Function at 0x140172ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x400
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [rsp + 0x458], rbx
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
movzx ebp, r9b
mov rsi, r8
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0xf0], rcx
mov r14, qword [rsp + 0x468]
mov qword [rsp + 0xf8], r14
mov rax, qword [rcx]
call qword [rax + 0x48]
test al, al
je 0x140172c3d
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
movzx eax, byte [rsp + 0x460]
mov byte [rsp + 0x20], al
movzx r9d, bpl
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.140172840
jmp 0x1401739d0
xor r13b, r13b
xor r15d, r15d
mov rbx, r15
test r14, r14
je 0x140172c72
mov rdx, r14
lea rcx, str.CExtPopupMenuWnd
call fcn.14001b184
mov rbx, rax
test rax, rax
je 0x140172c72
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x280]
movzx r13d, al
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_CopyRect]
mov r11d, dword [rsp + 0xc8]
mov ecx, r11d
mov edx, dword [rsp + 0xc0]
sub ecx, edx
test cl, 1
je 0x140172cb7
test r13b, r13b
je 0x140172cac
inc edx
mov dword [rsp + 0xc0], edx
jmp 0x140172cb7
dec r11d
mov dword [rsp + 0xc8], r11d
mov r13d, r15d
test rbx, rbx
je 0x140172cf6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x370]
test eax, eax
jle 0x140172cf6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x370]
lea edx, [rax - 1]
mov rcx, rbx
call fcn.1400818b0
test byte [rax + 0xbc], 0x10
jne 0x140172cf6
mov r13d, dword [rax + 0xa8]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, qword [r12 + 8]
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
cmp eax, 8
jg 0x140172d40
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
movzx eax, byte [rsp + 0x460]
mov byte [rsp + 0x20], al
movzx r9d, bpl
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.140172840
jmp 0x1401739d0
mov rdx, rsi
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_CopyRect]
xor r8d, r8d
or ebx, 0xffffffff
mov edx, ebx
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_InflateRect]
test bpl, bpl
je 0x140172eb7
lea rcx, [rsp + 0x110]
call fcn.14016dbe0
nop
or byte [rsp + 0x178], 2
mov rax, qword [rdi]
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x110]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x4e8]
test al, al
jne 0x140172e8e
mov rax, qword [rdi]
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x110]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x4f0]
test al, al
jne 0x140172e8e
mov byte [rsp + 0x90], al
mov dword [rsp + 0x88], r15d
mov byte [rsp + 0x80], al
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x70], 9
mov byte [rsp + 0x68], al
mov byte [rsp + 0x60], al
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], al
mov byte [rsp + 0x48], al
mov byte [rsp + 0x40], bpl
mov byte [rsp + 0x38], al
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], r15
lea rax, [0x1401dd700]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
mov r8b, 1
mov rdx, r14
lea rcx, [rsp + 0x250]
call fcn.140132940
mov r11, qword [rdi]
lea r8, [rsp + 0x250]
mov rdx, r12
mov rcx, rdi
call qword [r11 + 0x210]
mov r11, qword [rdi]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [r11 + 0x190]
mov rax, qword [rax]
mov r8, rax
shr r8, 0x20
mov edx, eax
lea rcx, [rsp + 0xd8]
call qword [sym.imp.USER32.dll_OffsetRect]
nop
mov rdx, qword [rsp + 0x190]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140172f6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140172f6d
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x88], r15d
mov byte [rsp + 0x80], r15b
mov byte [rsp + 0x78], r15b
mov byte [rsp + 0x70], r15b
mov byte [rsp + 0x68], 1
mov byte [rsp + 0x60], r15b
mov byte [rsp + 0x58], r15b
mov byte [rsp + 0x50], r15b
movzx eax, byte [rsp + 0x460]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x40], r15b
mov qword [rsp + 0x38], r15
lea rax, [0x1401dd700]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [rsp + 0xd8]
mov rdx, r14
lea rcx, [rsp + 0x1b0]
call fcn.14016dc70
nop
mov rax, qword [rdi]
lea r8, [rsp + 0x1b0]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x290]
nop
mov rdx, qword [rsp + 0x230]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140172f6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xb0], xmm0
mov eax, dword [rsp + 0xc0]
mov r10d, dword [rsp + 0xc8]
cmp eax, r10d
jle 0x140172f9c
mov dword [rsp + 0xb0], r10d
jmp 0x140172fab
mov eax, dword [rsp + 0xb8]
mov r10d, dword [rsp + 0xb0]
mov r9d, dword [rsp + 0xb4]
mov r8d, dword [rsp + 0xbc]
cmp r9d, r8d
jle 0x140172fd1
mov ecx, r9d
mov r9d, r8d
mov dword [rsp + 0xb4], r8d
mov r8d, ecx
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], rcx
sub eax, r10d
sub eax, 0x10
cdq
sub eax, edx
sar eax, 1
add eax, r10d
mov dword [rsp + 0xd0], eax
sub r8d, r9d
lea eax, [r8 - 0x10]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [rsp + 0xb4]
add ecx, eax
mov dword [rsp + 0xb0], ecx
mov byte [rsp + 0x2f0], 0xff
mov byte [rsp + 0x2f1], 0xff
mov byte [rsp + 0x2f2], 0xff
mov byte [rsp + 0x2f3], 0xff
mov byte [rsp + 0x2f4], 0xff
mov byte [rsp + 0x2f5], 0xea
mov byte [rsp + 0x2f6], 0xc6
mov byte [rsp + 0x2f7], 0xb4
mov byte [rsp + 0x2f8], 0xb4
mov byte [rsp + 0x2f9], 0xb4
mov byte [rsp + 0x2fa], 0xc6
mov byte [rsp + 0x2fb], 0xff
mov byte [rsp + 0x2fc], 0xff
mov byte [rsp + 0x2fd], 0xff
mov byte [rsp + 0x2fe], 0xff
mov byte [rsp + 0x2ff], 0xff
mov byte [rsp + 0x300], 0xff
mov byte [rsp + 0x301], 0xff
mov byte [rsp + 0x302], 0xff
mov byte [rsp + 0x303], 0xea
mov byte [rsp + 0x304], 0xea
mov byte [rsp + 0x305], 0xea
mov byte [rsp + 0x306], 0xea
mov byte [rsp + 0x307], 0xc6
mov byte [rsp + 0x308], 0xb4
mov byte [rsp + 0x309], 0x90
mov byte [rsp + 0x30a], 0x7e
mov byte [rsp + 0x30b], 0x7e
mov byte [rsp + 0x30c], 0xc6
mov byte [rsp + 0x30d], 0xff
mov byte [rsp + 0x30e], 0xff
mov byte [rsp + 0x30f], 0xff
mov byte [rsp + 0x310], 0xff
mov byte [rsp + 0x311], 0xff
mov byte [rsp + 0x312], 0xea
mov byte [rsp + 0x313], 0xfc
mov byte [rsp + 0x314], 0xfc
mov byte [rsp + 0x315], 0xea
mov byte [rsp + 0x316], 0xea
mov byte [rsp + 0x317], 0xc6
mov byte [rsp + 0x318], 0xb4
mov byte [rsp + 0x319], 0x90
mov byte [rsp + 0x31a], 0x7e
mov byte [rsp + 0x31b], 0x6c
mov byte [rsp + 0x31c], 0x5a
mov byte [rsp + 0x31d], 0x90
mov byte [rsp + 0x31e], 0xff
mov byte [rsp + 0x31f], 0xff
mov byte [rsp + 0x320], 0xff
mov byte [rsp + 0x321], 0xea
mov byte [rsp + 0x322], 0xfc
mov byte [rsp + 0x323], 0xfc
mov byte [rsp + 0x324], 0xfc
mov byte [rsp + 0x325], 0xea
mov byte [rsp + 0x326], 0xea
mov byte [rsp + 0x327], 0xc6
mov byte [rsp + 0x328], 0xb4
mov byte [rsp + 0x329], 0x90
mov byte [rsp + 0x32a], 0x7e
mov byte [rsp + 0x32b], 0x6c
mov byte [rsp + 0x32c], 0x5a
mov byte [rsp + 0x32d], 0x36
mov byte [rsp + 0x32e], 0x7e
mov byte [rsp + 0x32f], 0xff
mov byte [rsp + 0x330], 0xff
mov byte [rsp + 0x331], 0xfc
mov byte [rsp + 0x332], 0xfc
mov byte [rsp + 0x333], 0xfc
mov byte [rsp + 0x334], 0xfc
mov byte [rsp + 0x335], 0xea
mov byte [rsp + 0x336], 0xea
mov byte [rsp + 0x337], 0xc6
mov byte [rsp + 0x338], 0xb4
mov byte [rsp + 0x339], 0x90
mov byte [rsp + 0x33a], 0x7e
mov byte [rsp + 0x33b], 0x6c
mov byte [rsp + 0x33c], 0x5a
mov byte [rsp + 0x33d], 0x36
mov byte [rsp + 0x33e], 0x24
mov byte [rsp + 0x33f], 0xff
mov byte [rsp + 0x340], 0xea
mov byte [rsp + 0x341], 0xfc
mov byte [rsp + 0x342], 0xfc
mov byte [rsp + 0x343], 0xfc
mov byte [rsp + 0x344], 0xfc
mov byte [rsp + 0x345], 0xea
mov byte [rsp + 0x346], 0xea
mov byte [rsp + 0x347], 0xc6
mov byte [rsp + 0x348], 0xb4
mov byte [rsp + 0x349], 0x90
mov byte [rsp + 0x34a], 0x7e
mov byte [rsp + 0x34b], 0x6c
mov byte [rsp + 0x34c], 0x48
mov byte [rsp + 0x34d], 0x36
mov byte [rsp + 0x34e], 0x24
mov byte [rsp + 0x34f], 0x5a
mov byte [rsp + 0x350], 0xea
mov byte [rsp + 0x351], 0xea
mov byte [rsp + 0x352], 0xea
mov byte [rsp + 0x353], 0xea
mov byte [rsp + 0x354], 0xea
mov byte [rsp + 0x355], 0xea
mov byte [rsp + 0x356], 0xc6
mov byte [rsp + 0x357], 0xb4
mov byte [rsp + 0x358], 0x90
mov byte [rsp + 0x359], 0x90
mov byte [rsp + 0x35a], 0x7e
mov byte [rsp + 0x35b], 0x6c
mov byte [rsp + 0x35c], 0x48
mov byte [rsp + 0x35d], 0x24
mov byte [rsp + 0x35e], 0x12
mov byte [rsp + 0x35f], 0x24
mov byte [rsp + 0x360], 0xc6
mov byte [rsp + 0x361], 0xea
mov byte [rsp + 0x362], 0xea
mov byte [rsp + 0x363], 0xea
mov byte [rsp + 0x364], 0xc6
mov byte [rsp + 0x365], 0xc6
mov byte [rsp + 0x366], 0xc6
mov byte [rsp + 0x367], 0xb4
mov byte [rsp + 0x368], 0x90
mov byte [rsp + 0x369], 0x7e
mov byte [rsp + 0x36a], 0x7e
mov byte [rsp + 0x36b], 0x48
mov byte [rsp + 0x36c], 0x36
mov byte [rsp + 0x36d], 0x24
mov byte [rsp + 0x36e], 0x12
mov byte [rsp + 0x36f], 0x12
mov byte [rsp + 0x370], 0xc6
mov byte [rsp + 0x371], 0xc6
mov byte [rsp + 0x372], 0xc6
mov byte [rsp + 0x373], 0xc6
mov byte [rsp + 0x374], 0xc6
mov byte [rsp + 0x375], 0xb4
mov byte [rsp + 0x376], 0xb4
mov byte [rsp + 0x377], 0x90
mov byte [rsp + 0x378], 0x7e
mov byte [rsp + 0x379], 0x7e
mov byte [rsp + 0x37a], 0x6c
mov byte [rsp + 0x37b], 0x48
mov byte [rsp + 0x37c], 0x36
mov byte [rsp + 0x37d], 0x12
mov byte [rsp + 0x37e], 0x12
mov byte [rsp + 0x37f], 0
mov byte [rsp + 0x380], 0xc6
mov byte [rsp + 0x381], 0xb4
mov byte [rsp + 0x382], 0xb4
mov byte [rsp + 0x383], 0xb4
mov byte [rsp + 0x384], 0xb4
mov byte [rsp + 0x385], 0xb4
mov byte [rsp + 0x386], 0x90
mov byte [rsp + 0x387], 0x7e
mov byte [rsp + 0x388], 0x7e
mov byte [rsp + 0x389], 0x6c
mov byte [rsp + 0x38a], 0x5a
mov byte [rsp + 0x38b], 0x36
mov byte [rsp + 0x38c], 0x24
mov byte [rsp + 0x38d], 0x12
mov byte [rsp + 0x38e], 0
mov byte [rsp + 0x38f], 0
mov byte [rsp + 0x390], 0xc6
mov byte [rsp + 0x391], 0x90
mov byte [rsp + 0x392], 0x90
mov byte [rsp + 0x393], 0x90
mov byte [rsp + 0x394], 0x90
mov byte [rsp + 0x395], 0x90
mov byte [rsp + 0x396], 0x7e
mov byte [rsp + 0x397], 0x7e
mov byte [rsp + 0x398], 0x6c
mov byte [rsp + 0x399], 0x6c
mov byte [rsp + 0x39a], 0x48
mov byte [rsp + 0x39b], 0x36
mov byte [rsp + 0x39c], 0x24
mov byte [rsp + 0x39d], 0x12
mov byte [rsp + 0x39e], 0
mov byte [rsp + 0x39f], 0x36
mov byte [rsp + 0x3a0], 0xff
mov byte [rsp + 0x3a1], 0x90
mov byte [rsp + 0x3a2], 0x7e
mov byte [rsp + 0x3a3], 0x7e
mov byte [rsp + 0x3a4], 0x7e
mov byte [rsp + 0x3a5], 0x7e
mov byte [rsp + 0x3a6], 0x6c
mov byte [rsp + 0x3a7], 0x6c
mov byte [rsp + 0x3a8], 0x5a
mov byte [rsp + 0x3a9], 0x5a
mov byte [rsp + 0x3aa], 0x36
mov byte [rsp + 0x3ab], 0x24
mov byte [rsp + 0x3ac], 0x12
mov byte [rsp + 0x3ad], 0
mov byte [rsp + 0x3ae], 0
mov byte [rsp + 0x3af], 0xff
mov byte [rsp + 0x3b0], 0xff
mov byte [rsp + 0x3b1], 0xc6
mov byte [rsp + 0x3b2], 0x6c
mov byte [rsp + 0x3b3], 0x6c
mov byte [rsp + 0x3b4], 0x6c
mov byte [rsp + 0x3b5], 0x6c
mov byte [rsp + 0x3b6], 0x5a
mov byte [rsp + 0x3b7], 0x5a
mov byte [rsp + 0x3b8], 0x5a
mov byte [rsp + 0x3b9], 0x48
mov byte [rsp + 0x3ba], 0x36
mov byte [rsp + 0x3bb], 0x24
mov byte [rsp + 0x3bc], 0x12
mov byte [rsp + 0x3bd], 0
mov byte [rsp + 0x3be], 0x48
mov byte [rsp + 0x3bf], 0xff
mov byte [rsp + 0x3c0], 0xff
mov byte [rsp + 0x3c1], 0xff
mov byte [rsp + 0x3c2], 0xb4
mov byte [rsp + 0x3c3], 0x6c
mov byte [rsp + 0x3c4], 0x5a
mov byte [rsp + 0x3c5], 0x5a
mov byte [rsp + 0x3c6], 0x5a
mov byte [rsp + 0x3c7], 0x48
mov byte [rsp + 0x3c8], 0x48
mov byte [rsp + 0x3c9], 0x36
mov byte [rsp + 0x3ca], 0x24
mov byte [rsp + 0x3cb], 0x12
mov byte [rsp + 0x3cc], 0
mov byte [rsp + 0x3cd], 0x36
mov byte [rsp + 0x3ce], 0xff
mov byte [rsp + 0x3cf], 0xff
mov byte [rsp + 0x3d0], 0xff
mov byte [rsp + 0x3d1], 0xff
mov byte [rsp + 0x3d2], 0xff
mov byte [rsp + 0x3d3], 0xc6
mov byte [rsp + 0x3d4], 0x5a
mov byte [rsp + 0x3d5], 0x48
mov byte [rsp + 0x3d6], 0x48
mov byte [rsp + 0x3d7], 0x48
mov byte [rsp + 0x3d8], 0x36
mov byte [rsp + 0x3d9], 0x24
mov byte [rsp + 0x3da], 0x24
mov byte [rsp + 0x3db], 0x12
mov byte [rsp + 0x3dc], 0x6c
mov byte [rsp + 0x3dd], 0xff
mov byte [rsp + 0x3de], 0xff
mov byte [rsp + 0x3df], 0xff
mov byte [rsp + 0x3e0], 0xff
mov byte [rsp + 0x3e1], 0xff
mov byte [rsp + 0x3e2], 0xff
mov byte [rsp + 0x3e3], 0xff
mov byte [rsp + 0x3e4], 0xff
mov byte [rsp + 0x3e5], 0xb4
mov byte [rsp + 0x3e6], 0x6c
mov byte [rsp + 0x3e7], 0x48
mov byte [rsp + 0x3e8], 0x36
mov byte [rsp + 0x3e9], 0x5a
mov byte [rsp + 0x3ea], 0x7e
mov byte [rsp + 0x3eb], 0xff
mov byte [rsp + 0x3ec], 0xff
mov byte [rsp + 0x3ed], 0xff
mov byte [rsp + 0x3ee], 0xff
mov byte [rsp + 0x3ef], 0xff
mov rax, qword [rdi]
mov r15, qword [rsp + 0x470]
mov r9, r15
mov r8, r14
mov edx, 0xbdd
mov rcx, rdi
call qword [rax + 0x150]
mov dword [rsp + 0xa0], eax
mov r10, qword [rdi]
mov r9, r15
mov r8, r14
mov edx, 0xbde
mov rcx, rdi
call qword [r10 + 0x150]
mov edi, eax
xor esi, esi
lea rbp, [rsp + 0x2f0]
lea ecx, [rsi + 0x10]
mov r15d, dword [rsp + 0xd0]
mov r14d, dword [rsp + 0xb0]
nop
movzx r13d, byte [rbp]
cmp r13d, 0xff
je 0x140173959
movzx r9d, di
shr r9w, 8
mov r10d, edi
shr r10d, 0x10
xor edx, edx
mov eax, esi
div ecx
mov r11d, edx
mov ebx, eax
movzx ecx, word [rsp + 0xa0]
shr cx, 8
movzx r8d, cl
movzx ecx, r9b
sub ecx, r8d
imul ecx, r13d
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r9b, dl
movzx r9d, r9b
shl r9d, 8
mov eax, dword [rsp + 0xa0]
shr eax, 0x10
movzx ecx, al
movzx r8d, r10b
sub r8d, ecx
imul r8d, r13d
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r10b, dl
movzx eax, r10b
shl eax, 0x10
or r9d, eax
movzx ecx, dil
movzx eax, byte [rsp + 0xa0]
sub ecx, eax
imul ecx, r13d
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dil
sub al, dl
movzx ecx, al
or r9d, ecx
lea r8d, [r11 + r14]
lea edx, [rbx + r15]
mov rcx, qword [r12 + 8]
call qword [sym.imp.GDI32.dll_SetPixel]
mov ecx, 0x10
inc esi
inc rbp
cmp esi, 0x100
jl 0x140173870
mov dword [rsp + 0xe8], 0
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rdi]
mov r9, qword [rsp + 0x470]
mov r8, qword [rsp + 0xf8]
mov edx, 0x3fa
mov rcx, rdi
call qword [rax + 0x150]
mov dword [rsp + 0xec], eax
mov rax, qword [rdi]
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x20], rcx
lea r9, [0x140273898]
lea r8, [rsp + 0xc0]
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x1a8]
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.14002f990
mov rbx, qword [rsp + 0x458]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret