmp eax, 1
jne 0x1400019b2
lea rdx, [rbp + 0xa0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Failed_to_convert_drive_name_to_DOS_device_name._n
call fcn.140001010
jmp 0x1400019b2
lea rdx, [rbp + 0xa0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_drive_name_cannot_be_found._n
call fcn.140001010
jmp 0x1400019b2
lea rdx, [rbp + 0xa0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Please_check_your_input._n
call fcn.140001010
jmp 0x1400019b2
lea rdx, [rbp + 0xa0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._Error_occurred_in_allocating_memory_for_appId._n
call fcn.140001010
jmp 0x1400019b2
lea rdx, [rbp + 0xa0]
lea rcx, str.____CustomFwpmGetAppIdFromFileName0_failed_to_convert_the___S__to_app_ID_format._The_file_path_cannot_be_found._n
call fcn.140001010
jmp 0x1400019b2
movups xmm0, xmmword [0x140005900]
lea rax, str.Custom_Outbound_Filter
mov dword [rsp + 0x50], ebx
movups xmm1, xmmword [0x140005720]
mov rbx, qword [rsp + 0x30]
lea rdx, [rbp + 0x88]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov dword [rbp - 0x30], 1
movaps xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x30], 0x1001
movups xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], rbx
mov dword [rbp + 0x20], 1
call fcn.140002340
test eax, eax
jne 0x1400018ee
mov rcx, qword [rsp + 0x38]
lea rax, str.Microsoft_Corporation
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x70]
lea rax, str.Microsoft_Windows_WFP_Built_in_custom_provider.
mov dword [rbp - 0x70], 1
xor r8d, r8d
mov qword [rbp - 0x78], rax
call qword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
test eax, eax
je 0x1400018de
mov edx, eax
lea rcx, str.____FwpmProviderAdd0_failed_with_error_code:_0x_x._n
call fcn.140001010
jmp 0x1400018f9
lea rdx, [rbp + 0x88]
call fcn.140002340
test eax, eax
je 0x1400018f9
lea rax, [rbp + 0x88]
mov qword [rbp - 0x28], rax
mov rcx, qword [rsp + 0x38]
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, [rbp - 0x50]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x14000192e
mov r8, qword [rbp + 0x80]
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv4_layer_._n
mov rdx, rdi
call fcn.140001010
jmp 0x14000193c
mov edx, eax
lea rcx, str.____Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.140001010
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [rsp + 0x38]
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x14000197c
mov r8, qword [rbp + 0x80]
lea rcx, str.Added_WFP_filter_for___s___Filter_id:__d__IPv6_layer_._n
mov rdx, rdi
call fcn.140001010
jmp 0x14000198a
mov edx, eax
lea rcx, str.____Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call fcn.140001010
test rbx, rbx
je 0x1400019a7
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000199e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400024e0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret