Function at 0x180036090
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x18005a098]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx ebx, byte [rsp + 0x60]
lea r13d, [rcx + 0x7f8]
mov r14, r8
mov rsi, rdx
mov ebp, ecx
cmp ecx, r13d
jae 0x1800363ac
mov r12, qword [rsp + 0x88]
movzx r15d, byte [rsp + 0x60]
xor edx, edx
lea r8, [0x180000000]
cmp ebp, 0x17e
ja 0x180036376
je 0x180036354
cmp ebp, 0xbe
ja 0x1800361b5
je 0x180036190
cmp ebp, 0x40
je 0x180036188
cmp ebp, 0x65
je 0x180036149
cmp ebp, 0x6e
jne 0x18003639d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10b
mov rcx, rsi
mov r15b, 1
call fcn.18000fe90
test al, al
jne 0x18003639d
xor al, al
jmp 0x1800363af
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
je 0x180036181
nop word [rax + rax]
mov rdx, qword [rbx]
mov r8, r14
mov ecx, 0x76
call fcn.180038c70
test al, al
jne 0x180036468
add rbx, 8
cmp rbx, rdi
jne 0x180036160
xor bl, bl
jmp 0x18003639d
inc dword [rsi + 0x30]
jmp 0x18003639d
mov qword [rsp + 0x28], rdx
lea r8, [0x18000b8c0]
mov dword [rsp + 0x20], edx
mov r9, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
jmp 0x18003639d
mov eax, ebp
sub eax, 0xed
je 0x1800363ac
sub eax, 9
je 0x1800361df
cmp eax, 0x50
jne 0x18003639d
cmp qword [rsi], 0
je 0x180036142
jmp 0x18003639d
cmp qword [rsi + 0x30], 0
jne 0x18003631c
mov edi, 7
nop
cmp edi, 7
ja case.default.0x180036206
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x36470]
add rcx, r8
jmp rcx
mov qword [rsp + 0x90], rdx
mov dword [rsp + 0x68], edx
jmp case.default.0x180036206
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea r8, [0x180000000]
jmp case.default.0x180036206
mov dword [rsp + 0x64], 0xa
jmp case.default.0x180036206
mov eax, dword [rsp + 0x6c]
mov r9d, dword [rsp + 0x64]
mov r8d, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x50], edx
mov edx, dword [rsp + 0x68]
mov dword [rsp + 0x48], 0xa
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_GdiAlphaBlend]
xor edx, edx
lea r8, [0x180000000]
jmp case.default.0x180036206
mov eax, dword [rsi + 0x28]
xor r9d, r9d
mov rdx, qword [rsi + 0x30]
mov dword [rsp + 0x6c], 0x14
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rsi + 0x20]
test eax, eax
jne 0x180036142
xor edx, edx
lea r8, [0x180000000]
jmp case.default.0x180036206
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x74], edx
jmp case.default.0x180036206
mov rax, qword [rsi + 0x10]
mov qword [rsi + 0x30], rax
mov dword [rsp + 0x78], edx
jmp case.default.0x180036206
mov eax, dword [rsi + 0x28]
mov dword [rsp + 0x7c], 0x14
mov qword [rsp + 0x88], rdx
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [rsi + 0x10]
mov qword [rsi + 0x38], rcx
dec edi
lea eax, [rdi + 0x49]
cmp eax, 0x48
ja 0x1800361f0
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsi + 0x28]
xor r9d, r9d
mov rdx, qword [rsi + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rsi + 0x20]
test eax, eax
jne 0x180036142
jmp 0x18003639d
lea rcx, [rsp + 0xa0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectExA]
xor r8d, r8d
mov rcx, rsi
mov r12, rax
lea edx, [r8 + 0x27]
call fcn.1800079f0
jmp 0x18003639d
cmp ebp, 0x28e
ja 0x180036442
je 0x18003641b
mov eax, ebp
sub eax, 0x1ce
je 0x1800363ec
sub eax, 0x38
je 0x1800363da
cmp eax, 0x50
jne 0x18003639d
mov bl, 1
add ebp, 0x88
cmp ebp, r13d
jb 0x1800360e4
movzx eax, bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800436f0
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, r15b
test r12, r12
mov ecx, edx
cmovne ecx, eax
movzx r15d, cl
jmp 0x18003639d
mov qword [rsp + 0x28], rdx
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x80], 1
mov ecx, 0x125
call fcn.180018e70
jmp 0x18003639d
mov rcx, qword [rsi + 0x30]
mov rax, qword [rsi + 0x38]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rcx
test r15b, r15b
je 0x18003639d
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x18003639d
mov eax, ebp
sub eax, 0x2de
je 0x1800363ac
sub eax, 0x38
je 0x18003639b
cmp eax, 0x88
je 0x1800363ac
jmp 0x18003639d
mov al, 1
jmp 0x1800363af