How exactly does rpcclient obtain its information?

If I ran rpcclient -N -c lsaquery, assuming null sessions are enabled, and I get a reply; what exactly has happened?

msrpc and smb share a lot of functionality, but Im unsure as to what exactly rpcclient is doing. Is it connecting to 135? or is it going via smb? Is it binding to a named pipe, presumably lsarpc?

If theres anyone that can provide a good resource, I've read a bunch of things from Microsoft but they aren't really explaining it indepth, I would greatly appreciate it :)

​

Edit: This post goes through a lot of different enumeration via rpcclient.