Function at 0x164f01520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4d8
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r15, rcx
mov r14d, dword [r11 + 0x10]
mov dword [r11 - 0x148], r14d
mov rbx, qword [r11 + 0x18]
mov r12d, dword [r11 + 0x20]
mov dword [r11 - 0x140], r12d
xor esi, esi
mov dword [rsp + 0x20], 0x42413441
mov dword [rsp + 0x24], 0x43323237
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x22
lea rcx, [rsp + 0x68]
call fcn.164e47a70
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.164e47510
nop
lea rcx, [rsp + 0xf0]
call fcn.164f0fec0
lea rdx, [0x1650baca0]
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.164f232a0
lea rdx, [0x1650bb5bc]
mov rcx, rax
call fcn.164ea21e0
lea rdx, [0x1650bb5c0]
test rbx, rbx
cmovne rdx, rbx
mov rcx, rax
call fcn.164e47850
lea rdx, [0x1650bb7d8]
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rsp + 0x3c8]
mov rcx, rax
call fcn.164f232a0
lea rdx, [0x1650afd70]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0xf0]
call fcn.164e47630
nop
mov edx, r14d
mov rcx, r15
call fcn.164f03e70
test al, al
jne 0x164f01718
mov dword [rsp + 0x20], 0x42413441
mov dword [rsp + 0x24], 0x43323237
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x20
lea rcx, [rsp + 0x68]
call fcn.164e47a70
lea r9, [rsp + 0x30]
lea r8d, [rsi + 2]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.164e47510
nop
lea rdx, str.Process
lea rcx, [rsp + 0xf0]
call fcn.164ea21e0
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.164f232a0
lea rdx, str._is_not_trusted.
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0xf0]
call fcn.164e47630
xor eax, eax
jmp 0x164f01b67
test rbx, rbx
je 0x164f01adf
cmp word [rbx], 0
je 0x164f01adf
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x88], xmm1
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x164f01750
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.164e485e0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb0]
call fcn.164f24550
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x400]
call fcn.164efaec0
nop
lea rcx, [rsp + 0xb0]
call fcn.164e54bf0
nop
lea rcx, [rsp + 0x78]
call fcn.164e54bf0
lea rdx, [rsp + 0x448]
lea rcx, [rsp + 0x3e0]
call fcn.164e539c0
mov qword [rsp + 0x3b0], rsi
lea rcx, [rsp + 0x3e0]
cmp qword [rsp + 0x3f8], 7
cmova rcx, qword [rsp + 0x3e0]
lea rdx, [rsp + 0x3b0]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
test eax, eax
je 0x164f017fb
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x164f01803
mov rsi, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x3e0]
call fcn.164e54bf0
mov qword [rsp + 0x3b8], rsi
test rsi, rsi
jne 0x164f01909
mov dword [rsp + 0x20], 0x42413441
mov dword [rsp + 0x24], 0x43323237
mov dword [rsp + 0x30], 0x6e657665
mov dword [rsp + 0x34], 0x5f725f74
mov dword [rsp + 0x38], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x20
lea rcx, [rsp + 0x68]
call fcn.164e47a70
lea r9, [rsp + 0x30]
lea r8d, [rsi + 2]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.164e47510
nop
lea rdx, str.CreateBinding_for
lea rcx, [rsp + 0xf0]
call fcn.164ea21e0
lea rdx, [rsp + 0x448]
mov rcx, rax
call fcn.164ea2220
lea rdx, [0x1650bb7a0]
mov rcx, rax
call fcn.164ea21e0
nop
lea rcx, [rsp + 0xf0]
call fcn.164e47630
nop
lea rcx, [rsp + 0x488]
call fcn.164e54bf0
lea rcx, [rsp + 0x468]
call fcn.164e54bf0
lea rcx, [rsp + 0x448]
call fcn.164e54bf0
lea rcx, [rsp + 0x428]
call fcn.164e54bf0
lea rcx, [rsp + 0x408]
call fcn.164e54bf0
xor eax, eax
jmp 0x164f01b67
mov byte [rsp + 0x3d0], 0
lea rax, [rsp + 0x3b8]
mov qword [rsp + 0x3d8], rax
mov edx, r12d
mov rcx, rsi
call fcn.164f28de0
test al, al
jne 0x164f01a04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x20], 0x42413441
mov dword [rsp + 0x24], 0x43323237
mov dword [rsp + 0x48], 0x6e657665
mov dword [rsp + 0x4c], 0x5f725f74
mov dword [rsp + 0x50], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 0x20
lea rcx, [rsp + 0x20]
call fcn.164e47a70
lea r9, [rsp + 0x48]
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.164e47510
nop
lea rcx, [rsp + 0x250]
call fcn.164f0ff10
lea rdx, [rsp + 0x448]
mov rcx, rax
call fcn.164ea2220
lea rdx, str.__PID
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rsp + 0x3c0]
mov rcx, rax
call fcn.164f232a0
lea rdx, str._failed._Error
mov rcx, rax
call fcn.164ea21e0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.164f232a0
nop
lea rcx, [rsp + 0x250]
call fcn.164e47630
lea rdx, [rsp + 0xa0]
mov rcx, r15
call fcn.164f06430
nop
mov r8d, r14d
lea rdx, [rsp + 0x400]
mov rcx, qword [rax]
call fcn.164f46b00
mov rsi, rax
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x164f01a6e
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x164f01a6e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x164e9d7b8.0]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x164f01a6e
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x164e9d7b8.0]
nop
cmp byte [rsp + 0x3d0], 0
jne 0x164f01a96
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x3b0], rax
lea rcx, [rsp + 0x3b0]
call fcn.164ef6650
nop
lea rcx, [rsp + 0x488]
call fcn.164e54bf0
lea rcx, [rsp + 0x468]
call fcn.164e54bf0
lea rcx, [rsp + 0x448]
call fcn.164e54bf0
lea rcx, [rsp + 0x428]
call fcn.164e54bf0
lea rcx, [rsp + 0x408]
call fcn.164e54bf0
mov rax, rsi
jmp 0x164f01b67
mov dword [rsp + 0x20], 0x42413441
mov dword [rsp + 0x24], 0x43323237
mov dword [rsp + 0x48], 0x6e657665
mov dword [rsp + 0x4c], 0x5f725f74
mov dword [rsp + 0x50], 0x637072
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 0x20
lea rcx, [rsp + 0x68]
call fcn.164e47a70
lea r9, [rsp + 0x48]
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.164e47510
nop
lea rdx, str.Client_endpoint_name_is_empty.
lea rcx, [rsp + 0x250]
call fcn.164ea21e0
nop
lea rcx, [rsp + 0x250]
call fcn.164e47630
xor eax, eax
jmp 0x164f01b67
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.165001080
add rsp, 0x4d8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret