Function at 0x424bd0
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x456ae8], 0
push ebx
mov ebx, 1
jne 0x424ec8
cmp dword [0x456ae4], 0
jne 0x424c17
push str.fwpuclnt.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x456ae4], eax
je 0x424ec8
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0042d860
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x424c59
jne 0x424c5f
cmp dword [ebp - 0x110], ebx
jb 0x424c5f
mov byte [0x456ae0], bl
mov edx, dword [0x456ae4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FwpmEngineOpen0
push edx
call esi
test eax, eax
mov dword [0x456a84], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmEngineClose0
push eax
call esi
test eax, eax
mov dword [0x456a88], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmTransactionAbort0
push ecx
call esi
test eax, eax
mov dword [0x456a8c], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmTransactionBegin0
push edx
call esi
test eax, eax
mov dword [0x456a90], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmTransactionCommit0
push eax
call esi
test eax, eax
mov dword [0x456a94], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmSubLayerAdd0
push ecx
call esi
test eax, eax
mov dword [0x456a98], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmSubLayerDeleteByKey0
push edx
call esi
test eax, eax
mov dword [0x456a9c], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmSubLayerGetByKey0
push eax
call esi
test eax, eax
mov dword [0x456aa0], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmFreeMemory0
push ecx
call esi
test eax, eax
mov dword [0x456aa4], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmFilterAdd0
push edx
call esi
test eax, eax
mov dword [0x456aa8], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmFilterDeleteByKey0
push eax
call esi
test eax, eax
mov dword [0x456ab0], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmFilterDeleteById0
push ecx
call esi
test eax, eax
mov dword [0x456aac], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmFilterGetByKey0
push edx
call esi
test eax, eax
mov dword [0x456ab4], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmGetAppIdFromFileName0
push eax
call esi
test eax, eax
mov dword [0x456ab8], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmCalloutAdd0
push ecx
call esi
test eax, eax
mov dword [0x456abc], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmCalloutDeleteByKey0
push edx
call esi
test eax, eax
mov dword [0x456ac0], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmCalloutGetByKey0
push eax
call esi
test eax, eax
mov dword [0x456ac4], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmProviderAdd0
push ecx
call esi
test eax, eax
mov dword [0x456ac8], eax
je 0x424ec7
mov edx, dword [0x456ae4]
push str.FwpmProviderGetByKey0
push edx
call esi
test eax, eax
mov dword [0x456ad0], eax
je 0x424ec7
mov eax, dword [0x456ae4]
push str.FwpmProviderDeleteByKey0
push eax
call esi
test eax, eax
mov dword [0x456acc], eax
je 0x424ec7
mov ecx, dword [0x456ae4]
push str.FwpmFilterCreateEnumHandle0
push ecx
call esi
mov edx, dword [0x456ae4]
push str.FwpmFilterDestroyEnumHandle0
push edx
mov dword [0x456ad4], eax
call esi
mov dword [0x456ad8], eax
mov eax, dword [0x456ae4]
push str.FwpmFilterEnum0
push eax
call esi
cmp dword [0x456ad4], 0
mov dword [0x456adc], eax
je 0x424ec7
cmp dword [0x456ad8], 0
je 0x424ec7
test eax, eax
je 0x424ec7
mov byte [0x456ae1], bl
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x456ae1]
mov byte [0x456ae8], bl
xor ecx, ebp
pop ebx
call fcn.0042d845
mov esp, ebp
pop ebp
ret