Function at 0x2179346
Capabilities:
Listen for remote procedure calls
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push edi
xor esi, esi
push 0x218cc50
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x10], pe_nt_image_headers32
push eax
push ecx
push str.CLSID6C736DB0_BD94_11D0_8A23_00AA00B58E10EnableEvents
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2179490
lea eax, [ebp - 0xb4]
mov ecx, 0x2186880
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x21793b4
or dl, dl
je 0x21793b0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x21793b4
add eax, 2
add ecx, 2
or dl, dl
jne 0x2179394
xor eax, eax
jmp 0x21793b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x2179490
mov byte [ebp - 7], 1
xor ebx, ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
push 1
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 8], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp dword [0x218cb40], ebx
je 0x217944e
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp dword [ebp - 4], ebx
je 0x217944e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea edi, [eax + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x2179445
push 2
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push dword [ebp - 4]
push 0xfff3ffff
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor edi, edi
lea ecx, [ebp - 0x28]
push edi
push dword [ebp - 0x14]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea ecx, [ebp - 0x28]
push str.MSFT.VSA.IEC.STATUS.6c736db0
push edi
lea edx, [ebp - 0x34]
push 1
mov dword [ebp - 0x2c], edi
push edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0xc
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp dword [ebp - 0x14], edi
je 0x2179490
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
cmp dword [0x218c1d8], edi
jne 0x21794f1
mov dword [0x218cb50], edi
mov dword [0x218cb54], edi
mov dword [0x218cb58], edi
mov dword [0x218cb5c], edi
mov dword [0x218cb48], 0x10
mov dword [0x218cb4c], 2
mov dword [0x218cb60], 0xbb8
push 0x217a281
push str.RPCSS
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x218cb64], eax
cmp eax, edi
jne 0x21794f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x2179507
push 2
call fcn.02179a24
test esi, esi
jne 0x2179519
call fcn.02179b6f
mov esi, eax
test esi, esi
jne 0x217952b
push 2
call fcn.02179a24
call fcn.02177af0
mov esi, eax
test esi, esi
jne 0x217953d
push 2
call fcn.02179a24
call fcn.0217a55e
mov esi, eax
test esi, esi
jne 0x217954f
push 2
call fcn.02179a24
call fcn.02178198
mov esi, eax
test esi, esi
jne 0x2179558
push 2
call fcn.02179a24
call fcn.02178bc4
mov esi, eax
test esi, esi
jne 0x2179594
call fcn.02173ee1
test esi, esi
jne 0x21795a4
push 1
push 0x4d2
push 1
call sub.RPCRT4.dll_RpcServerListen
mov esi, eax
test esi, esi
jne 0x21795a4
push 0
call sub.RPCRT4.dll_RpcMgmtIsServerListening
cmp eax, 0x6b3
jne 0x2179594
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call sub.RPCRT4.dll_RpcMgmtIsServerListening
cmp eax, 0x6b3
je 0x217957e
test esi, esi
jne 0x21795cc
push 2
call fcn.02179a24
call fcn.02177d8c
test esi, esi
jne 0x21795d7
push 4
call fcn.02179a24
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
jne 0x21795cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x21795d7
push 0
call fcn.02177b5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8