Function at 0x1009691
Capabilities:
Listen for remote procedure calls
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x101c200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.01008741
mov dword [ebp - 0x90], eax
call fcn.01009e73
xor ebx, ebx
cmp eax, ebx
mov dword [0x101c220], eax
je 0x100acfc
lea eax, [ebp - 0x80]
push eax
call fcn.01009da1
cmp eax, ebx
jl 0x10098b1
call fcn.01009c26
call fcn.01009e37
test eax, eax
jne 0x100ad0c
test word [ebp - 0x80], 0x2000
jne 0x100ad1b
test word [ebp - 0x80], 0x4c00
jne 0x100ad0c
push 2
push ebx
push dword [0x101d094]
call fcn.0100a081
cmp eax, 1
mov dword [0x101c25c], eax
je 0x100ad2a
cmp eax, ebx
jne 0x1009739
push 0x80000000
push 0x101c2e4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x100acfc
push edi
xor edi, edi
push esi
push ebx
push 0x10098ec
push 0xa
push 0x10098e4
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov esi, eax
cmp esi, 0x6cc
je 0x100ad34
cmp esi, ebx
jne 0x100ad44
lea ecx, [ebp - 0x40]
call fcn.0100a037
mov edi, 0x100ca15
push edi
call fcn.01008a1a
push eax
mov esi, 0x4d2
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.01009151
cmp eax, ebx
mov dword [ebp - 0x80], eax
jne 0x100ad50
lea ecx, [ebp - 0x7c]
call fcn.01009f90
push edi
call fcn.01008a61
push eax
push esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.010092d5
mov esi, eax
cmp esi, ebx
jne 0x10098d6
lea eax, [ebp - 0x88]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetControlPrint
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009813
lea eax, [ebp - 0x8c]
push eax
push 0x101c314
lea eax, [ebp - 0x94]
push eax
push ebx
push str.CallExitProcessOnShutdown
push dword [ebp - 0x88]
mov dword [ebp - 0x8c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push dword [ebp - 0x90]
push 0xa
push ebx
push ebx
push ebx
push dword [0x101d0a8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov esi, eax
cmp esi, ebx
jne 0x10098d6
push 0x8000
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
mov esi, eax
cmp esi, ebx
jne 0x10098d6
lea eax, [ebp - 0x84]
push eax
push 9
call dword [sym.imp.RPCRT4.dll_RpcServerInqDefaultPrincNameW]
test eax, eax
jne 0x1009884
push ebx
push ebx
push 9
push dword [ebp - 0x84]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov esi, eax
cmp esi, ebx
jne 0x100ad67
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push 1
push 0x1770
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
lea ecx, [ebp - 0x7c]
mov esi, eax
call fcn.010098f9
lea ecx, [ebp - 0x40]
call fcn.01009429
cmp esi, ebx
jne 0x100ad7e
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01009e24
leave
ret
cmp eax, ebx
jl 0x10098b1
jmp 0x1009739
inc edi
cmp edi, 5
jge 0x100975e
jmp 0x100973d
lea ecx, [ebp - 0x7c]
call fcn.010098f9
jmp 0x100ad5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0x80010000
jmp 0x10098b1
mov dword [0x101c25c], 2
jmp 0x1009739
call fcn.0100cb39
test eax, eax
je 0x10096f5
jmp 0x100ad0c
call fcn.010046f1
jmp 0x10098be
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10098c7
mov eax, esi
or eax, 0x80010000
jmp 0x10098af
lea ecx, [ebp - 0x40]
call fcn.01009429
mov eax, dword [ebp - 0x80]
jmp 0x100ad80
lea ecx, [ebp - 0x40]
call fcn.01009429
jmp 0x100ad7e
lea ecx, [ebp - 0x7c]
call fcn.010098f9
lea ecx, [ebp - 0x40]
call fcn.01009429
mov eax, esi
jmp 0x10098af
mov eax, esi
or eax, 0x80010000
jmp 0x10098af