// https://github.com/silverf0x/RpcView/blob/14d5e1a3b6cc02196dabdcf668ea341129b36be0/RpcCore/RpcCore.c#L387
RpcProcessInfo_T* __fastcall RpcCoreGetProcessInfo(void* pRpcCoreCtxt,DWORD Pid,DWORD Ppid,ULONG ProcessInfoMask)
{
	SHFILEINFOW				ShFileInfo;
	HANDLE					hProcess;
	VOID PTR_T				pRpcServer;
	RPC_SERVER_T			RpcServer;
	RpcProcessInfo_T*		pRpcProcessInfo=NULL;
	RpcCoreInternalCtxt_T*	pRpcCoreInternalCtxt=(RpcCoreInternalCtxt_T*)pRpcCoreCtxt;

	pRpcProcessInfo=(RpcProcessInfo_T*)OS_ALLOC(sizeof(RpcProcessInfo_T));
	if (pRpcProcessInfo==NULL) return (NULL);
	//
	// Process minimal info
	//
	pRpcProcessInfo->Pid			= Pid;
	pRpcProcessInfo->ParentPid		= Ppid;
	pRpcProcessInfo->RpcProcessType = RpcProcessType_UNKNOWN;

	hProcess=ProcexpOpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION,FALSE,Pid);
	if (hProcess!=NULL)
	{
#ifdef _WIN64
	IsWow64Process(hProcess, &pRpcProcessInfo->bIsWow64);
#endif
	}
	//
	// Process general information
	//
	if (ProcessInfoMask & RPC_PROCESS_INFO_MISC)
	{
		GetProcessNameFromPid(Pid,pRpcProcessInfo->Name,sizeof(pRpcProcessInfo->Name));	
		GetProcessPath(Pid,pRpcProcessInfo->Path,sizeof(pRpcProcessInfo->Path));
		pRpcProcessInfo->Version=GetModuleVersion(pRpcProcessInfo->Path);
		GetModuleDescription(pRpcProcessInfo->Path,pRpcProcessInfo->Description,sizeof(pRpcProcessInfo->Description));
		GetUserAndDomainName(pRpcProcessInfo->Pid,pRpcProcessInfo->User,sizeof(pRpcProcessInfo->User));
		GetProcessPebInfo(hProcess,pRpcProcessInfo->CmdLine,sizeof(pRpcProcessInfo->CmdLine),pRpcProcessInfo->Desktop,sizeof(pRpcProcessInfo->Desktop));
		// Get icon
		if (hProcess!=NULL)
		{
			ZeroMemory(&ShFileInfo,sizeof(ShFileInfo));
			if (SHGetFileInfoW(pRpcProcessInfo->Path,0,&ShFileInfo,sizeof(ShFileInfo),SHGFI_ICON|SHGFI_LARGEICON))
			{
				pRpcProcessInfo->hIcon=ShFileInfo.hIcon;
			}
		}
	}
	//
	// Process RPC information
	//
	if (ProcessInfoMask & RPC_PROCESS_INFO_RPC)
	{
		if (pRpcCoreInternalCtxt->pGlobalRpcServer==NULL)
		{
			GetRpcServerAddressInProcess(pRpcProcessInfo->Pid,pRpcCoreInternalCtxt);
			if (pRpcCoreInternalCtxt->pGlobalRpcServer==NULL) goto End;
		}
		if (!ReadProcessMemory(hProcess,pRpcCoreInternalCtxt->pGlobalRpcServer,&pRpcServer,sizeof(VOID PTR_T),NULL)) goto End;
		if (!ReadProcessMemory(hProcess,pRpcServer,&RpcServer,sizeof(RpcServer),NULL)) goto End;

		//If the number of endpoints is correct we have a RPC server
		if (RpcServer.AddressDict.NumberOfEntries!=0)
		{
			pRpcProcessInfo->RpcProcessType		= GetProcessType(hProcess,&RpcServer);
			pRpcProcessInfo->bIsServer			= TRUE;
			pRpcProcessInfo->EndpointsCount		= RpcServer.AddressDict.NumberOfEntries;
			pRpcProcessInfo->SspCount			= RpcServer.AuthenInfoDict.NumberOfEntries;
			pRpcProcessInfo->InterfacesCount	= RpcServer.InterfaceDict.NumberOfEntries;
			pRpcProcessInfo->InCalls			= RpcServer.InCalls;
			pRpcProcessInfo->OutCalls			= RpcServer.OutCalls;
			pRpcProcessInfo->InPackets			= RpcServer.InPackets;
			pRpcProcessInfo->OutPackets			= RpcServer.OutPackets;
			pRpcProcessInfo->bIsListening		= RpcServer.bIsListening;
			pRpcProcessInfo->MaxCalls			= RpcServer.MaxCalls;
		}
	}
End:
	if (hProcess!=NULL) CloseHandle(hProcess);
	return (pRpcProcessInfo);
}

// https://github.com/silverf0x/RpcView/blob/master/RpcCore/RpcCore.c#L210
BOOL WINAPI GetRpcServerAddressInProcess(DWORD Pid,RpcCoreInternalCtxt_T* pRpcCoreInternalCtxt)
{
	VOID PTR_T PTR_T					pCandidate;
	VOID PTR_T							pRpcServer;
	RPC_SERVER_T						RpcServer;
	ModuleSectionInfo_T					ModuleSectionInfo;
	HANDLE								hProcess = NULL;
	GetRpcServerAddressCallbackCtxt_T	GetRpcServerAddressCallbackCtxt;
	DWORD								cbSize;
	HMODULE*							pHmodule = NULL;
	CHAR								ModuleFileName[MAX_PATH];
	BOOL								bResult=FALSE;

	hProcess = ProcexpOpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
	if (hProcess == NULL) goto End;

    if (!EnumProcessModulesEx(hProcess, NULL, 0, &cbSize, LIST_MODULES_ALL)) goto End;
	pHmodule = (HMODULE*)malloc(cbSize);
    if (pHmodule == NULL) goto End;
    if (!EnumProcessModulesEx(hProcess, pHmodule, cbSize, &cbSize, LIST_MODULES_ALL)) goto End;

	for(ULONG i=0;i<cbSize/sizeof(*pHmodule);i++)
	{
		ModuleFileName[0] = 0;
		GetModuleFileNameExA(hProcess, pHmodule[i], ModuleFileName, sizeof(ModuleFileName));
		if (strstr(ModuleFileName,"RPCRT4.dll")==NULL) goto NextModule;

		if (!GetModuleDataSection(hProcess, pHmodule[i], &ModuleSectionInfo)) goto End;
#pragma warning(push)
#pragma warning(disable:4305)
		pCandidate=(VOID PTR_T PTR_T)ModuleSectionInfo.pBase;
#pragma warning(pop)
        GetRpcServerAddressCallbackCtxt.bFound=FALSE;
		
		for (i=0; i<ModuleSectionInfo.Size; i+=sizeof(VOID PTR_T))
		{
			if (!ReadProcessMemory(hProcess,pCandidate,&pRpcServer,sizeof(VOID PTR_T),NULL))	goto NextCandidate;
			if (!ReadProcessMemory(hProcess,pRpcServer,&RpcServer,sizeof(RpcServer),NULL))		goto NextCandidate;
            GetRpcServerAddressCallbackCtxt.pRpcServer = pRpcServer;
			if (!EnumSimpleDict(hProcess,&RpcServer.InterfaceDict,&GetRpcServerAddressCallback,&GetRpcServerAddressCallbackCtxt)) goto End;
			if (GetRpcServerAddressCallbackCtxt.bFound==TRUE)
			{
				_cprintf("gRpcServer localized at address %p in process %u\n",pCandidate,Pid);
				pRpcCoreInternalCtxt->pGlobalRpcServer=pCandidate;
				bResult=TRUE;
				break;
			}
NextCandidate:		
			pCandidate++;
		}
		CloseHandle(hProcess);
		hProcess=NULL;
		goto End;
NextModule: ;
	}
End:
	if (hProcess!=NULL) CloseHandle(hProcess);
	if (pHmodule !=NULL) free(pHmodule);
	return (bResult);
}

// https://github.com/silverf0x/RpcView/blob/14d5e1a3b6cc02196dabdcf668ea341129b36be0/RpcView/RpcCoreManager.c#L254
BOOL __fastcall	RpcCoreEnumProcessEndpoints(void* pRpcCoreCtxt,DWORD Pid,RpcCoreEnumProcessEndpointsCallbackFn_T RpcCoreEnumProcessEndpointsCallbackFn,void* pCallbackCtxt)
{
	HANDLE					hProcess;
	BOOL					bResult=FALSE;
	RPC_SERVER_T			RpcServer;
	UINT					i;
	UINT					Size;
	VOID PTR_T *			pTable=NULL;
	VOID PTR_T				pRpcServer;
	RPC_ADDRESS_T			RpcAddress;
	WCHAR					ProtocoleW[RPC_MAX_ENDPOINT_PROTOCOL_SIZE];
	WCHAR					NameW[RPC_MAX_ENDPOINT_NAME_SIZE];
	RpcEndpointInfo_T		RpcEndpointInfo;
	BOOL					bContinue=TRUE;
	RpcCoreInternalCtxt_T*	pRpcCoreInternalCtxt=(RpcCoreInternalCtxt_T*)pRpcCoreCtxt;

	hProcess=ProcexpOpenProcess(PROCESS_VM_READ,FALSE,Pid);
	if (hProcess==NULL) goto End;

	if (!ReadProcessMemory(hProcess,pRpcCoreInternalCtxt->pGlobalRpcServer,&pRpcServer,sizeof(VOID PTR_T),NULL)) goto End;
	if (!ReadProcessMemory(hProcess,pRpcServer,&RpcServer,sizeof(RpcServer),NULL)) goto End;

	if (RpcServer.AddressDict.NumberOfEntries > MAX_SIMPLE_DICT_ENTRIES)
	{
		goto End;
	}

	Size=RpcServer.AddressDict.NumberOfEntries*sizeof(VOID PTR_T);
	pTable=(VOID PTR_T *)OS_ALLOC(Size);
	if (pTable==NULL) goto End;

	if (!ReadProcessMemory(hProcess,RpcServer.AddressDict.pArray,pTable,Size,NULL)) goto End;
	for (i=0; i<RpcServer.AddressDict.NumberOfEntries; i++)
	{
		if (!ReadProcessMemory(hProcess,pTable[i],&RpcAddress,sizeof(RpcAddress),NULL)) goto End;
		if (!ReadProcessMemory(hProcess,RpcAddress.Protocole,ProtocoleW,sizeof(ProtocoleW),NULL)) goto End;
		if (!ReadProcessMemory(hProcess,RpcAddress.Name,NameW,sizeof(NameW),NULL)) goto End;
		RpcEndpointInfo.pName		= NameW;
		RpcEndpointInfo.pProtocole	= ProtocoleW;
		bResult=RpcCoreEnumProcessEndpointsCallbackFn(Pid,&RpcEndpointInfo,pCallbackCtxt,&bContinue);
		if (!bResult) goto End;
		if (!bContinue) break;
	}
	bResult=TRUE;
End:
	if (hProcess!=NULL) CloseHandle(hProcess);
	if (pTable!=NULL)	OS_FREE(pTable);
	return (bResult);
}

RpcInterfaceInfo_T*	__fastcall RpcCoreGetInterfaceInfo(void* pRpcCoreCtxt, DWORD Pid, RPC_IF_ID* pIf, ULONG InterfaceInfoMask);

	if (!VerQueryValueW(pData, L"\\VarFileInfo\\Translation", (LPVOID*)&lpTranslate,&cbTranslate)) goto End;
	//
	// Read the file description for each language and code page.
	//
	for(i=0; i < (cbTranslate/sizeof(LanguageCodePage_T)); i++)
	{
		StringCbPrintfW(SubBlock,sizeof(SubBlock),L"\\StringFileInfo\\%04x%04x\\FileDescription",lpTranslate[i].wLanguage,lpTranslate[i].wCodePage);
		//
		// Retrieve file description for language and code page "i". 
		//
		if (VerQueryValueW(pData,SubBlock,(LPVOID*)&lpBuffer,&Size))
		{
			StringCbPrintfW(pDescription,Bytes,L"%s",lpBuffer);
			break;
		}
	}