Function at 0x14003d320
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [0x14008d458], 0
jne 0x14003d6ff
cmp qword [0x14008d450], 0
jne 0x14003d36d
lea rcx, str.fwpuclnt.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov qword [0x14008d450], rax
je 0x14003d6ff
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
call fcn.14004c980
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rsp + 0x24]
cmp r11d, 6
ja 0x14003d3a6
jne 0x14003d3ad
cmp dword [rsp + 0x28], 1
jb 0x14003d3ad
mov byte [0x14008d448], 1
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmEngineOpen0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d390], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmEngineClose0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d398], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmTransactionAbort0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3a0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmTransactionBegin0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3a8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmTransactionCommit0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3b0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmSubLayerAdd0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3b8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmSubLayerDeleteByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3c0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmSubLayerGetByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3c8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFreeMemory0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3d0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterAdd0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3d8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterDeleteByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3e8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterDeleteById0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3e0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterGetByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3f0], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmGetAppIdFromFileName0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d3f8], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmCalloutAdd0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d400], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmCalloutDeleteByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d408], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmCalloutGetByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d410], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmProviderAdd0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d418], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmProviderGetByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d428], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmProviderDeleteByKey0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x14008d420], rax
je 0x14003d6ff
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterCreateEnumHandle0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterDestroyEnumHandle0
mov qword [0x14008d430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008d450]
lea rdx, str.FwpmFilterEnum0
mov qword [0x14008d438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14008d430], 0
mov r11, rax
mov qword [0x14008d440], rax
je 0x14003d6ff
cmp qword [0x14008d438], 0
je 0x14003d6ff
movzx eax, byte [0x14008d449]
mov ecx, 1
test r11, r11
cmovne eax, ecx
mov byte [0x14008d449], al
jmp 0x14003d705
mov al, byte [0x14008d449]
mov byte [0x14008d458], 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x158
ret