Function at 0x18001f198
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
mov r12, rcx
xor esi, esi
and qword [rbp + 0x40], rsi
and qword [rbp - 8], rsi
lea rdx, [rbp - 0x10]
lea rcx, [0x180036dd4]
xor edi, edi
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x18001f293
lea rdx, [rbp + 0x48]
mov rcx, rbx
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x18001f280
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x48]
mov edi, eax
add edi, edi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r12
mov ebx, eax
lea r14d, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rsi + 0x40]
lea r13d, [rax + rax]
lea rax, [rdi + r14]
mov ebx, edi
lea rdx, [rax + r13 + 4]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18001f274
mov rdx, qword [rbp - 0x10]
mov r8d, ebx
mov rcx, rax
call fcn.180026930
mov rdx, qword [rbp + 0x48]
lea rcx, [rbx + rdi + 2]
mov r8d, r14d
call fcn.180026930
mov byte [rbx + rdi], 0x2f
add rbx, r13
lea rcx, [rbx + rdi + 4]
mov r8d, r13d
mov rdx, r12
call fcn.180026930
mov byte [rbx + rdi + 2], 0x2f
lea rcx, [rbp + 0x48]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x18001f287
mov ecx, eax
call fcn.180004a6c
lea rcx, [rbp - 0x10]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x18001f29a
mov ecx, eax
call fcn.180004a6c
test rdi, rdi
je 0x18001f3e9
xor r9d, r9d
lea rcx, str.ncacn_ip_tcp
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
test eax, eax
jne 0x18001f3d9
lea edx, [rax + 9]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov esi, eax
test eax, eax
jne 0x18001f3d9
and qword [rsp + 0x30], 0
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rax + 8]
lea rcx, [0x180036dd0]
mov r13d, 0x4d2
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov esi, eax
test eax, eax
jne 0x18001f3d9
lea rcx, [rbp + 0x40]
call qword [sym.imp.RPCRT4.dll_RpcServerInqBindings]
mov esi, eax
test eax, eax
jne 0x18001f3d9
lea r12d, [rax + 1]
mov rax, qword [rbp + 0x40]
xor ebx, ebx
cmp dword [rax], ebx
jbe 0x18001f37a
xor esi, esi
mov rcx, qword [rsi + rax + 8]
lea rdx, [rbp - 8]
call qword [sym.imp.RPCRT4.dll_RpcBindingToStringBindingW]
test eax, eax
jne 0x18001f364
mov rdx, qword [rbp - 8]
mov ecx, ebx
call fcn.180004a6c
lea rcx, [rbp - 8]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
jmp 0x18001f36b
mov ecx, eax
call fcn.180004a6c
mov rax, qword [rbp + 0x40]
add ebx, r12d
add rsi, 8
cmp ebx, dword [rax]
jb 0x18001f33a
lea r9, str.mimikatz_Ho__hey__Im_a_DC_:_
lea rcx, [0x180036dd0]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.RPCRT4.dll_RpcEpRegisterW]
lea rcx, [rbp + 0x40]
mov esi, eax
call qword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
test esi, esi
jne 0x18001f3d5
call fcn.180004a6c
mov r8d, r12d
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov esi, eax
test eax, eax
jne 0x18001f3c5
call fcn.180004a6c
jmp 0x18001f3e0
cmp eax, 0x6b1
jne 0x18001f3d9
call fcn.180004a6c
xor esi, esi
jmp 0x18001f3e0
mov ecx, esi
jmp 0x18001f3db
mov ecx, eax
call fcn.180004a6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret