Function at 0x140001050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14000f028]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea r8, [rbp + 7]
mov dword [rbp + 7], 0x70767165
mov dword [rbp + 0xb], 0x2e786262
mov dword [rbp + 0xf], 0x74746c
mov dword [rbp + 0x17], 0x77727a57
mov dword [rbp + 0x1b], 0x3233656c
mov dword [rbp + 0x1f], 0x68687a2e
mov byte [rbp + 0x23], 0
mov dword [rbp + 0x27], 0x62667359
mov dword [rbp + 0x2b], 0x32337a73
mov dword [rbp + 0x2f], 0x7a7a722e
mov byte [rbp + 0x33], 0
movzx eax, byte [r8]
cmp al, 0x61
jl 0x1400010f3
cmp al, 0x7a
jg 0x1400010f3
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x4f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x14000111a
cmp al, 0x41
jl 0x14000111d
cmp al, 0x5a
jg 0x14000111d
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x2f
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x1400010c6
lea r8, [rbp + 0x17]
nop word [rax + rax]
movzx eax, byte [r8]
cmp al, 0x61
jl 0x14000115d
cmp al, 0x7a
jg 0x14000115d
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x5d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x140001184
cmp al, 0x41
jl 0x140001187
cmp al, 0x5a
jg 0x140001187
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x3d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x140001130
lea r8, [rbp + 0x27]
movzx eax, byte [r8]
cmp al, 0x61
jl 0x1400011c1
cmp al, 0x7a
jg 0x1400011c1
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x55
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x61
jmp 0x1400011e8
cmp al, 0x41
jl 0x1400011eb
cmp al, 0x5a
jg 0x1400011eb
movsx ecx, al
mov eax, 0x4ec4ec4f
sub ecx, 0x35
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x1a
sub ecx, edx
add cl, 0x41
mov byte [r8], cl
inc r8
cmp byte [r8], 0
jne 0x140001194
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x17]
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp + 0x27]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsi], rax
cmp qword [rdi], 0
je 0x140001236
cmp qword [rbx], 0
je 0x140001236
test rax, rax
je 0x140001236
mov eax, 1
jmp 0x1400012e2
lea rdx, [rbp - 0x69]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BeginPaint]
xor ecx, ecx
lea r9, [rbp - 0x79]
mov dword [rsp + 0x28], ecx
lea r8d, [rcx + 2]
mov dword [rbp - 0x79], ecx
mov qword [rbp - 0x19], rcx
lea rdx, [rbp - 0x19]
mov rcx, rax
mov rdi, rax
mov qword [rbp - 0x11], 0xff
mov dword [rbp - 9], 0xc8
mov qword [rbp - 5], 0x64
mov dword [rbp + 3], 0xff
mov qword [rbp - 0x75], 1
mov dword [rsp + 0x20], 1
call qword [sym.imp.MSIMG32.dll_GradientFill]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov edx, 0x32
mov rcx, rdi
lea r9d, [rdx + 0x64]
mov r8d, edx
mov rbx, rax
mov dword [rsp + 0x20], 0x96
call qword [sym.imp.GDI32.dll_Ellipse]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, [rbp - 0x69]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140002a60
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret