Function at 0x100001c70
Capabilities:
Listen for remote procedure calls

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r13
sub rsp, 0xa0
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x30], 0xd
lea rax, [0x100012210]
mov qword [r11 - 0x80], rax
mov dword [rsp + 0x20], 0x4d2
mov r9d, 0x28
xor r8d, r8d
xor edx, edx
lea rcx, [0x100014b00]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov ebx, eax
mov dword [rsp + 0x30], eax
xor esi, esi
cmp eax, esi
jne 0x100009654
mov edi, 1
mov dword [0x10001d1c0], edi
lea rcx, [0x10001d958]
call qword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, esi
jne 0x10000969d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r9d, dword [rax + 0x2c0]
lea r8, str.b08669ee_8cb5_43a5_a017_84fe_08X
mov edx, 0x25
lea rcx, [rsp + 0x40]
call fcn.100002858
lea r13, [0x10001d990]
mov rdx, r13
lea rcx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, esi
jne 0x1000096e3
mov dword [0x10001d260], edi
mov qword [0x10001d268], r13
or edx, 0xffffffff
lea rcx, str.RPCSS
call fcn.1000012d4
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, esi
jne 0x10000972b
xor r9d, r9d
lea r8, [0x10001d260]
mov rdx, qword [0x10001d958]
lea rcx, [0x100014b00]
call qword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, esi
jne 0x100009773
mov dword [0x10001d1bc], edi
mov r8d, edi
mov edx, 0x4d2
mov ecx, edi
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
mov dword [rsp + 0x30], eax
cmp eax, 0x6b1
cmove ebx, esi
mov dword [rsp + 0x30], ebx
cmp ebx, esi
jne 0x1000097bb
cmp ebx, esi
jne 0x100009804
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
lea edi, [rsi + 1]
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
lea edx, [rsi + 0x15]
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100001dd6
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
lea edx, [rdi + 0x15]
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100001dd6
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
mov edx, 0x17
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100001dd6
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
mov edx, 0x18
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100001dd6
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
mov edx, 0x19
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
jmp 0x100001dd6
lea rax, [0x10001d1e0]
mov rcx, qword [0x10001d1e0]
cmp rcx, rax
je 0x100001dd6
test byte [rcx + 0x1c], dil
je 0x100001dd6
cmp byte [rcx + 0x19], 2
jb 0x100001dd6
mov edx, 0x1a
mov r9d, ebx
lea r8, [0x100016dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100001e70
nop
jmp 0x100001dd6
call fcn.1000122f4
nop
jmp 0x100001dde