Function at 0x100049900
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rdi, rcx
lea r14, [0x100152eb8]
mov r13d, 1
lea r15, [0x10001e5a0]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x10004995b
test byte [rcx + 0x1c], r13b
je 0x10004995b
mov edx, 0x130
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034764
mov rcx, qword [0x100152eb8]
xor ebp, ebp
cmp dword [rdi + 0x1f0], ebp
jne 0x100049e0a
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0xb8], ebp
movdqu xmm0, xmmword [0x10002e8d0]
movdqu xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0x1c]
lea rcx, [rsp + 0x50]
call sub.MFPlat.DLL_MFTEnumEx
mov ebx, eax
lea eax, [rbp + 5]
lea r12d, [rbp + 2]
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x1000499f9
test byte [rcx + 0x1c], r12b
je 0x1000499f9
movzx r8d, byte [rcx + 0x19]
mov edx, r12d
cmp ebx, ebp
cmovge edx, eax
cmp r8d, edx
jl 0x1000499f9
mov edx, 0x131
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.10003b338
mov sil, 4
cmp ebx, ebp
jl 0x100049a3e
mov r9d, ebp
cmp dword [rsp + 0xb8], ebp
seta r9b
mov dword [rdi + 0x1fc], r9d
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x100049a3e
test byte [rcx + 0x1c], r12b
je 0x100049a3e
cmp byte [rcx + 0x19], sil
jb 0x100049a3e
mov edx, 0x132
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov rcx, qword [rsp + 0x38]
cmp rcx, rbp
je 0x100049a84
mov esi, ebp
cmp dword [rsp + 0xb8], ebp
jbe 0x100049a7b
mov rbx, rbp
cmp qword [rbx + rcx], rbp
je 0x100049a6b
mov rcx, qword [rbx + rcx]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
add esi, r13d
add rbx, 8
cmp esi, dword [rsp + 0xb8]
jb 0x100049a56
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov sil, 4
mov dword [rdi + 0x1f4], ebp
mov dword [rdi + 0x1f8], ebp
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x100020300]
mov r8d, r13d
xor edx, edx
lea rcx, [0x1000202f0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x100049b08
test byte [r10 + 0x1c], r12b
je 0x100049b08
movzx r8d, byte [r10 + 0x19]
mov edx, r12d
cmp eax, ebp
mov eax, 5
cmovge edx, eax
cmp r8d, edx
jl 0x100049b08
mov edx, 0x133
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003bdc0
mov r10, qword [0x100152eb8]
cmp ebx, ebp
jl 0x100049cb1
mov word [rsp + 0xb0], bp
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
call qword [rax + 0x60]
mov ebx, eax
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x100049b7c
test byte [r10 + 0x1c], r12b
je 0x100049b7c
movzx edx, byte [r10 + 0x19]
mov ecx, r12d
cmp eax, ebp
mov eax, 5
cmovge ecx, eax
cmp edx, ecx
jl 0x100049b7c
movsx eax, word [rsp + 0xb0]
mov edx, 0x134
mov dword [rsp + 0x20], eax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003b338
mov r10, qword [0x100152eb8]
cmp ebx, ebp
jl 0x100049cb1
or eax, 0xffffffff
cmp ax, word [rsp + 0xb0]
jne 0x100049cb1
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [0x1000202e0]
mov r8d, r13d
xor edx, edx
lea rcx, [0x1000202d0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x100049c15
test byte [r10 + 0x1c], r12b
je 0x100049c15
movzx edx, byte [r10 + 0x19]
mov ecx, r12d
cmp eax, ebp
mov eax, 5
cmovge ecx, eax
cmp edx, ecx
jl 0x100049c15
mov edx, 0x135
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.10003bdc0
mov r10, qword [0x100152eb8]
cmp ebx, ebp
jl 0x100049c97
mov dword [rsp + 0xb0], ebp
lea r8, [rsp + 0xb0]
lea rdx, [0x10001ef00]
mov rcx, qword [rsp + 0xc8]
call fcn.100042b78
cmp eax, ebp
jl 0x100049c50
cmp dword [rsp + 0xb0], ebp
je 0x100049c50
mov dword [rdi + 0x1f4], r13d
mov dword [rsp + 0xb0], ebp
lea r8, [rsp + 0xb0]
lea rdx, [0x10001fc38]
mov rcx, qword [rsp + 0xc8]
call fcn.100042b78
cmp eax, ebp
jl 0x100049c90
cmp dword [rsp + 0xb0], ebp
je 0x100049c90
mov dword [rdi + 0x1f8], r13d
mov r10, qword [0x100152eb8]
jmp 0x100049c97
mov r10, qword [0x100152eb8]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rbp
je 0x100049cb1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x100049d0a
test byte [r10 + 0x1c], r12b
je 0x100049ce1
cmp byte [r10 + 0x19], sil
jb 0x100049ce1
mov edx, 0x136
mov r9d, dword [rdi + 0x1f4]
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036328
mov r10, qword [0x100152eb8]
cmp r10, r14
je 0x100049d0a
test byte [r10 + 0x1c], r12b
je 0x100049d0a
cmp byte [r10 + 0x19], sil
jb 0x100049d0a
mov edx, 0x137
mov r9d, dword [rdi + 0x1f8]
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.100036328
call fcn.100042360
mov dword [rdi + 0x200], eax
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x100049d41
test byte [rcx + 0x1c], r12b
je 0x100049d41
cmp byte [rcx + 0x19], sil
jb 0x100049d41
mov edx, 0x138
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov qword [rsp + 0x40], rbp
mov dword [rdi + 0x204], ebp
mov dword [rsp + 0xc0], ebp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x1000203c0]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x100020390]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebp
jl 0x100049da2
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0xc0]
call qword [rax + 0x18]
cmp eax, ebp
jl 0x100049da2
cmp dword [rsp + 0xc0], ebp
je 0x100049da2
mov dword [rdi + 0x204], r13d
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x100049dd2
test byte [rcx + 0x1c], r12b
je 0x100049dd2
cmp byte [rcx + 0x19], sil
jb 0x100049dd2
mov edx, 0x139
mov r9d, dword [rdi + 0x204]
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100036328
mov dword [rdi + 0x1f0], r13d
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
je 0x100049dea
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x100049e03
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x100152eb8]
jmp 0x100049e0a
mov rcx, qword [0x100152eb8]
cmp rcx, r14
je 0x100049e26
test byte [rcx + 0x1c], r13b
je 0x100049e26
mov edx, 0x13a
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.100034764
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret