Function at 0x1016e89
Capabilities:
Listen for remote procedure calls
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.01015a13
mov dword [ebp - 0xc4], eax
call fcn.01015aeb
call fcn.01017838
xor edi, edi
mov dword [0x1049144], eax
cmp eax, edi
je 0x101ab2f
lea eax, [ebp - 0x84]
push eax
call fcn.01015b6d
mov esi, eax
cmp esi, edi
jl 0x101abc0
mov eax, dword [0x1049ec4]
push 3
cdq
pop ecx
idiv ecx
push eax
call fcn.01015e17
mov eax, dword [0x1049ec4]
push 3
cdq
pop ecx
idiv ecx
push eax
call fcn.0101743f
call fcn.01015bf1
push 4
pop esi
test eax, eax
jne 0x101ac2e
test dword [ebp - 0x84], 0x2000
jne 0x101ac3d
test dword [ebp - 0x84], 0x4c00
jne 0x101ac2e
push 2
push edi
push dword [0x1049eb8]
call fcn.01017a0d
mov dword [0x10491e8], eax
cmp eax, 1
je 0x101ac4c
cmp eax, edi
jne 0x10170f6
push 0x80000000
push 0x10492b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x101acaf
mov dword [ebp - 0x84], edi
push edi
push 0x101710c
push 0xa
push 0x1017104
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov ebx, eax
cmp ebx, 0x6cc
je 0x101adf7
cmp ebx, edi
jne 0x101ae1a
lea ecx, [ebp - 0x44]
call fcn.010179ad
push 0x10241d1
call fcn.01015e4d
push eax
mov ebx, 0x4d2
push ebx
push edi
lea ecx, [ebp - 0x44]
call fcn.010166fd
mov dword [ebp - 0x84], eax
cmp eax, edi
jne 0x101aeb2
lea ecx, [ebp - 0x80]
call fcn.01017958
push 0x10241d1
call fcn.01015ecf
push eax
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.01016851
mov dword [ebp - 0x84], eax
cmp eax, edi
jne 0x101af43
lea eax, [ebp - 0xb8]
push eax
push 0x20019
push edi
push str.SystemCurrentControlSetControlPrint
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x101704b
lea eax, [ebp - 0xc0]
push eax
push 0x104936c
lea eax, [ebp - 0xe0]
push eax
push edi
push str.CallExitProcessOnShutdown
push dword [ebp - 0xb8]
mov dword [ebp - 0xc0], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0xb8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push edi
push dword [ebp - 0xc4]
push ebx
push edi
push edi
push edi
push dword [0x1049ec8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov ebx, eax
cmp ebx, edi
jne 0x101afc9
push 0x8000
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
mov ebx, eax
cmp ebx, edi
jne 0x101b04f
lea eax, [ebp - 0xbc]
push eax
push 9
call dword [sym.imp.RPCRT4.dll_RpcServerInqDefaultPrincNameW]
test eax, eax
jne 0x10170bb
push edi
push edi
push 9
push dword [ebp - 0xbc]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
cmp ebx, edi
jne 0x101b083
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push 1
push dword [0x1049ec4]
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
cmp ebx, edi
jne 0x101b107
lea ecx, [ebp - 0x80]
call fcn.01017179
lea ecx, [ebp - 0x44]
call fcn.01017119
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100327d
leave
ret
cmp eax, 2
jne 0x1016f69
jmp 0x101ad13
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x84], eax
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101ab67
test byte [eax + 0x1c], 1
je 0x101ab67
push dword [ebp - 0x84]
push 0x101ff18
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
mov eax, dword [ebp - 0x84]
push 4
pop esi
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xb4]
push edi
push eax
mov dword [ebp - 0xb4], 0x64
lea eax, [ebp - 0xa8]
push eax
push 0x101b150
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], esi
call fcn.01032099
add esp, 0x10
call ebx
or eax, 0x80010000
jmp 0x10170e7
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101abe5
test byte [eax + 0x1c], 1
je 0x101abe5
push esi
push 0x101ff18
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push esi
call fcn.01024167
push edi
push 0x101b170
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0xa0], edi
call fcn.0102411d
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x101b150
call fcn.01032099
add esp, 0x10
mov eax, esi
jmp 0x10170e7
mov dword [0x10491e8], 2
jmp 0x101ad13
call fcn.010243c3
test eax, eax
je 0x1016f1d
jmp 0x101ac2e
call fcn.01024796
mov ebx, eax
cmp ebx, edi
jge 0x1016f69
push 4
pop esi
push ebx
mov dword [ebp - 0xa8], 0x65
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], edi
call fcn.01024167
mov dword [ebp - 0xb4], eax
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0x101b150
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], edi
call fcn.01032099
add esp, 0x10
mov eax, ebx
jmp 0x10170e7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x84], eax
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101ace7
test byte [eax + 0x1c], 1
je 0x101ace7
push dword [ebp - 0x84]
push 0x101ff18
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
mov eax, dword [ebp - 0x84]
push 4
pop esi
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0xa8], 0x66
lea eax, [ebp - 0xb4]
jmp 0x101ab8e
movzx ebx, word [ebp - 0x84]
mov eax, ebx
shr eax, 0xe
and eax, 1
mov dword [ebp - 0xa8], eax
mov eax, ebx
shr eax, 0xb
and eax, 1
mov dword [ebp - 0xb4], eax
mov eax, ebx
shr eax, 0xa
and eax, 1
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], edi
call fcn.010243c3
neg eax
sbb eax, eax
shr ebx, 0xd
neg eax
and ebx, 1
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01015bf1
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x90], eax
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x101b140
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01032099
add esp, 0x20
jmp 0x1016f69
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], 5
jge 0x1016f90
jmp 0x1016f6f
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101ae3f
test byte [eax + 0x1c], 1
je 0x101ae3f
push ebx
push 0x101ff18
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push ebx
mov dword [ebp - 0x90], 0x64
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024167
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b160
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0102411d
push eax
push 0x101ff2c
lea ecx, [ebp - 0xdc]
call fcn.0102411d
push eax
push 0x101fef8
call fcn.01032099
add esp, 0x18
mov eax, ebx
jmp 0x101abb6
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101aedc
test byte [eax + 0x1c], 1
je 0x101aedc
push dword [ebp - 0x84]
push 0x101ff18
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x67
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024167
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b150
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01032099
add esp, 0x10
lea ecx, [ebp - 0x44]
call fcn.01017119
mov eax, dword [ebp - 0x84]
or eax, 0x80010000
jmp 0x10170e7
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101af6d
test byte [eax + 0x1c], 1
je 0x101af6d
push dword [ebp - 0x84]
push 0x101ff18
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x68
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024167
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b150
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01032099
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.01017179
jmp 0x101af2b
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101afee
test byte [eax + 0x1c], 1
je 0x101afee
push ebx
push 0x101ff18
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
mov dword [ebp - 0x90], 0x69
push ebx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024167
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b150
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01032099
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.01017179
lea ecx, [ebp - 0x44]
call fcn.01017119
mov eax, ebx
jmp 0x101af39
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b074
test byte [eax + 0x1c], 1
je 0x101b074
push ebx
push 0x101ff18
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
mov dword [ebp - 0x90], 0x6a
jmp 0x101aff8
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b0a8
test byte [eax + 0x1c], 1
je 0x101b0a8
push ebx
push 0x101ff18
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
push ebx
mov dword [ebp - 0x90], 0x6b
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024167
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b150
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01032099
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.01017179
lea ecx, [ebp - 0x44]
call fcn.01017119
jmp 0x101aca8
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b12c
test byte [eax + 0x1c], 1
je 0x101b12c
push ebx
push 0x101ff18
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01034754
mov dword [ebp - 0x90], 0x6c
jmp 0x101aff8