Function at 0x1400b64e8
Capabilities:
Access firewall policy via inetfwpolicy2
Access firewall settings via inetfwmgr

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r13d, r13d
mov r15, rcx
mov ebx, r13d
mov qword [rbp - 0x10], r13
lea rcx, str.svchost_peer_to_peer__UDP_
mov dword [rbp + 0x48], ebx
mov qword [rbp - 0x18], r13
mov r14d, r13d
mov qword [rbp - 0x20], r13
mov esi, r13d
mov qword [rbp + 0x50], r13
mov edi, r13d
mov qword [rbp - 8], r13
mov qword [rbp + 0x58], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
test rax, rax
je 0x1400b66c0
lea rcx, str.svchost_management__UDP_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
test rax, rax
je 0x1400b66c0
lea rcx, str.svchost_peer_to_peer__TCP_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test rax, rax
je 0x1400b66c0
lea rcx, str.svchost_management__TCP_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
je 0x1400b66c0
lea rax, [rbp - 0x10]
xor edx, edx
lea r9, [0x1402c62c8]
mov qword [rsp + 0x20], rax
lea r8d, [r13 + 1]
lea rcx, [0x1402c62a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b66c0
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + gethostname]
test eax, eax
js 0x1400b66c0
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
test eax, eax
js 0x1400b66c0
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x1400b66c0
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
test rax, rax
je 0x1400b66c0
mov r13d, 4
mov rcx, qword [rbp + 0x58]
mov rdx, r15
mov r8, qword [rcx]
call qword [r8 + 0x48]
test eax, eax
js 0x1400b66b4
inc ebx
cmp ebx, r13d
jl 0x1400b661b
xor edx, edx
lea rax, [rbp - 8]
lea r9, [0x1402c6298]
mov qword [rsp + 0x20], rax
lea rcx, [0x1402c6308]
lea r8d, [rdx + 0x17]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b66b4
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
js 0x1400b66b4
mov rcx, qword [rbp + 0x50]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x50]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x50]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x48]
sub r13, 1
jne 0x1400b6674
lea ebx, [r13 + 1]
jmp 0x1400b66b7
mov ebx, dword [rbp + 0x48]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x1400b66cf
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400b66de
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400b66ed
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400b66fc
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400b670b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400b671a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test r12, r12
je 0x1400b6728
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14, r14
je 0x1400b6736
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x1400b6744
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x1400b6752
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret