Function at 0x140002930
Capabilities:
Register network filter via wfp api

Disassembly:
mov r11, rsp
push rbp
push rbx
push r15
lea rbp, [r11 - 0x1b8]
sub rsp, 0x2a0
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rbp + 0x180], rax
xorps xmm0, xmm0
mov qword [r11 + 8], rsi
mov qword [r11 + 0x20], rdi
lea rcx, [rbp - 0x50]
mov qword [r11 - 0x28], r14
mov esi, edx
mov r14, r8
xor eax, eax
xor r15d, r15d
mov qword [rbp + 0xd0], rax
mov r8d, 0xc8
mov qword [rsp + 0x50], r15
xor edx, edx
mov qword [rsp + 0x40], r15
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [rbp + 0xb0], 1
lea rax, [0x1400cda18]
mov qword [0x1400cda18], r15
lea r9, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r15 + 0xa]
xor ecx, ecx
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test eax, eax
je 0x140002a1a
mov edi, eax
lea rdx, str.FwpEngineOpen:_open_fwp_session_failed
jmp 0x140002e02
lea rdx, str.Block_DNS:_WFP_engine_opened
mov qword [rsp + 0x298], r12
xor ecx, ecx
call fcn.140087af0
mov rcx, qword [0x1400cda18]
lea r8, [rsp + 0x50]
lea rdx, str._rf_7j
call qword [sym.imp.fwpuclnt.dll_FwpmSubLayerGetByKey0]
lea r12, [0x140097e40]
test eax, eax
jne 0x140002a72
lea rdx, str.Block_DNS:_Using_existing_sublayer
xor ecx, ecx
call fcn.140087af0
lea rcx, [rsp + 0x50]
call qword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
jmp 0x140002b58
movups xmm0, xmmword [str._rf_7j]
mov qword [rsp + 0x48], r15
xor eax, eax
xorps xmm1, xmm1
mov qword [rbp + 0x120], rax
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x48]
xor ecx, ecx
lea r9, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0xa]
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test eax, eax
jne 0x140002b20
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov eax, 0x100
xor r8d, r8d
movaps xmmword [rsp + 0x60], xmm0
mov word [rbp - 0x60], ax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov dword [rbp - 0x80], r15d
call qword [sym.imp.fwpuclnt.dll_FwpmSubLayerAdd0]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
mov edi, ebx
test rcx, rcx
je 0x140002b32
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
cmp ebx, 0x80320009
je 0x140002b4a
test ebx, ebx
je 0x140002b4a
lea rdx, str.add_sublayer:_failed_to_add_persistent_sublayer
jmp 0x140002dfa
lea rdx, str.Block_DNS:_Added_a_persistent_sublayer_with_pre_defined_UUID
xor ecx, ecx
call fcn.140087af0
lea rdx, [rbp + 0x88]
mov ecx, esi
call qword [sym.imp.IPHLPAPI.DLL_ConvertInterfaceIndexToLuid]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002b7b
lea rdx, str.Convert_interface_index_to_luid_failed
jmp 0x140002dfa
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.fwpuclnt.dll_FwpmGetAppIdFromFileName0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002b9d
lea rdx, str.Get_byte_blob_for_openvpn_executable_name_failed
jmp 0x140002dfa
movups xmm0, xmmword [str._rf_7j]
mov rcx, qword [0x1400cda18]
lea rax, [rbp + 0x130]
mov qword [rbp + 0x28], rax
lea r9, [rbp + 0x80]
movaps xmmword [rbp], xmm0
lea rdx, [rbp - 0x50]
movups xmm0, xmmword [0x1400981b0]
mov eax, getservbyname
mov qword [rbp - 0x40], r12
mov word [rbp + 0x150], ax
xor r8d, r8d
mov rax, qword [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [0x1400981e0]
mov dword [rbp + 0x10], 1
mov byte [rbp + 0x18], reloc.WS2_32.dll_ntohs
movaps xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [0x1400981a0]
mov dword [rbp + 0x20], 2
mov dword [rbp + 0x30], 0x1002
movups xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0x140], r15d
mov dword [rbp + 0x148], 2
mov dword [rbp + 0x168], r15d
mov dword [rbp + 0x170], reloc.WS2_32.dll_inet_ntoa
mov qword [rbp + 0x178], rax
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002c60
lea rdx, str.Add_filter_to_permit_IPv4_port_53_traffic_from_OpenVPN_failed
jmp 0x140002dfa
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400cda18]
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002c9a
lea rdx, str.Add_filter_to_permit_IPv6_port_53_traffic_from_OpenVPN_failed
jmp 0x140002dfa
lea rdx, str.Block_DNS:_Added_permit_filters_for_exe_path
xor ecx, ecx
call fcn.140087af0
movups xmm0, xmmword [0x1400981b0]
mov rcx, qword [0x1400cda18]
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dword [rbp + 0x30], 0x1001
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x10], r15d
mov dword [rbp + 0x20], 1
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002cf4
lea rdx, str.Add_filter_to_block_IPv4_DNS_traffic_failed
jmp 0x140002dfa
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400cda18]
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002d2e
lea rdx, str.Add_filter_to_block_IPv6_DNS_traffic_failed
jmp 0x140002dfa
lea rdx, str.Block_DNS:_Added_block_filters_for_all_interfaces
xor ecx, ecx
call fcn.140087af0
movups xmm0, xmmword [0x1400981b0]
mov rcx, qword [0x1400cda18]
lea rax, [rbp + 0x88]
lea r9, [rbp + 0x80]
mov dword [rbp + 0x10], 1
movaps xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x50]
movups xmm0, xmmword [0x1400981d0]
xor r8d, r8d
mov byte [rbp + 0x18], reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x30], 0x1002
movups xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0x20], 2
mov dword [rbp + 0x168], r15d
mov dword [rbp + 0x170], 4
mov qword [rbp + 0x178], rax
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002db9
lea rdx, str.Add_filter_to_permit_IPv4_DNS_traffic_through_TAP_failed
jmp 0x140002dfa
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400cda18]
lea r9, [rbp + 0x80]
xor r8d, r8d
lea rdx, [rbp - 0x50]
movaps xmmword [rbp - 0x10], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002df0
lea rdx, str.Add_filter_to_permit_IPv6_DNS_traffic_through_TAP_failed
jmp 0x140002dfa
mov edi, r15d
lea rdx, str.Block_DNS:_Added_permit_filters_for_TAP_interface
mov r12, qword [rsp + 0x298]
mov ecx, edi
call fcn.140087af0
mov r14, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2c0]
cmp qword [rsp + 0x40], r15
je 0x140002e33
lea rcx, [rsp + 0x40]
call qword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
test ebx, ebx
je 0x140002e50
mov rcx, qword [0x1400cda18]
test rcx, rcx
je 0x140002e50
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov qword [0x1400cda18], r15
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14008aca0
add rsp, 0x2a0
pop r15
pop rbx
pop rbp
ret