Function at 0x140002720
Capabilities:
Register network filter via wfp api

Disassembly:
mov r11, rsp
push rbp
push rbx
push r15
lea rbp, [r11 - 0x1b8]
sub rsp, 0x2a0
mov rax, qword [0x1400c7008]
xor rax, rsp
mov qword [rbp + 0x180], rax
xorps xmm0, xmm0
mov qword [r11 + 8], rsi
mov qword [r11 + 0x20], rdi
lea rcx, [rbp - 0x40]
mov qword [r11 - 0x28], r14
mov esi, edx
mov r14, r8
xor eax, eax
xor r15d, r15d
mov qword [rbp + 0xd0], rax
mov r8d, 0xc8
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x38], r15
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [rbp + 0xb0], 1
lea rax, [0x1400c99d8]
mov qword [0x1400c99d8], r15
lea r9, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r15 + 0xa]
xor ecx, ecx
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test eax, eax
je 0x14000280a
mov edi, eax
lea rdx, str.FwpEngineOpen:_open_fwp_session_failed
jmp 0x140002bdf
lea rdx, str.Block_DNS:_WFP_engine_opened
mov qword [rsp + 0x298], r12
xor ecx, ecx
call fcn.140085e20
mov rcx, qword [0x1400c99d8]
lea r8, [rsp + 0x48]
lea rdx, str._rf_7j
call qword [sym.imp.fwpuclnt.dll_FwpmSubLayerGetByKey0]
lea r12, [0x1400958a0]
test eax, eax
jne 0x140002862
lea rdx, str.Block_DNS:_Using_existing_sublayer
xor ecx, ecx
call fcn.140085e20
lea rcx, [rsp + 0x48]
call qword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
jmp 0x140002945
movups xmm0, xmmword [str._rf_7j]
mov qword [rsp + 0x40], r15
xor eax, eax
xorps xmm1, xmm1
mov qword [rbp + 0x120], rax
xor r8d, r8d
movaps xmmword [rsp + 0x60], xmm0
xorps xmm0, xmm0
mov qword [rbp - 0x50], rax
lea rax, [rsp + 0x40]
xor ecx, ecx
lea r9, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0xa]
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
call qword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test eax, eax
jne 0x14000290d
movaps xmm0, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov eax, 0x100
xor r8d, r8d
movaps xmmword [rsp + 0x70], xmm0
mov word [rbp - 0x50], ax
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov dword [rbp - 0x70], r15d
call qword [sym.imp.fwpuclnt.dll_FwpmSubLayerAdd0]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
mov edi, ebx
test rcx, rcx
je 0x14000291f
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
cmp ebx, 0x80320009
je 0x140002937
test ebx, ebx
je 0x140002937
lea rdx, str.add_sublayer:_failed_to_add_persistent_sublayer
jmp 0x140002bd7
lea rdx, str.Block_DNS:_Added_a_persistent_sublayer_with_pre_defined_UUID
xor ecx, ecx
call fcn.140085e20
lea rdx, [rsp + 0x50]
mov ecx, esi
call qword [sym.imp.IPHLPAPI.DLL_ConvertInterfaceIndexToLuid]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002966
lea rdx, str.Convert_interface_index_to_luid_failed
jmp 0x140002bd7
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.fwpuclnt.dll_FwpmGetAppIdFromFileName0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002988
lea rdx, str.Get_byte_blob_for_openvpn_executable_name_failed
jmp 0x140002bd7
movups xmm0, xmmword [str._rf_7j]
mov rcx, qword [0x1400c99d8]
lea rax, [rbp + 0x130]
mov qword [rbp + 0x38], rax
lea r9, [rsp + 0x30]
movaps xmmword [rbp + 0x10], xmm0
lea rdx, [rbp - 0x40]
movups xmm0, xmmword [0x140095c10]
mov eax, getservbyname
mov qword [rbp - 0x30], r12
mov word [rbp + 0x150], ax
xor r8d, r8d
mov rax, qword [rsp + 0x38]
movaps xmmword [rbp], xmm0
movups xmm0, xmmword [0x140095c40]
mov dword [rbp + 0x20], 1
mov byte [rbp + 0x28], reloc.WS2_32.dll_ntohs
movaps xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [0x140095c00]
mov dword [rbp + 0x30], 2
mov dword [rbp + 0x40], 0x1002
movups xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0x140], r15d
mov dword [rbp + 0x148], 2
mov dword [rbp + 0x168], r15d
mov dword [rbp + 0x170], reloc.WS2_32.dll_inet_ntoa
mov qword [rbp + 0x178], rax
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002a49
lea rdx, str.Add_filter_to_permit_IPv4_port_53_traffic_from_OpenVPN_failed
jmp 0x140002bd7
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400c99d8]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp - 0x40]
movaps xmmword [rbp], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002a81
lea rdx, str.Add_filter_to_permit_IPv6_port_53_traffic_from_OpenVPN_failed
jmp 0x140002bd7
lea rdx, str.Block_DNS:_Added_permit_filters_for_exe_path
xor ecx, ecx
call fcn.140085e20
movups xmm0, xmmword [0x140095c10]
mov rcx, qword [0x1400c99d8]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rbp + 0x40], 0x1001
lea rdx, [rbp - 0x40]
movaps xmmword [rbp], xmm0
mov dword [rbp + 0x20], r15d
mov dword [rbp + 0x30], 1
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002ad9
lea rdx, str.Add_filter_to_block_IPv4_DNS_traffic_failed
jmp 0x140002bd7
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400c99d8]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp - 0x40]
movaps xmmword [rbp], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002b11
lea rdx, str.Add_filter_to_block_IPv6_DNS_traffic_failed
jmp 0x140002bd7
lea rdx, str.Block_DNS:_Added_block_filters_for_all_interfaces
xor ecx, ecx
call fcn.140085e20
movups xmm0, xmmword [0x140095c10]
mov rcx, qword [0x1400c99d8]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
mov dword [rbp + 0x20], 1
movaps xmmword [rbp], xmm0
lea rdx, [rbp - 0x40]
movups xmm0, xmmword [0x140095c30]
xor r8d, r8d
mov byte [rbp + 0x28], reloc.WS2_32.dll_ntohl
mov dword [rbp + 0x40], 0x1002
movups xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0x30], 2
mov dword [rbp + 0x168], r15d
mov dword [rbp + 0x170], 4
mov qword [rbp + 0x178], rax
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002b98
lea rdx, str.Add_filter_to_permit_IPv4_DNS_traffic_through_TAP_failed
jmp 0x140002bd7
movups xmm0, xmmword [str._9rJ]
mov rcx, qword [0x1400c99d8]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp - 0x40]
movaps xmmword [rbp], xmm0
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov ebx, eax
mov edi, eax
test eax, eax
je 0x140002bcd
lea rdx, str.Add_filter_to_permit_IPv6_DNS_traffic_through_TAP_failed
jmp 0x140002bd7
mov edi, r15d
lea rdx, str.Block_DNS:_Added_permit_filters_for_TAP_interface
mov r12, qword [rsp + 0x298]
mov ecx, edi
call fcn.140085e20
mov r14, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2c0]
cmp qword [rsp + 0x38], r15
je 0x140002c10
lea rcx, [rsp + 0x38]
call qword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
test ebx, ebx
je 0x140002c2d
mov rcx, qword [0x1400c99d8]
test rcx, rcx
je 0x140002c2d
call qword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov qword [0x1400c99d8], r15
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140088150
add rsp, 0x2a0
pop r15
pop rbx
pop rbp
ret