Function at 0x180030d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x828
mov qword [rsp + 0x7b8], 0xfffffffffffffffe
mov rax, qword [0x1800c34c8]
xor rax, rsp
mov qword [rsp + 0x810], rax
lea r8, [0x1800a1750]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rsp + 0x4d0], rax
cmp qword [rsp + 0x4d0], 0
je 0x180030dcd
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x290]
call fcn.18002f7c0
nop
mov word [rsp + 0x278], 0
mov word [rsp + 0x270], 0
mov word [rsp + 0x268], 0
mov word [rsp + 0x260], 0
mov word [rsp + 0x258], 0
mov word [rsp + 0x250], 0
mov word [rsp + 0x248], 0
mov word [rsp + 0x240], 0
mov word [rsp + 0x238], 0
mov word [rsp + 0x230], 0
mov word [rsp + 0x228], 0
mov word [rsp + 0x220], 0
mov word [rsp + 0x218], 0
mov word [rsp + 0x210], 0
mov word [rsp + 0x208], 0
mov word [rsp + 0x200], 0
mov word [rsp + 0x1f8], 0
mov word [rsp + 0x1f0], 0
mov word [rsp + 0x1e8], 0
mov word [rsp + 0x1e0], 0
mov word [rsp + 0x1d8], 0
mov word [rsp + 0x1d0], 0
mov word [rsp + 0x1c8], 0
mov word [rsp + 0x1c0], 0
mov word [rsp + 0x1b8], 0
mov word [rsp + 0x1b0], 0
mov word [rsp + 0x1a8], 0
mov word [rsp + 0x1a0], 0
mov word [rsp + 0x198], 0
mov word [rsp + 0x190], 0
mov word [rsp + 0x188], 0
mov word [rsp + 0x180], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x170], 0
mov word [rsp + 0x168], 0
mov word [rsp + 0x160], 0
mov word [rsp + 0x158], 0
mov word [rsp + 0x150], 0
mov word [rsp + 0x148], 0
mov word [rsp + 0x140], 0
mov word [rsp + 0x138], 0
mov word [rsp + 0x130], 0
mov word [rsp + 0x128], 0
mov word [rsp + 0x120], 0
mov word [rsp + 0x118], 0
mov word [rsp + 0x110], 0
mov word [rsp + 0x108], 0
mov word [rsp + 0x100], 0
mov word [rsp + 0xf8], 0
mov word [rsp + 0xf0], 0
mov word [rsp + 0xe8], 0
mov word [rsp + 0xe0], 0
mov word [rsp + 0xd8], 0
mov word [rsp + 0xd0], 0
mov word [rsp + 0xc8], 0
mov word [rsp + 0xc0], 0
mov word [rsp + 0xb8], 0
mov word [rsp + 0xb0], 0
mov word [rsp + 0xa8], 0
mov word [rsp + 0xa0], WSACleanup
mov word [rsp + 0x98], 0x65
mov word [rsp + 0x90], WSASetLastError
mov word [rsp + 0x88], 0x64
mov word [rsp + 0x80], WSASetLastError
mov word [rsp + 0x78], 0x61
mov word [rsp + 0x70], 0x48
mov word [rsp + 0x68], WSASetLastError
mov word [rsp + 0x60], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x58], 0x61
mov word [rsp + 0x50], 0x54
mov word [rsp + 0x48], WSASetLastError
mov word [rsp + 0x40], 0x63
mov word [rsp + 0x38], 0x65
mov word [rsp + 0x30], 0x68
mov word [rsp + 0x28], 0x43
mov word [rsp + 0x20], 0x66
mov r9w, WSASetLastError
mov r8w, 0x65
mov dx, 0x53
lea rcx, [rsp + 0x4d8]
call fcn.18002ebd0
mov qword [rsp + 0x7c0], rax
mov rax, qword [rsp + 0x7c0]
mov qword [rsp + 0x7c8], rax
mov rcx, qword [rsp + 0x7c8]
call fcn.180011f90
mov rdx, rax
lea rcx, [rsp + 0x330]
call fcn.180015800
nop
lea rcx, [rsp + 0x4d8]
call fcn.180011f30
mov word [rsp + 0x278], 0
mov word [rsp + 0x270], 0
mov word [rsp + 0x268], 0
mov word [rsp + 0x260], 0
mov word [rsp + 0x258], 0
mov word [rsp + 0x250], 0
mov word [rsp + 0x248], 0
mov word [rsp + 0x240], 0
mov word [rsp + 0x238], 0
mov word [rsp + 0x230], 0
mov word [rsp + 0x228], 0
mov word [rsp + 0x220], 0
mov word [rsp + 0x218], 0
mov word [rsp + 0x210], 0
mov word [rsp + 0x208], 0
mov word [rsp + 0x200], 0
mov word [rsp + 0x1f8], 0
mov word [rsp + 0x1f0], 0
mov word [rsp + 0x1e8], 0
mov word [rsp + 0x1e0], 0
mov word [rsp + 0x1d8], 0
mov word [rsp + 0x1d0], 0
mov word [rsp + 0x1c8], 0
mov word [rsp + 0x1c0], 0
mov word [rsp + 0x1b8], 0
mov word [rsp + 0x1b0], 0
mov word [rsp + 0x1a8], 0
mov word [rsp + 0x1a0], 0
mov word [rsp + 0x198], 0
mov word [rsp + 0x190], 0
mov word [rsp + 0x188], 0
mov word [rsp + 0x180], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x170], 0
mov word [rsp + 0x168], 0
mov word [rsp + 0x160], 0
mov word [rsp + 0x158], 0
mov word [rsp + 0x150], 0
mov word [rsp + 0x148], 0
mov word [rsp + 0x140], 0
mov word [rsp + 0x138], 0
mov word [rsp + 0x130], 0
mov word [rsp + 0x128], 0
mov word [rsp + 0x120], 0
mov word [rsp + 0x118], 0
mov word [rsp + 0x110], 0
mov word [rsp + 0x108], WSASetLastError
mov word [rsp + 0x100], 0x63
mov word [rsp + 0xf8], 0x65
mov word [rsp + 0xf0], WSASetLastError
mov word [rsp + 0xe8], 0x43
mov word [rsp + 0xe0], WSAGetLastError
mov word [rsp + 0xd8], WSASetLastError
mov word [rsp + 0xd0], 0x65
mov word [rsp + 0xc8], 0x53
mov word [rsp + 0xc0], 0x5c
mov word [rsp + 0xb8], WSASetLastError
mov word [rsp + 0xb0], 0x63
mov word [rsp + 0xa8], 0x65
mov word [rsp + 0xa0], WSASetLastError
mov word [rsp + 0x98], 0x43
mov word [rsp + 0x90], 0x5c
mov word [rsp + 0x88], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x80], 0x77
mov word [rsp + 0x78], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x70], 0x64
mov word [rsp + 0x68], WSASetLastError
mov word [rsp + 0x60], WSAGetLastError
mov word [rsp + 0x58], 0x57
mov word [rsp + 0x50], 0x5c
mov word [rsp + 0x48], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x40], 0x66
mov word [rsp + 0x38], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x30], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x20], WSACleanup
mov r9w, 0x63
mov r8w, 0x69
mov dx, Ordinal_79
lea rcx, [rsp + 0x500]
call fcn.18002ebd0
mov qword [rsp + 0x7d0], rax
mov rax, qword [rsp + 0x7d0]
mov qword [rsp + 0x7d8], rax
mov rcx, qword [rsp + 0x7d8]
call fcn.180011f90
mov rdx, rax
lea rcx, [rsp + 0x358]
call fcn.180015800
nop
lea rcx, [rsp + 0x500]
call fcn.180011f30
lea rdx, str.25F8A8CF_2F6D_4071_9176_CF2197F24ACB
lea rcx, [rsp + 0x2e0]
call fcn.180015800
lea rdx, str.71E33B86_6711_4ad5_9B32_BCE44C2B94C3
lea rcx, [rsp + 0x308]
call fcn.180015800
lea rax, [rsp + 0x528]
mov qword [rsp + 0x640], rax
lea rdx, [rsp + 0x290]
mov rcx, qword [rsp + 0x640]
call fcn.180026b10
mov qword [rsp + 0x7e0], rax
mov rdx, qword [rsp + 0x7e0]
mov rcx, qword [rsp + 0x830]
call fcn.180031bc0
lea rcx, [rsp + 0x3b0]
call fcn.18002f7c0
nop
mov word [rsp + 0x278], 0
mov word [rsp + 0x270], 0
mov word [rsp + 0x268], 0
mov word [rsp + 0x260], 0
mov word [rsp + 0x258], 0
mov word [rsp + 0x250], 0
mov word [rsp + 0x248], 0
mov word [rsp + 0x240], 0
mov word [rsp + 0x238], 0
mov word [rsp + 0x230], 0
mov word [rsp + 0x228], 0
mov word [rsp + 0x220], 0
mov word [rsp + 0x218], 0
mov word [rsp + 0x210], 0
mov word [rsp + 0x208], 0
mov word [rsp + 0x200], 0
mov word [rsp + 0x1f8], 0
mov word [rsp + 0x1f0], 0
mov word [rsp + 0x1e8], 0
mov word [rsp + 0x1e0], 0
mov word [rsp + 0x1d8], 0
mov word [rsp + 0x1d0], 0
mov word [rsp + 0x1c8], 0
mov word [rsp + 0x1c0], 0
mov word [rsp + 0x1b8], 0
mov word [rsp + 0x1b0], 0
mov word [rsp + 0x1a8], 0
mov word [rsp + 0x1a0], 0
mov word [rsp + 0x198], 0
mov word [rsp + 0x190], 0
mov word [rsp + 0x188], 0
mov word [rsp + 0x180], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x170], 0
mov word [rsp + 0x168], 0
mov word [rsp + 0x160], 0
mov word [rsp + 0x158], 0
mov word [rsp + 0x150], 0
mov word [rsp + 0x148], 0
mov word [rsp + 0x140], 0
mov word [rsp + 0x138], 0
mov word [rsp + 0x130], 0
mov word [rsp + 0x128], 0
mov word [rsp + 0x120], 0
mov word [rsp + 0x118], 0
mov word [rsp + 0x110], 0
mov word [rsp + 0x108], 0
mov word [rsp + 0x100], 0
mov word [rsp + 0xf8], 0
mov word [rsp + 0xf0], 0
mov word [rsp + 0xe8], 0
mov word [rsp + 0xe0], 0
mov word [rsp + 0xd8], 0
mov word [rsp + 0xd0], 0
mov word [rsp + 0xc8], 0
mov word [rsp + 0xc0], 0
mov word [rsp + 0xb8], 0
mov word [rsp + 0xb0], 0
mov word [rsp + 0xa8], 0
mov word [rsp + 0xa0], 0
mov word [rsp + 0x98], 0
mov word [rsp + 0x90], 0
mov word [rsp + 0x88], WSACleanup
mov word [rsp + 0x80], 0x65
mov word [rsp + 0x78], WSASetLastError
mov word [rsp + 0x70], 0x64
mov word [rsp + 0x68], WSASetLastError
mov word [rsp + 0x60], 0x61
mov word [rsp + 0x58], 0x48
mov word [rsp + 0x50], WSASetLastError
mov word [rsp + 0x48], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x40], 0x61
mov word [rsp + 0x38], 0x54
mov word [rsp + 0x30], 0x68
mov word [rsp + 0x28], 0x63
mov word [rsp + 0x20], 0x53
mov r9w, Ordinal_79
mov r8w, 0x50
mov dx, 0x54
lea rcx, [rsp + 0x648]
call fcn.18002ebd0
mov qword [rsp + 0x7e8], rax
mov rax, qword [rsp + 0x7e8]
mov qword [rsp + 0x7f0], rax
mov rcx, qword [rsp + 0x7f0]
call fcn.180011f90
mov rdx, rax
lea rcx, [rsp + 0x450]
call fcn.180015800
nop
lea rcx, [rsp + 0x648]
call fcn.180011f30
mov word [rsp + 0x278], 0
mov word [rsp + 0x270], 0
mov word [rsp + 0x268], 0
mov word [rsp + 0x260], 0
mov word [rsp + 0x258], 0
mov word [rsp + 0x250], 0
mov word [rsp + 0x248], 0
mov word [rsp + 0x240], 0
mov word [rsp + 0x238], 0
mov word [rsp + 0x230], 0
mov word [rsp + 0x228], 0
mov word [rsp + 0x220], 0
mov word [rsp + 0x218], 0
mov word [rsp + 0x210], 0
mov word [rsp + 0x208], 0
mov word [rsp + 0x200], 0
mov word [rsp + 0x1f8], 0
mov word [rsp + 0x1f0], 0
mov word [rsp + 0x1e8], 0
mov word [rsp + 0x1e0], 0
mov word [rsp + 0x1d8], 0
mov word [rsp + 0x1d0], 0
mov word [rsp + 0x1c8], 0
mov word [rsp + 0x1c0], 0
mov word [rsp + 0x1b8], 0
mov word [rsp + 0x1b0], 0
mov word [rsp + 0x1a8], 0
mov word [rsp + 0x1a0], 0
mov word [rsp + 0x198], 0
mov word [rsp + 0x190], 0
mov word [rsp + 0x188], 0
mov word [rsp + 0x180], 0
mov word [rsp + 0x178], 0
mov word [rsp + 0x170], 0
mov word [rsp + 0x168], 0
mov word [rsp + 0x160], 0
mov word [rsp + 0x158], 0
mov word [rsp + 0x150], 0
mov word [rsp + 0x148], 0
mov word [rsp + 0x140], 0
mov word [rsp + 0x138], 0
mov word [rsp + 0x130], 0
mov word [rsp + 0x128], 0
mov word [rsp + 0x120], 0
mov word [rsp + 0x118], 0
mov word [rsp + 0x110], 0
mov word [rsp + 0x108], WSASetLastError
mov word [rsp + 0x100], 0x63
mov word [rsp + 0xf8], 0x53
mov word [rsp + 0xf0], Ordinal_79
mov word [rsp + 0xe8], 0x50
mov word [rsp + 0xe0], 0x54
mov word [rsp + 0xd8], 0x5c
mov word [rsp + 0xd0], WSASetLastError
mov word [rsp + 0xc8], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0xc0], WSASetLastError
mov word [rsp + 0xb8], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0xb0], 0x61
mov word [rsp + 0xa8], 0x63
mov word [rsp + 0xa0], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x98], Ordinal_79
mov word [rsp + 0x90], 0x5c
mov word [rsp + 0x88], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x80], 0x77
mov word [rsp + 0x78], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x70], 0x64
mov word [rsp + 0x68], WSASetLastError
mov word [rsp + 0x60], WSAGetLastError
mov word [rsp + 0x58], 0x57
mov word [rsp + 0x50], 0x5c
mov word [rsp + 0x48], reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x40], 0x66
mov word [rsp + 0x38], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x30], reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x20], WSACleanup
mov r9w, 0x63
mov r8w, 0x69
mov dx, Ordinal_79
lea rcx, [rsp + 0x670]
call fcn.18002ebd0
mov qword [rsp + 0x7f8], rax
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x800], rax
mov rcx, qword [rsp + 0x800]
call fcn.180011f90
mov rdx, rax
lea rcx, [rsp + 0x478]
call fcn.180015800
nop
lea rcx, [rsp + 0x670]
call fcn.180011f30
lea rdx, str.8CDB0EAC_9336_4851_8E96_74CD9150012A
lea rcx, [rsp + 0x400]
call fcn.180015800
lea rdx, str.C1481322_B510_4d5b_8C23_D4007D453009
lea rcx, [rsp + 0x428]
call fcn.180015800
lea rax, [rsp + 0x698]
mov qword [rsp + 0x7b0], rax
lea rdx, [rsp + 0x3b0]
mov rcx, qword [rsp + 0x7b0]
call fcn.180026b10
mov qword [rsp + 0x808], rax
mov rdx, qword [rsp + 0x808]
mov rcx, qword [rsp + 0x830]
call fcn.180031bc0
nop
lea rcx, [rsp + 0x3b0]
call fcn.1800269e0
nop
lea rcx, [rsp + 0x290]
call fcn.1800269e0
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.18003c690
add rsp, 0x828
ret