Here’s where I am now, with a little help from @strawgate. This version is a little more readable, and seems to work with multiple network connections / multiple active profiles
Q: (type of it as string,(if exists (type of it as string & "Profile", keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall" of native registry) whose (item 0 of it = name of item 1 of it and exists value "EnableFirewall" of item 1 of it) then ("GPO" , (exists value "EnableFirewall" whose (it as integer = 1) of item 1 of (type of it as string & "Profile", keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall" of native registry) whose (item 0 of it = name of item 1 of it )) as string ) else ("Local" , firewall enabled of it as string))) of (it) of profiles of local policies of firewall
A: Domain, ( Local, False )
A: Public, ( GPO, True )