Function at 0x14006e0d0
Capabilities:
Register network filter via wfp api

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x4d8]
sub rsp, 0x5d0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x60], esi
xor edx, edx
lea r8d, [rsi + 0x44]
lea rcx, [rsp + 0x64]
call fcn.140171ae0
lea rax, str.PeerBlock_Dynamic_Session
mov qword [rsp + 0x70], rax
lea rax, str.PeerBlock_firewall_callout.
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], 1
xor edx, edx
lea r8d, [rsi + 0x54]
lea rcx, [rbp + 0xc4]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8cb8]
movups xmmword [rbp + 0xc0], xmm0
movups xmm0, xmmword [0x1401d9410]
movups xmmword [rbp + 0x100], xmm0
lea rax, str.PeerBlock_IPv4_Flow_Outbound_Callout
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rax
xor edx, edx
lea r8d, [rsi + 0x54]
lea rcx, [rbp + 4]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8ca8]
movups xmmword [rbp], xmm0
movups xmm0, xmmword [0x1401d9400]
movups xmmword [rbp + 0x40], xmm0
lea rax, str.PeerBlock_IPv4_Flow_Inbound_Callout
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
xor edx, edx
lea r8d, [rsi + 0x54]
lea rcx, [rbp + 0x64]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c98]
movups xmmword [rbp + 0x60], xmm0
movups xmm0, xmmword [str._9rJ]
movups xmmword [rbp + 0xa0], xmm0
lea rax, str.PeerBlock_IPv6_Flow_Outbound_Callout
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
xor edx, edx
lea r8d, [rsi + 0x54]
lea rcx, [rbp + 0x124]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c88]
movups xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [0x1401d93e0]
movups xmmword [rbp + 0x160], xmm0
lea rax, str.PeerBlock_IPv6_Flow_Inbound_Callout
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rax
xor edx, edx
lea r8d, [rsi + 0x44]
lea rcx, [rbp - 0x4c]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c78]
movups xmmword [rbp - 0x50], xmm0
lea rax, str.PeerBlock_Sub_layer
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0x184]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c68]
movaps xmmword [rbp + 0x180], xmm0
movups xmm0, xmmword [0x1401d9410]
movups xmmword [rbp + 0x1c0], xmm0
lea rax, str.PeerBlock_Flow_Outbound_Filter_for_IPv4.
mov qword [rbp + 0x190], rax
lea rax, str.Sets_up_flow_outbound_filter_for_all_IPv4_traffic__so_we_can_filter_the_blocked_ip_addresses_out.
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x200], 0x4005
movups xmm1, xmmword [0x1401d8cb8]
movd dword [rbp + 0x204], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 4
movd dword [rbp + 0x208], xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movd dword [rbp + 0x20c], xmm0
psrldq xmm1, 0xc
movd dword [rbp + 0x210], xmm1
movups xmm0, xmmword [0x1401d8c78]
movups xmmword [rbp + 0x1d0], xmm0
mov dword [rbp + 0x1e0], esi
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0x324]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c58]
movaps xmmword [rbp + 0x320], xmm0
movups xmm0, xmmword [0x1401d9400]
movups xmmword [rbp + 0x360], xmm0
lea rax, str.PeerBlock_Flow_Inbound_Filter_for_IPv4.
mov qword [rbp + 0x330], rax
lea rax, str.Sets_up_flow_inbound_filter_for_all_IPv4_traffic__so_we_can_filter_the_blocked_ip_addresses_out.
mov qword [rbp + 0x338], rax
mov dword [rbp + 0x3a0], 0x4005
movups xmm1, xmmword [0x1401d8ca8]
movd dword [rbp + 0x3a4], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 4
movd dword [rbp + 0x3a8], xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movd dword [rbp + 0x3ac], xmm0
psrldq xmm1, 0xc
movd dword [rbp + 0x3b0], xmm1
movups xmm0, xmmword [0x1401d8c78]
movups xmmword [rbp + 0x370], xmm0
mov dword [rbp + 0x380], esi
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0x254]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c48]
movaps xmmword [rbp + 0x250], xmm0
movups xmm0, xmmword [str._9rJ]
movups xmmword [rbp + 0x290], xmm0
lea rax, str.PeerBlock_Flow_Outbound_Filter_for_IPv6.
mov qword [rbp + 0x260], rax
lea rax, str.Sets_up_flow_outbound_filter_for_all_IPv6_traffic__so_we_can_filter_the_blocked_ip_addresses_out.
mov qword [rbp + 0x268], rax
mov dword [rbp + 0x2d0], 0x4005
movups xmm1, xmmword [0x1401d8c98]
movd dword [rbp + 0x2d4], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 4
movd dword [rbp + 0x2d8], xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movd dword [rbp + 0x2dc], xmm0
psrldq xmm1, 0xc
movd dword [rbp + 0x2e0], xmm1
movups xmm0, xmmword [0x1401d8c78]
movups xmmword [rbp + 0x2a0], xmm0
mov dword [rbp + 0x2b0], esi
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0x3f4]
call fcn.140171ae0
movups xmm0, xmmword [0x1401d8c38]
movaps xmmword [rbp + 0x3f0], xmm0
movups xmm0, xmmword [0x1401d93e0]
movups xmmword [rbp + 0x430], xmm0
lea rax, str.PeerBlock_Flow_Inbound_Filter_for_IPv6.
mov qword [rbp + 0x400], rax
lea rax, str.Sets_up_flow_inbound_filter_for_all_IPv6_traffic__so_we_can_filter_the_blocked_ip_addresses_out.
mov qword [rbp + 0x408], rax
mov dword [rbp + 0x470], 0x4005
movups xmm1, xmmword [0x1401d8c88]
movd dword [rbp + 0x474], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 4
movd dword [rbp + 0x478], xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movd dword [rbp + 0x47c], xmm0
psrldq xmm1, 0xc
movd dword [rbp + 0x480], xmm1
movups xmm0, xmmword [0x1401d8c78]
movups xmmword [rbp + 0x440], xmm0
mov dword [rbp + 0x450], esi
add rbx, 0x148
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14006e980
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmTransactionBegin0]
mov edi, eax
test eax, eax
je 0x14006e55d
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rax, [0x1401d9388]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmCalloutAdd0]
mov edi, eax
test eax, eax
je 0x14006e5be
cmp eax, 0x80320009
je 0x14006e5be
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9378]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmCalloutAdd0]
mov edi, eax
test eax, eax
je 0x14006e61c
cmp eax, 0x80320009
je 0x14006e61c
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9378]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmCalloutAdd0]
mov edi, eax
test eax, eax
je 0x14006e67a
cmp eax, 0x80320009
je 0x14006e67a
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9378]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x120]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmCalloutAdd0]
mov edi, eax
test eax, eax
je 0x14006e6db
cmp eax, 0x80320009
je 0x14006e6db
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9378]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmSubLayerAdd0]
mov edi, eax
test eax, eax
je 0x14006e72f
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rax, [0x1401d9360]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x180]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov edi, eax
test eax, eax
je 0x14006e789
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9350]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x320]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov edi, eax
test eax, eax
je 0x14006e7e3
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9350]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov edi, eax
test eax, eax
je 0x14006e83d
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9350]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x3f0]
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmFilterAdd0]
mov edi, eax
test eax, eax
je 0x14006e897
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401d9350]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], edi
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
mov rcx, qword [rbx]
call qword [sym.imp.fwpuclnt.dll_FwpmTransactionCommit0]
mov ebx, eax
test eax, eax
je 0x14006e8e4
lea rcx, [rsp + 0x20]
call fcn.1401670f4
nop
lea rcx, vtable.win32_error.0
mov qword [rsp + 0x20], rcx
lea rax, [0x1401d9338]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], ebx
lea rdx, [0x14022dc38]
lea rcx, [rsp + 0x20]
call fcn.140170da8
int3
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret