Function at 0x1400ea9f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4d8
mov rax, qword [0x1402bf200]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r15, rcx
mov r14d, dword [r11 + 0x10]
mov dword [r11 - 0x148], r14d
mov rbx, qword [r11 + 0x18]
mov r12d, dword [r11 + 0x20]
mov dword [r11 - 0x140], r12d
xor esi, esi
mov dword [rsp + 0x20], 0x44333635
mov dword [rsp + 0x24], 0x33363738
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x22
lea rcx, [rsp + 0x68]
call fcn.140026d50
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140025780
nop
lea rcx, [rsp + 0xf0]
call fcn.1400f9440
lea rdx, [0x140253a20]
mov rcx, rax
call fcn.14003e030
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.1400093e0
lea rdx, [0x1402542fc]
mov rcx, rax
call fcn.14003e030
lea rdx, [0x140254300]
test rbx, rbx
cmovne rdx, rbx
mov rcx, rax
call fcn.140028820
lea rdx, [0x14025430c]
mov rcx, rax
call fcn.14003e030
lea rdx, [rsp + 0x3c8]
mov rcx, rax
call fcn.1400093e0
lea rdx, [0x14023cf20]
mov rcx, rax
call fcn.14003e030
nop
lea rcx, [rsp + 0xf0]
call fcn.140028440
nop
mov edx, r14d
mov rcx, r15
call fcn.1400ed340
test al, al
jne 0x1400eabe8
mov dword [rsp + 0x20], 0x44333635
mov dword [rsp + 0x24], 0x33363738
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x20
lea rcx, [rsp + 0x68]
call fcn.140026d50
lea r9, [rsp + 0x30]
lea r8d, [rsi + 2]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140025780
nop
lea rdx, str.Process
lea rcx, [rsp + 0xf0]
call fcn.14003e030
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.1400093e0
lea rdx, str._is_not_trusted.
mov rcx, rax
call fcn.14003e030
nop
lea rcx, [rsp + 0xf0]
call fcn.140028440
xor eax, eax
jmp 0x1400eb037
test rbx, rbx
je 0x1400eafaf
cmp word [rbx], 0
je 0x1400eafaf
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x88], xmm1
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400eac20
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14002a920
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb0]
call fcn.14010b1b0
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.1400e43f0
nop
lea rcx, [rsp + 0xb0]
call fcn.14002adf0
nop
lea rcx, [rsp + 0x78]
call fcn.14002adf0
lea rdx, [rsp + 0x448]
lea rcx, [rsp + 0x3e0]
call fcn.140024420
mov qword [rsp + 0x3b0], rsi
lea rcx, [rsp + 0x3e0]
cmp qword [rsp + 0x3f8], 7
cmova rcx, qword [rsp + 0x3e0]
lea rdx, [rsp + 0x3b0]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
test eax, eax
je 0x1400eaccb
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400eacd3
mov rsi, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x3e0]
call fcn.14002adf0
mov qword [rsp + 0x3b8], rsi
test rsi, rsi
jne 0x1400eadd9
mov dword [rsp + 0x20], 0x44333635
mov dword [rsp + 0x24], 0x33363738
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x20
lea rcx, [rsp + 0x68]
call fcn.140026d50
lea r9, [rsp + 0x30]
lea r8d, [rsi + 2]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140025780
nop
lea rdx, str.CreateBinding_for
lea rcx, [rsp + 0xf0]
call fcn.14003e030
lea rdx, [rsp + 0x448]
mov rcx, rax
call fcn.14002a020
lea rdx, [0x140254508]
mov rcx, rax
call fcn.14003e030
nop
lea rcx, [rsp + 0xf0]
call fcn.140028440
nop
lea rcx, [rsp + 0x488]
call fcn.14002adf0
lea rcx, [rsp + 0x468]
call fcn.14002adf0
lea rcx, [rsp + 0x448]
call fcn.14002adf0
lea rcx, [rsp + 0x428]
call fcn.14002adf0
lea rcx, [rsp + 0x408]
call fcn.14002adf0
xor eax, eax
jmp 0x1400eb037
mov byte [rsp + 0x3d0], 0
lea rax, [rsp + 0x3b8]
mov qword [rsp + 0x3d8], rax
mov edx, r12d
mov rcx, rsi
call fcn.14010f9f0
test al, al
jne 0x1400eaed4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x20], 0x44333635
mov dword [rsp + 0x24], 0x33363738
mov dword [rsp + 0x48], 0x6e657665
mov dword [rsp + 0x4c], 0x5f725f74
mov dword [rsp + 0x50], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 0x20
lea rcx, [rsp + 0x20]
call fcn.140026d50
lea r9, [rsp + 0x48]
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140025780
nop
lea rcx, [rsp + 0x250]
call fcn.1400f9490
lea rdx, [rsp + 0x448]
mov rcx, rax
call fcn.14002a020
lea rdx, str.__PID
mov rcx, rax
call fcn.14003e030
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.1400093e0
lea rdx, str._failed._Error
mov rcx, rax
call fcn.14003e030
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400093e0
nop
lea rcx, [rsp + 0x250]
call fcn.140028440
lea rdx, [rsp + 0xa0]
mov rcx, r15
call fcn.1400ef900
nop
mov r8d, r14d
lea rdx, [rsp + 0x400]
mov rcx, qword [rax]
call fcn.14012d700
mov rsi, rax
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1400eaf3e
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400eaf3e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400617cf.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400eaf3e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400617cf.0]
nop
cmp byte [rsp + 0x3d0], 0
jne 0x1400eaf66
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x3b0], rax
lea rcx, [rsp + 0x3b0]
call fcn.1400dfff0
nop
lea rcx, [rsp + 0x488]
call fcn.14002adf0
lea rcx, [rsp + 0x468]
call fcn.14002adf0
lea rcx, [rsp + 0x448]
call fcn.14002adf0
lea rcx, [rsp + 0x428]
call fcn.14002adf0
lea rcx, [rsp + 0x408]
call fcn.14002adf0
mov rax, rsi
jmp 0x1400eb037
mov dword [rsp + 0x20], 0x44333635
mov dword [rsp + 0x24], 0x33363738
mov dword [rsp + 0x48], 0x6e657665
mov dword [rsp + 0x4c], 0x5f725f74
mov dword [rsp + 0x50], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 0x20
lea rcx, [rsp + 0x68]
call fcn.140026d50
lea r9, [rsp + 0x48]
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140025780
nop
lea rdx, str.Client_endpoint_name_is_empty.
lea rcx, [rsp + 0x250]
call fcn.14003e030
nop
lea rcx, [rsp + 0x250]
call fcn.140028440
xor eax, eax
jmp 0x1400eb037
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.14019acb0
add rsp, 0x4d8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret