Yes, that is the correct executable. Here is how it should be configured:
C:\Windows\system32>sc qc MpsSvc
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: MpsSvc
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k
LocalServiceNoNetwork
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Windows Firewall
DEPENDENCIES : mpsdrv
: bfe
SERVICE_START_NAME : NT Authority\LocalService
It depends on two other services. Here are their respective configurations:
C:\Windows\system32>sc qc mpsdrv
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: mpsdrv
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : System32\drivers\mpsdrv.sys
LOAD_ORDER_GROUP : network
TAG : 0
DISPLAY_NAME : Windows Firewall Authorization Driver
DEPENDENCIES :
SERVICE_START_NAME :
C:\Windows\system32>sc qc bfe
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: bfe
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k
LocalServiceNoNetwork
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Base Filtering Engine
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\LocalService
Check all three of them to make sure they are all configured this way.