Function at 0x1017009
Capabilities:
Listen for remote procedure calls
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x1049108]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.01015c73
mov dword [ebp - 0xc4], eax
call fcn.01015d4b
call fcn.010179e8
xor edi, edi
mov dword [0x1049144], eax
cmp eax, edi
je 0x101b159
lea eax, [ebp - 0x84]
push eax
call fcn.01015dcd
mov esi, eax
cmp esi, edi
jl 0x101b1ea
mov eax, dword [0x1049ec4]
push 3
cdq
pop ecx
idiv ecx
push eax
call fcn.01016077
mov eax, dword [0x1049ec4]
push 3
cdq
pop ecx
idiv ecx
push eax
call fcn.010175ef
call fcn.01015e51
push 4
pop esi
test eax, eax
jne 0x101b258
test dword [ebp - 0x84], 0x2000
jne 0x101b267
test dword [ebp - 0x84], 0x4c00
jne 0x101b258
push 2
push edi
push dword [0x1049ec0]
call fcn.01017bbd
mov dword [0x10491e8], eax
cmp eax, 1
je 0x101b276
cmp eax, edi
jne 0x1017276
push 0x80000000
push 0x10492b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x101b2d9
mov dword [ebp - 0x84], edi
push edi
push 0x101728c
push 0xa
push 0x1017284
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov ebx, eax
cmp ebx, 0x6cc
je 0x101b421
cmp ebx, edi
jne 0x101b444
lea ecx, [ebp - 0x44]
call fcn.01017b5d
push 0x1024801
call fcn.010160ad
push eax
mov ebx, 0x4d2
push ebx
push edi
lea ecx, [ebp - 0x44]
call fcn.01016884
mov dword [ebp - 0x84], eax
cmp eax, edi
jne 0x101b4dc
lea ecx, [ebp - 0x80]
call fcn.01017b08
push 0x1024801
call fcn.0101612f
push eax
push ebx
push edi
lea ecx, [ebp - 0x80]
call fcn.010169d5
mov dword [ebp - 0x84], eax
cmp eax, edi
jne 0x101b56d
lea eax, [ebp - 0xb8]
push eax
push 0x20019
push edi
push str.SystemCurrentControlSetControlPrint
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10171cb
lea eax, [ebp - 0xc0]
push eax
push 0x104936c
lea eax, [ebp - 0xe0]
push eax
push edi
push str.CallExitProcessOnShutdown
push dword [ebp - 0xb8]
mov dword [ebp - 0xc0], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0xb8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push edi
push dword [ebp - 0xc4]
push ebx
push edi
push edi
push edi
push dword [0x1049ec8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf2]
mov ebx, eax
cmp ebx, edi
jne 0x101b5f3
push 0x8000
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
mov ebx, eax
cmp ebx, edi
jne 0x101b679
lea eax, [ebp - 0xbc]
push eax
push 9
call dword [sym.imp.RPCRT4.dll_RpcServerInqDefaultPrincNameW]
test eax, eax
jne 0x101723b
push edi
push edi
push 9
push dword [ebp - 0xbc]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
cmp ebx, edi
jne 0x101b6ad
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
push 1
push dword [0x1049ec4]
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
cmp ebx, edi
jne 0x101b731
lea ecx, [ebp - 0x80]
call fcn.010172f9
lea ecx, [ebp - 0x44]
call fcn.01017299
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01003279
leave
ret
cmp eax, 2
jne 0x10170e9
jmp 0x101b33d
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x84], eax
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b191
test byte [eax + 0x1c], 1
je 0x101b191
push dword [ebp - 0x84]
push 0x10205a8
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov eax, dword [ebp - 0x84]
push 4
pop esi
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xb4]
push edi
push eax
mov dword [ebp - 0xb4], 0x64
lea eax, [ebp - 0xa8]
push eax
push 0x101b778
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb0], esi
call fcn.0101a9e7
add esp, 0x10
call ebx
or eax, 0x80010000
jmp 0x1017267
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b20f
test byte [eax + 0x1c], 1
je 0x101b20f
push esi
push 0x10205a8
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push esi
call fcn.01024799
push edi
push 0x101b798
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0xa0], edi
call fcn.0101ac1a
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x101b778
call fcn.0101a9e7
add esp, 0x10
mov eax, esi
jmp 0x1017267
mov dword [0x10491e8], 2
jmp 0x101b33d
call fcn.010249f3
test eax, eax
je 0x101709d
jmp 0x101b258
call fcn.01024dc8
mov ebx, eax
cmp ebx, edi
jge 0x10170e9
push 4
pop esi
push ebx
mov dword [ebp - 0xa8], 0x65
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], edi
call fcn.01024799
mov dword [ebp - 0xb4], eax
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0x101b778
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], edi
call fcn.0101a9e7
add esp, 0x10
mov eax, ebx
jmp 0x1017267
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x84], eax
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b311
test byte [eax + 0x1c], 1
je 0x101b311
push dword [ebp - 0x84]
push 0x10205a8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov eax, dword [ebp - 0x84]
push 4
pop esi
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0xa8], 0x66
lea eax, [ebp - 0xb4]
jmp 0x101b1b8
movzx ebx, word [ebp - 0x84]
mov eax, ebx
shr eax, 0xe
and eax, 1
mov dword [ebp - 0xa8], eax
mov eax, ebx
shr eax, 0xb
and eax, 1
mov dword [ebp - 0xb4], eax
mov eax, ebx
shr eax, 0xa
and eax, 1
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], edi
call fcn.010249f3
neg eax
sbb eax, eax
shr ebx, 0xd
neg eax
and ebx, 1
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.01015e51
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x90], eax
push edi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x101b768
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.0101a9e7
add esp, 0x20
jmp 0x10170e9
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], 5
jge 0x1017110
jmp 0x10170ef
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b469
test byte [eax + 0x1c], 1
je 0x101b469
push ebx
push 0x10205a8
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push ebx
mov dword [ebp - 0x90], 0x64
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024799
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b788
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0101ac1a
push eax
push 0x10205bc
lea ecx, [ebp - 0xdc]
call fcn.0101ac1a
push eax
push 0x1020598
call fcn.0101a9e7
add esp, 0x18
mov eax, ebx
jmp 0x101b1e0
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b506
test byte [eax + 0x1c], 1
je 0x101b506
push dword [ebp - 0x84]
push 0x10205a8
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x67
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024799
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b778
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0101a9e7
add esp, 0x10
lea ecx, [ebp - 0x44]
call fcn.01017299
mov eax, dword [ebp - 0x84]
or eax, 0x80010000
jmp 0x1017267
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b597
test byte [eax + 0x1c], 1
je 0x101b597
push dword [ebp - 0x84]
push 0x10205a8
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push dword [ebp - 0x84]
mov dword [ebp - 0x90], 0x68
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024799
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b778
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0101a9e7
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.010172f9
jmp 0x101b555
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b618
test byte [eax + 0x1c], 1
je 0x101b618
push ebx
push 0x10205a8
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov dword [ebp - 0x90], 0x69
push ebx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024799
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b778
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0101a9e7
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.010172f9
lea ecx, [ebp - 0x44]
call fcn.01017299
mov eax, ebx
jmp 0x101b563
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b69e
test byte [eax + 0x1c], 1
je 0x101b69e
push ebx
push 0x10205a8
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov dword [ebp - 0x90], 0x6a
jmp 0x101b622
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b6d2
test byte [eax + 0x1c], 1
je 0x101b6d2
push ebx
push 0x10205a8
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
push ebx
mov dword [ebp - 0x90], 0x6b
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
call fcn.01024799
mov dword [ebp - 0x9c], eax
push edi
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x101b778
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], edi
call fcn.0101a9e7
add esp, 0x10
lea ecx, [ebp - 0x80]
call fcn.010172f9
lea ecx, [ebp - 0x44]
call fcn.01017299
jmp 0x101b2d2
mov eax, dword [0x1049104]
cmp eax, 0x1049104
je 0x101b756
test byte [eax + 0x1c], 1
je 0x101b756
push ebx
push 0x10205a8
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010245cc
mov dword [ebp - 0x90], 0x6c
jmp 0x101b622