Function at 0x4017f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x4017f0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov rdi, rsp
movabs rcx, 0x6c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c0]
mov rax, qword [0x0048e070]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov byte [rsp + 0x38], 0x65
mov byte [rsp + 0x39], 0x71
mov byte [rsp + 0x3a], 0x76
mov byte [rsp + 0x3b], 0x70
mov byte [rsp + 0x3c], 0x62
mov byte [rsp + 0x3d], 0x62
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x3f], 0x2e
mov byte [rsp + 0x40], 0x6c
mov byte [rsp + 0x41], 0x74
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x43], 0
mov dword [rsp + 0x54], 8
mov byte [rsp + 0x68], 0x57
mov byte [rsp + 0x69], 0x7a
mov byte [rsp + 0x6a], 0x72
mov byte [rsp + 0x6b], 0x77
mov byte [rsp + 0x6c], 0x6c
mov byte [rsp + 0x6d], 0x65
mov byte [rsp + 0x6e], 0x33
mov byte [rsp + 0x6f], 0x32
mov byte [rsp + 0x70], 0x2e
mov byte [rsp + 0x71], 0x7a
mov byte [rsp + 0x72], 0x68
mov byte [rsp + 0x73], 0x68
mov byte [rsp + 0x74], 0
mov dword [rsp + 0x84], 0x16
mov byte [rsp + 0x98], 0x59
mov byte [rsp + 0x99], 0x73
mov byte [rsp + 0x9a], 0x66
mov byte [rsp + 0x9b], 0x62
mov byte [rsp + 0x9c], 0x73
mov byte [rsp + 0x9d], 0x7a
mov byte [rsp + 0x9e], 0x33
mov byte [rsp + 0x9f], 0x32
mov byte [rsp + 0xa0], 0x2e
mov byte [rsp + 0xa1], 0x72
mov byte [rsp + 0xa2], 0x7a
mov byte [rsp + 0xa3], 0x7a
mov byte [rsp + 0xa4], 0
mov dword [rsp + 0xb4], 0xe
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x38]
call fcn.00401082
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x84]
lea rcx, [rsp + 0x68]
call fcn.00401082
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0xb4]
lea rcx, [rsp + 0x98]
call fcn.00401082
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x1c0]
mov qword [rcx], rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x1c8]
mov qword [rcx], rax
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x1d0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x1c0]
cmp qword [rax], 0
je 0x4019fb
mov rax, qword [rsp + 0x1c8]
cmp qword [rax], 0
je 0x4019fb
mov rax, qword [rsp + 0x1d0]
cmp qword [rax], 0
je 0x4019fb
mov eax, 1
jmp 0x401b53
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BeginPaint]
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x138], 0
mov dword [rsp + 0x13c], 0
mov word [rsp + 0x140], 0xff
mov word [rsp + 0x142], 0
mov word [rsp + 0x144], 0
mov word [rsp + 0x146], 0
mov dword [rsp + 0x148], 0xc8
mov dword [rsp + 0x14c], 0x64
mov word [rsp + 0x150], 0
mov word [rsp + 0x152], 0
mov word [rsp + 0x154], 0xff
mov word [rsp + 0x156], 0
mov dword [rsp + 0x178], 0
mov dword [rsp + 0x17c], 1
mov dword [rsp + 0x180], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x178]
mov r8d, 2
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.MSIMG32.dll_GradientFill]
xor edx, edx
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x20], 0x96
mov r9d, 0x96
mov r8d, 0x32
mov edx, 0x32
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.GDI32.dll_Ellipse]
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x004791c0]
call fcn.00406010
mov rax, rdi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.00405ff0
add rsp, 0x1b0
pop rdi
ret