Function at 0x1400022f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400022f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x240
mov rdi, rsp
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x250]
mov qword [rsp + 0x210], 0xfffffffffffffffe
mov rax, qword [0x14007d060]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov ecx, 0x70
call fcn.1400051d0
mov qword [rsp + 0x208], rax
cmp qword [rsp + 0x208], 0
je 0x140002369
mov rcx, qword [rsp + 0x208]
call fcn.14000105a
mov qword [rsp + 0x218], rax
jmp 0x140002375
mov qword [rsp + 0x218], 0
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov qword [0x14007eaa0], rax
mov rdi, qword [0x14007eaa0]
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov rax, qword [0x14007eaa0]
add rax, 0x38
lea rdx, str.Test.txt
mov rcx, rax
call fcn.1400010f5
mov rax, qword [0x14007eaa0]
add rax, 0x38
mov rcx, rax
call fcn.140001028
movzx eax, al
test eax, eax
jne 0x1400023fa
mov rax, qword [0x14007eaa0]
add rax, 0x38
lea rdx, str.6666
mov rcx, rax
call fcn.14000110e
test eax, eax
jne 0x14000275d
mov qword [rsp + 0x60], 0
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_BeginPaint]
mov qword [rsp + 0xd8], rax
mov byte [rsp + 0xe4], 0
mov byte [rsp + 0xe5], 0
mov byte [rsp + 0xe6], 0x80
mov byte [rsp + 0xe7], 1
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x110]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x124], eax
mov eax, dword [rsp + 0x114]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x128], eax
mov eax, dword [rsp + 0x128]
cmp dword [rsp + 0x124], eax
jge 0x140002497
mov eax, dword [rsp + 0x124]
mov dword [rsp + 0x220], eax
jmp 0x1400024a5
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x220], eax
mov eax, dword [rsp + 0x220]
sub eax, 0x14
mov dword [rsp + 0x12c], eax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rsp + 0x130], rax
mov r8d, dword [rsp + 0x114]
mov edx, dword [rsp + 0x110]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x140], rax
mov r8d, 6
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.USER32.dll_FillRect]
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x128]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x12c]
mov edx, dword [rsp + 0x124]
add edx, ecx
mov ecx, edx
mov edx, dword [rsp + 0x12c]
mov edi, dword [rsp + 0x128]
sub edi, edx
mov edx, edi
mov edi, dword [rsp + 0x12c]
mov r8d, dword [rsp + 0x124]
sub r8d, edi
mov edi, r8d
mov r9d, eax
mov r8d, ecx
mov ecx, edi
call qword [sym.imp.GDI32.dll_CreateEllipticRgn]
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x124]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x158], eax
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x128]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x15c], eax
mov eax, 0xff00
mov word [rsp + 0x160], ax
xor eax, eax
mov word [rsp + 0x162], ax
xor eax, eax
mov word [rsp + 0x164], ax
xor eax, eax
mov word [rsp + 0x166], ax
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x124]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x128]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x16c], eax
xor eax, eax
mov word [rsp + 0x170], ax
xor eax, eax
mov word [rsp + 0x172], ax
mov eax, 0xff
mov word [rsp + 0x174], ax
xor eax, eax
mov word [rsp + 0x176], ax
mov dword [rsp + 0x198], 0
mov dword [rsp + 0x19c], 1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x198]
mov r8d, 2
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.MSIMG32.dll_GradientFill]
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x110]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.MSIMG32.dll_AlphaBlend]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_EndPaint]
mov rax, qword [0x14007eaa0]
add rax, 0x30
mov rcx, qword [0x14007eaa0]
add rcx, 0x28
mov rdx, qword [0x14007eaa0]
add rdx, 0x20
mov qword [rsp + 0x228], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x228]
mov rcx, rax
call fcn.14000104b
test eax, eax
je 0x14000281e
mov edx, 2
lea rcx, [0x140001113]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x14000106e]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x140001109]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x1400010a0]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x140001131]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x14000113b]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov edx, 2
lea rcx, [0x14000100a]
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov rax, qword [0x14007eaa0]
cmp qword [rax + 0x30], 0
je 0x140002917
mov byte [rsp + 0x1b8], 0x41
mov byte [rsp + 0x1b9], 0x6e
mov byte [rsp + 0x1ba], 0x77
mov byte [rsp + 0x1bb], 0x79
mov byte [rsp + 0x1bc], 0x7a
mov byte [rsp + 0x1bd], 0x66
mov byte [rsp + 0x1be], 0x71
mov byte [rsp + 0x1bf], 0x55
mov byte [rsp + 0x1c0], 0x77
mov byte [rsp + 0x1c1], 0x74
mov byte [rsp + 0x1c2], 0x79
mov byte [rsp + 0x1c3], 0x6a
mov byte [rsp + 0x1c4], 0x68
mov byte [rsp + 0x1c5], 0x79
mov byte [rsp + 0x1c6], 0
mov dword [rsp + 0x1d4], 5
mov rax, qword [0x14007eaa0]
mov eax, dword [rax + 0x18]
mov qword [rsp + 0x230], rax
mov r9b, 1
mov rcx, qword [0x14007eaa0]
mov r8, qword [rcx + 0x30]
mov edx, dword [rsp + 0x1d4]
lea rcx, [rsp + 0x1b8]
call fcn.14000107d
lea r9, [rsp + 0x1e4]
mov r8d, 0x40
mov rcx, qword [rsp + 0x230]
mov rdx, rcx
mov rcx, qword [0x14007eaa0]
mov rcx, qword [rcx + 0x68]
call rax
mov rax, qword [0x14007eaa0]
call qword [rax + 0x68]
xor eax, eax
mov edi, eax
mov rcx, rsp
lea rdx, [0x1400699b0]
call fcn.140004e50
mov eax, edi
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140004e30
add rsp, 0x240
pop rdi
ret