Function at 0x11c40
Capabilities:
Register network filter via wfp api

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1e0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov edi, edx
mov rbp, rcx
lea rdx, [rsp + 0x20]
add rcx, 8
mov r13, r8
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp dword [rbp], 0xb1
lea rcx, [rsp + 0x20]
je 0x11ca3
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov eax, 0xc0000184
jmp 0x11ebd
mov ebx, dword [rbp + 0x88]
mov rsi, qword [rbp + 0x120]
mov rax, rdi
add rax, rax
mov r14, rdi
mov rdi, qword [rbp + 0x10]
movdqu xmm0, xmmword [rbp + rax*8 + 0x8c]
movdqu xmm7, xmmword [rbp + rax*8 + 0xcc]
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
or eax, 0xffffffff
xor edx, edx
sub eax, ebx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.00015760
mov rax, qword [r13 + 0x50]
movdqu xmm6, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x50], xmm6
and qword [rsp + 0x78], 0
xor edx, edx
mov qword [rsp + 0x68], rax
lea rax, [0x00013260]
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x58]
mov qword [rsp + 0x70], rax
call fcn.00015760
mov rax, qword [r13 + 0x10]
movdqu xmm0, xmmword [r13 + 0x30]
movdqu xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x90], rax
mov rax, qword [r13 + 0x18]
lea rcx, [rsp + 0xe0]
movdqu xmmword [rsp + 0xc0], xmm0
xor edx, edx
mov r8d, 0xc8
mov qword [rsp + 0x98], rax
call fcn.00015760
mov rax, qword [r13 + 0x20]
mov rcx, qword [0x00019098]
movdqu xmm0, xmmword [r13 + 0x30]
movdqu xmmword [rsp + 0xe0], xmm7
movdqu xmmword [rsp + 0x164], xmm6
mov qword [rsp + 0xf0], rax
mov rax, qword [r13 + 0x28]
mov rdx, rdi
movdqu xmmword [rsp + 0x120], xmm0
movdqu xmm0, xmmword [r13 + 0x40]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x160], 0x4005
movdqu xmmword [rsp + 0x130], xmm0
mov dword [rsp + 0x140], 4
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x148], rax
call qword [0x00018508]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rax
call sub.fwpkclnt.sys_FwpsCalloutRegister0
test eax, eax
js 0x11ebd
xor edx, edx
mov rcx, rsi
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov ebx, eax
test eax, eax
js 0x11eb1
lea rdx, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call sub.fwpkclnt.sys_FwpmCalloutAdd0
mov ebx, eax
test eax, eax
js 0x11ea9
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call sub.fwpkclnt.sys_FwpmFilterAdd0
mov ebx, eax
test eax, eax
js 0x11ea9
mov rcx, rsi
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov ebx, eax
test eax, eax
js 0x11eb1
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp dword [rbp], 0xb1
lea rcx, [rsp + 0x20]
je 0x11e93
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov ebx, 0xc0000184
jmp 0x11eb1
mov dword [rbp + r14*4 + 0x10c], 1
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor eax, eax
jmp 0x11ebd
mov rcx, rsi
call sub.fwpkclnt.sys_FwpmTransactionAbort0
lea rcx, [rsp + 0x40]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterByKey0
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.00014eb0
lea r11, [rsp + 0x1e0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret