Function at 0x100d366
Capabilities:
Listen for remote procedure calls

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push ebx
push 0xa
push ebx
xor ebp, ebp
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoA]
mov esi, eax
cmp esi, ebx
jne 0x100c5a3
mov dword [esp + 0xc], ebx
push edi
call fcn.0100a99b
test eax, eax
mov dword [esp + 0x14], eax
je 0x100c472
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c3d1
sub eax, edi
mov dword [esp + 0x18], eax
add eax, 0xf
push eax
push 0
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x100c472
mov edx, dword [esp + 0x14]
mov esi, 0x1001dac
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, edx
movsw word es:[edi], word [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c40b
sub eax, esi
mov ecx, eax
shr ecx, 2
mov esi, edx
lea edi, [ebp + 0xe]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x1024f78]
call edi
mov eax, dword [esp + 0x18]
and byte [eax + ebp + 0xe], 0
push 0
push ebp
push 0xa
push 0x1001da4
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov esi, eax
test esi, esi
je 0x100c47a
push ebp
xor ebp, ebp
push ebp
push dword [0x1024f78]
call edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jb 0x100c3bd
test esi, esi
jne 0x100c57c
and dword [esp + 0x10], 0
call fcn.0100a99b
test eax, eax
mov dword [esp + 0x14], eax
je 0x100c534
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100c493
sub eax, ecx
mov dword [esp + 0x18], eax
add eax, 0xd
push eax
push 0
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x100c534
mov edx, dword [esp + 0x14]
mov esi, 0x1001d94
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, edx
movsd dword es:[edi], dword [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c4cb
sub eax, esi
mov ecx, eax
shr ecx, 2
mov esi, edx
lea edi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
and byte [eax + ebx + 0xc], 0
push 0
push ebx
push 0xa
push 0x1001da4
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov esi, eax
test esi, esi
je 0x100c538
push ebx
xor ebx, ebx
push ebx
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jb 0x100c47f
test esi, esi
jne 0x100c57c
push 0
push 0
push dword [0x10200dc]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
mov esi, eax
test esi, esi
jne 0x100c57c
push 1
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
test esi, esi
je 0x100c575
push 1
push 0
push dword [0x10200dc]
call dword [sym.imp.RPCRT4.dll_RpcServerUnregisterIfEx]
jmp 0x100c57c
push ebp
push ebx
call fcn.0100c28d
test ebp, ebp
pop edi
je 0x100c590
push ebp
push 0
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x100c5a3
push ebx
push 0
push dword [0x1024f78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x1024f90
push 0x20
call fcn.01004551
test eax, eax
jne 0x100d389
push edi
mov ecx, 0x7080
mov edi, 0x1025040
rep stosd dword es:[edi], eax
pop edi
jmp 0x100c399
ret