Function at 0x401050
Capabilities:
Register network filter via wfp api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x98
lea eax, [ebp - 0x300]
mov dword [ebp - 0x21c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x240], 0
push 0
push eax
mov esi, ecx
movlpd qword [ebp - 0x248], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 0
lea eax, [ebp - 0x210]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x218], xmm0
push str._i__Getting_WFP_engine_handle_n
call fcn.00401010
add esp, 4
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
test eax, eax
je 0x401109
push eax
push str._X__FwpmEngineOpen0_failed_with_code_0x_x._n
call fcn.00401010
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
ret
push str._i__Creating_provider_n
call fcn.00401010
movups xmm0, xmmword [0x403be8]
add esp, 4
mov dword [ebp - 0x254], str.Alex_WFPMDE
lea eax, [ebp - 0x264]
mov dword [ebp - 0x250], str.Alex_WFPMDE_process_passed_in_params
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x24c], 1
push 0
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.fwpuclnt.dll_FwpmProviderAdd0]
cmp eax, 0x80320009
jne 0x4011bc
push str.___i__Provider_already_exists_n
call fcn.00401010
add esp, 4
push esi
push str._i__Getting_process___s__app_ID_n
call fcn.00401010
add esp, 8
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4011dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___X__MultiByteToWideChar_failed_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x40116b
push eax
push str.___X__FwpmProviderAdd0_failed_with_code_0x_x._n
call fcn.00401010
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmGetAppIdFromFileName0]
test eax, eax
je 0x401212
push eax
push str._X__FwpmGetAppIdFromFileName0_failed_with_code_0x_x._n
call fcn.00401010
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401cf3
mov esp, ebp
pop ebp
ret
push str._i__Creating_filters_n
call fcn.00401010
mov eax, dword [ebp - 0x220]
add esp, 4
movups xmm0, xmmword [0x403150]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x300]
mov dword [ebp - 0x2f0], str.Alex_WFPMDE_filter
movups xmmword [ebp - 0x2d8], xmm0
push eax
movups xmm0, xmmword [0x403170]
mov dword [ebp - 0x2e8], 1
push dword [ebp - 0x21c]
mov dword [ebp - 0x2a8], 0x1001
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0xc
mov dword [ebp - 0x2b0], 1
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x4012cb
push dword [ebp - 0x218]
push dword [ebp - 0x214]
push esi
push str._____Added_WFP_filter_for___s___Filter_id:_0x_x_x__IPv4_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x4012d9
push eax
push str.___X__Failed_to_add_filter_in_IPv4_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
movups xmm0, xmmword [str._9rJ]
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [ebp - 0x300]
push eax
push dword [ebp - 0x21c]
movups xmmword [ebp - 0x2d8], xmm0
call dword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
test eax, eax
jne 0x401323
push dword [ebp - 0x218]
push dword [ebp - 0x214]
push esi
push str._____Added_WFP_filter_for___s___Filter_id:_0x_x_x__IPv6_layer_._n
call fcn.00401010
add esp, 0x10
jmp 0x401331
push eax
push str.___X__Failed_to_add_filter_in_IPv6_layer_with_error_code:_0x_x._n
call fcn.00401010
add esp, 8
push dword [ebp - 0x21c]
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401cf3
mov esp, ebp
pop ebp
ret