Function at 0x140011537
Capabilities:
Check if file exists
Listen for remote procedure calls
Query or enumerate registry value

Disassembly:
jmp 0x140018d80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x9e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14002d068]
xor rax, rbp
mov qword [rbp + 0x3e0], rax
lea rcx, [0x1400331bc]
call fcn.14001178a
xor r9d, r9d
lea r8, str.pipeexorpc
mov edx, 0xa
lea rcx, str.ncacn_np
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 4]
call fcn.1400113f2
xor r9d, r9d
mov r8, qword [rbp + 0x410]
mov edx, 0xa
lea rcx, str.ncacn_ip_tcp
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 4]
call fcn.1400113f2
lea rax, [0x14001147e]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4d2
mov r9d, 0x10
xor r8d, r8d
xor edx, edx
mov rcx, qword [section..data]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 4]
call fcn.1400113f2
xor r9d, r9d
xor r8d, r8d
mov edx, 9
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 4]
call fcn.1400113f2
lea rax, str.SYSTEMCurrentControlSetServicesWorkSvcParametres
mov qword [rbp + 0x48], rax
lea rax, str.CryptoWorkerPath
mov qword [rbp + 0x68], rax
mov ecx, 0x400
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [0x14002d498], rax
mov dword [rbp + 0x84], 0x400
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140018f6e
mov rax, qword [0x140026350]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
cmp dword [rax], 5
jbe 0x140018f5f
mov rdx, qword [0x140029c44]
mov rcx, qword [rbp + 0xc8]
call fcn.1400111ef
movzx eax, al
test eax, eax
je 0x140018f5f
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0x304]
call fcn.1400112ee
mov qword [rbp + 0x3d8], rax
lea rdx, str.Could_not_open_registry_key___Aborting_RPC_Server_start__
lea rcx, [rbp + 0x328]
call fcn.14001184d
mov rcx, qword [rbp + 0x3d8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029c41]
mov rcx, qword [rbp + 0xc8]
call fcn.1400112df
xor eax, eax
test eax, eax
jne 0x140018ed4
call fcn.14001101e
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov rax, qword [0x14002d498]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x140019047
mov rax, qword [0x140026350]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
cmp dword [rax], 5
jbe 0x140019038
mov rdx, qword [0x140029c6a]
mov rcx, qword [rbp + 0xe8]
call fcn.1400111ef
movzx eax, al
test eax, eax
je 0x140019038
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0x344]
call fcn.1400112ee
mov qword [rbp + 0x3d8], rax
lea rdx, str.Could_not_read_registry_value___Aborting_RPC_Server_start__
lea rcx, [rbp + 0x368]
call fcn.14001184d
mov rcx, qword [rbp + 0x3d8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029c67]
mov rcx, qword [rbp + 0xe8]
call fcn.1400112df
xor eax, eax
test eax, eax
jne 0x140018fad
call fcn.14001101e
mov rcx, qword [0x14002d498]
call fcn.140011339
test rax, rax
jne 0x1400190c8
mov rax, qword [0x140026350]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
cmp dword [rax], 5
jbe 0x1400190bd
mov rdx, qword [0x140029c90]
mov rcx, qword [rbp + 0x108]
call fcn.1400111ef
movzx eax, al
test eax, eax
je 0x1400190bd
lea rdx, str.Registry_value_is_empty___Aborting_RPC_Server_start__
lea rcx, [rbp + 0x388]
call fcn.14001184d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029c8d]
mov rcx, qword [rbp + 0x108]
call fcn.1400114bf
xor eax, eax
test eax, eax
jne 0x140019058
call fcn.14001101e
mov rcx, qword [0x14002d498]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
jne 0x140019154
mov rax, qword [0x140026350]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
cmp dword [rax], 5
jbe 0x140019149
mov rdx, qword [0x140029caf]
mov rcx, qword [rbp + 0x148]
call fcn.1400111ef
movzx eax, al
test eax, eax
je 0x140019149
lea rdx, str.File_does_not_exist___Aborting_RPC_Server_start__
lea rcx, [rbp + 0x3a8]
call fcn.14001184d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029cac]
mov rcx, qword [rbp + 0x148]
call fcn.1400114bf
xor eax, eax
test eax, eax
jne 0x1400190e4
call fcn.14001101e
mov rax, qword [0x140026350]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
cmp dword [rax], 5
jbe 0x1400191b9
mov rdx, qword [0x140029cce]
mov rcx, qword [rbp + 0x168]
call fcn.1400111ef
movzx eax, al
test eax, eax
je 0x1400191b9
lea rdx, str.RPC_server_started__
lea rcx, [rbp + 0x3c8]
call fcn.14001184d
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140029ccb]
mov rcx, qword [rbp + 0x168]
call fcn.1400114bf
xor eax, eax
test eax, eax
jne 0x140019154
xor r8d, r8d
mov edx, 0x4d2
mov ecx, 1
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 4]
call fcn.1400113f2
lea rcx, [rbp - 0x30]
lea rdx, [0x1400274a0]
call fcn.14001165e
mov rcx, qword [rbp + 0x3e0]
xor rcx, rbp
call fcn.1400113ac
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret