Function at 0x140001310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140010028]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x70767165
mov dword [rbp + 0xb], 0x2e786262
mov dword [rbp + 0xf], 0x74746c
mov dword [rbp + 0x17], 0x77727a57
mov dword [rbp + 0x1b], 0x3233656c
mov dword [rbp + 0x1f], 0x68687a2e
mov byte [rbp + 0x23], 0
mov dword [rbp + 0x27], 0x62667359
mov dword [rbp + 0x2b], 0x32337a73
mov dword [rbp + 0x2f], 0x7a7a722e
mov byte [rbp + 0x33], 0
movzx eax, byte [r8]
cmp al, 0x61
jl 0x1400013b3
cmp al, 0x7a
jg 0x1400013b3
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x4f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x1400013da
cmp al, 0x41
jl 0x1400013dd
cmp al, 0x5a
jg 0x1400013dd
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x2f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x140001386
lea r8, [rbp + 0x17]
nop word [rax + rax]
movzx eax, byte [r8]
cmp al, 0x61
jl 0x14000141d
cmp al, 0x7a
jg 0x14000141d
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x5d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x140001444
cmp al, 0x41
jl 0x140001447
cmp al, 0x5a
jg 0x140001447
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x3d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x1400013f0
lea r8, [rbp + 0x27]
movzx eax, byte [r8]
cmp al, 0x61
jl 0x140001481
cmp al, 0x7a
jg 0x140001481
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x55
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x1400014a8
cmp al, 0x41
jl 0x1400014ab
cmp al, 0x5a
jg 0x1400014ab
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x35
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x140001454
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x17]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x27]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsi], rax
cmp qword [rdi], 0
je 0x1400014f6
cmp qword [rbx], 0
je 0x1400014f6
test rax, rax
je 0x1400014f6
mov eax, 1
jmp 0x1400015a2
lea rdx, [rbp - 0x69]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BeginPaint]
xor ecx, ecx
lea r9, [rbp - 0x79]
mov dword [rsp + 0x28], ecx
lea r8d, [rcx + 2]
mov dword [rbp - 0x79], ecx
mov qword [rbp - 0x19], rcx
lea rdx, [rbp - 0x19]
mov rcx, rax
mov rdi, rax
mov qword [rbp - 0x11], 0xff
mov dword [rbp - 9], 0xc8
mov qword [rbp - 5], 0x64
mov dword [rbp + 3], 0xff
mov qword [rbp - 0x75], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.MSIMG32.dll_GradientFill]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, 0x32
mov rcx, rdi
lea r9d, [rdx + 0x64]
mov r8d, edx
mov rbx, rax
mov dword [rsp + 0x20], 0x96
call qword [sym.imp.GDI32.dll_Ellipse]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, [rbp - 0x69]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140002d60
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret