Function at 0x1400345a4
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rcx
lea rax, section..data
mov r12d, 5
lea r14d, [r12 - 4]
mov rcx, qword [section..data]
cmp rcx, rax
je 0x140034601
test byte [rcx + 0x1c], r14b
je 0x140034601
cmp byte [rcx + 0x19], r12b
jb 0x140034601
mov edx, pe_nt_image_headers64
mov r9d, dword [r15 + 0x4c]
lea r8, [0x1400ae358]
mov rcx, qword [rcx + 0x10]
call fcn.140043960
xor r13d, r13d
mov edi, r13d
mov qword [rbp + 0x58], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ae1f8]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400ae208]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov esi, eax
lea ebx, [r13 + 2]
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140034684
test byte [r10 + 0x1c], bl
je 0x140034684
mov ecx, ebx
test esi, esi
cmovns ecx, r12d
movzx eax, byte [r10 + 0x19]
cmp eax, ecx
jb 0x140034684
mov edx, 0x101
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [0x1400ae358]
mov rcx, qword [r10 + 0x10]
call fcn.140052b04
test esi, esi
js 0x1400348c2
mov word [rbp + 0x48], r13w
mov rcx, qword [rbp + 0x58]
mov rax, qword [rcx]
movabs r10, 0x8f6d364032d6a370
lea rdx, [rbp + 0x48]
mov rax, qword [rax + 0x60]
call qword [case.0x140028cb6.0]
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400346fa
test byte [rcx + 0x1c], bl
je 0x1400346fa
mov edx, ebx
test esi, esi
cmovns edx, r12d
movzx eax, byte [rcx + 0x19]
cmp eax, edx
jb 0x1400346fa
movsx eax, word [rbp + 0x48]
mov edx, 0x102
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, [0x1400ae358]
mov rcx, qword [rcx + 0x10]
call fcn.140049814
test esi, esi
js 0x1400348c2
or eax, 0xffffffff
cmp ax, word [rbp + 0x48]
jne 0x1400348c2
mov qword [rbp + 0x50], r13
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ae218]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400ae228]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov esi, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140034784
test byte [rcx + 0x1c], bl
je 0x140034784
test esi, esi
cmovns ebx, r12d
movzx eax, byte [rcx + 0x19]
cmp eax, ebx
jb 0x140034784
mov edx, 0x103
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [0x1400ae358]
mov rcx, qword [rcx + 0x10]
call fcn.140052b04
test esi, esi
js 0x1400348a1
mov dword [rbp + 0x48], r13d
lea r8, [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
call fcn.140034940
test eax, eax
js 0x1400348a1
cmp dword [rbp + 0x48], r13d
je 0x1400348a1
lea r14, [r15 + 0xe8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
lea r12, [r15 + 0x110]
mov rcx, r12
call fcn.1400412b0
mov rsi, rax
test rax, rax
je 0x140034888
test edi, edi
jne 0x140034888
mov r9, rsi
mov rdx, rsi
mov rcx, r12
call fcn.140034a70
mov rsi, rax
mov rax, qword [r9 + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14003487f
call fcn.140054430
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
call fcn.140007738
nop
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call fcn.140035ea4
test eax, eax
jne 0x14003486c
mov ebx, r13d
cmp dword [rbp - 0x18], r13d
jle 0x14003486c
test edi, edi
jne 0x14003486c
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.14003a7f0
lea r8, [rbp + 0x48]
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
call fcn.140035000
test eax, eax
lea eax, [rdi + 1]
jne 0x140034865
cmp dword [rbp + 0x48], eax
cmove edi, eax
add ebx, eax
cmp ebx, dword [rbp - 0x18]
jl 0x140034839
lea rcx, [rbp - 0x20]
call fcn.14000aa8c
nop
lea rcx, [rbp - 8]
call fcn.1400043f0
test rsi, rsi
jne 0x1400347e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov r14d, 1
lea r12d, [r14 + 4]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400348c2
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [case.0x140028cb6.0]
nop
mov dword [r15 + 0x4c], edi
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400348fe
test byte [rcx + 0x1c], r14b
je 0x1400348fe
cmp byte [rcx + 0x19], r12b
jb 0x1400348fe
mov edx, 0x104
mov r9d, edi
lea r8, [0x1400ae358]
mov rcx, qword [rcx + 0x10]
call fcn.140043960
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14003491f
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [case.0x140028cb6.0]
nop
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret