Function at 0x1400b605c
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall rule properties via inetfwrule

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x38], 0
mov rsi, rcx
and qword [rbp + 0x40], 0
xor edi, edi
and qword [rbp + 0x48], 0
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x1400b648a
lea rax, [rbp + 0x48]
xor edx, edx
lea r13d, [rdi + 0x17]
mov qword [rsp + 0x20], rax
mov r8d, r13d
lea r9, [0x1402c6298]
lea rcx, [0x1402c6308]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b648a
lea rax, [rbp + 0x38]
mov r8d, r13d
lea r9, [0x1402c62d8]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1402c62f8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.svchost_peer_to_peer__UDP_
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea edx, [rdi + 0x11]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.16990
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.Svchost_agent_UDP_port_for_local_peer_to_peer_traffic.
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x140]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
or r12d, 0xffffffff
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x110]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
and qword [rbp + 0x38], rdi
lea rax, [rbp + 0x38]
lea r9, [0x1402c62d8]
mov qword [rsp + 0x20], rax
mov r8d, r13d
lea rcx, [0x1402c62f8]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.svchost_management__UDP_
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea edx, [rdi + 0x11]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.16991
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.Svchost_agent_UDP_port_for_internet_WebRTC_management_traffic.
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x140]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x110]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
and qword [rbp + 0x38], rdi
lea rax, [rbp + 0x38]
lea r9, [0x1402c62d8]
mov qword [rsp + 0x20], rax
mov r8d, r13d
lea rcx, [0x1402c62f8]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.svchost_peer_to_peer__TCP_
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea edx, [rdi + 6]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.16990
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.Svchost_agent_TCP_port_for_local_peer_to_peer_traffic.
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x110]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
and qword [rbp + 0x38], rdi
lea rax, [rbp + 0x38]
lea r9, [0x1402c62d8]
mov qword [rsp + 0x20], rax
mov r8d, r13d
lea rcx, [0x1402c62f8]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.svchost_management__TCP_
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea edx, [rdi + 6]
mov rax, qword [rcx]
call qword [rax + 0x80]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.16991
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
lea rdx, str.Svchost_agent_TCP_port_for_management_traffic.
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov edx, r12d
mov rax, qword [rcx]
call qword [rax + 0x110]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x1400b648a
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor ecx, ecx
mov qword [rbp + 0x38], rcx
lea edi, [rcx + 1]
jmp 0x1400b648e
mov rcx, qword [rbp + 0x38]
test rbx, rbx
je 0x1400b64a0
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400b64ab
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400b64ba
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400b64c9
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test edi, edi
jne 0x1400b64d5
mov rdx, rsi
call fcn.1400b5ec0
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret