Function at 0x140035de0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
movzx r15d, dl
mov rsi, rcx
call fcn.1400639a0
nop
lea rbx, [rsi + 0x68]
mov qword [rbp + 0x77], rbx
xor r12d, r12d
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov byte [rbx + 0x20], r12b
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ec248]
xor edx, edx
lea r8d, [r12 + 0x17]
lea rcx, [0x140102040]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140035e85
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ole32.dll_OleRun]
mov edi, eax
test eax, eax
js 0x140035e77
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
lea r8, [rbx + 8]
lea rdx, [0x140102080]
call qword [rax]
mov edi, eax
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
test edi, edi
jns 0x140035e89
mov qword [rbx + 8], r12
lea rax, vtable.CGraffitiWnd.0
mov qword [rsi], rax
lea rax, vtable.CGraffitiWnd.1.0
mov qword [rbx], rax
mov qword [rsi + 0x98], r12
mov qword [rsi + 0xa0], r12
mov qword [rsi + 0xa8], r12
mov qword [rsi + 0xb0], r12
mov qword [rsi + 0xb8], r12
mov dword [rsi + 0xc0], r12d
mov byte [rsi + 0x118], 0
mov dword [rsi + 0x11c], r12d
mov qword [rsi + 0x120], r12
mov qword [rsi + 0x128], r12
mov qword [rsi + 0x130], r12
mov dword [rsi + 0x138], r12d
mov rdi, 0xffffffffffffffff
mov dword [rsi + 0x13c], edi
mov byte [rsi + 0x140], 1
lea rcx, [rsi + 0x144]
call fcn.140057270
nop
mov dword [rsi + 0x168], 0x26
mov dword [rsi + 0x16c], 0x1d
mov byte [rsi + 0x170], 0
mov qword [rsi + 0x178], r12
mov qword [rsi + 0x180], r12
mov qword [rsi + 0x188], r12
lea ecx, [rdi + 0x21]
call fcn.1400dc988
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 0x180], rax
mov qword [rsi + 0x190], r12
mov qword [rsi + 0x198], r12
lea ecx, [rdi + 0x21]
call fcn.1400dc988
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 0x190], rax
lea rbx, [rsi + 0x1a8]
mov qword [rbp + 0x77], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
lea ecx, [rdi + 0x31]
call fcn.1400dc988
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rsi + 0x1b8]
mov qword [rbp + 0x77], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
lea ecx, [rdi + 0x29]
call fcn.1400dc988
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi + 0xc8], xmm0
movups xmmword [rsi + 0xd8], xmm0
mov qword [rsi + 0xe8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xd0], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xc8], rax
test r15b, r15b
je 0x140036032
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rdi + 2]
jmp 0x140036042
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov dword [rsi + 0x1a0], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsi + 0x1a4], eax
lea rcx, [rsi + 0xf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsi + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x14003aba0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0xb8], rax
lea r15, [rsi + 0x1a8]
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140036491
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x77], rax
lea rdx, str.confirm_drawing_area
cmp rdx, 0x10000
jae 0x1400360d1
movzx edx, dx
lea rcx, [rbp + 0x77]
call fcn.140028a30
jmp 0x1400360eb
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400360d4
mov r8d, eax
lea rcx, [rbp + 0x77]
call fcn.14000ede0
nop
mov r14, qword [r15]
mov r8, qword [r14 + 8]
mov qword [rbp - 0x19], r8
mov dword [rbp - 0x11], r12d
mov r10, r14
mov rax, qword [rbp + 0x77]
cmp byte [r8 + 0x19], 0
jne 0x140036172
nop dword [rax + rax]
mov qword [rbp - 0x19], r8
test rax, rax
je 0x1400364a7
mov rcx, qword [r8 + 0x20]
mov r9, rax
sub r9, rcx
nop word [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r9]
jne 0x140036148
add rcx, 2
test dx, dx
jne 0x140036130
mov ecx, r12d
jmp 0x14003614d
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x14003615e
mov dword [rbp - 0x11], r12d
mov r8, qword [r8 + 0x10]
jmp 0x14003616b
mov dword [rbp - 0x11], 1
mov r10, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x140036110
movabs r13, 0x555555555555555
cmp byte [r10 + 0x19], 0
jne 0x1400361be
mov r8, qword [r10 + 0x20]
test r8, r8
je 0x14003649c
mov rcx, rax
sub r8, rax
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x1400361ae
add rcx, 2
test dx, dx
jne 0x140036196
mov ecx, r12d
jmp 0x1400361b3
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140036244
cmp qword [r15 + 8], r13
je 0x1400364b2
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], r12
mov ecx, 0x30
call fcn.1400dc988
mov rbx, rax
mov qword [rbp - 0x49], rax
mov rcx, qword [rbp + 0x77]
add rcx, 0xffffffffffffffe8
call fcn.1400284a0
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400364b8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], 0
movups xmm0, xmmword [rbp - 0x19]
movaps xmmword [rbp - 0x29], xmm0
mov r8, rbx
lea rdx, [rbp - 0x29]
mov rcx, r15
call fcn.1400187c0
mov r10, rax
mov rax, qword [rbp + 0x77]
lea rbx, [r10 + 0x28]
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036261
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.double_click_to_confirm_the_drawing_area
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140036270
mov r8d, eax
mov rcx, rbx
call fcn.14000ede0
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400364c3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rdx, str.confirm_picture_adjusting
cmp rdx, 0x10000
jae 0x1400362c2
movzx edx, dx
lea rcx, [rbp + 0x7f]
call fcn.140028a30
jmp 0x1400362dc
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400362c5
mov r8d, eax
lea rcx, [rbp + 0x7f]
call fcn.14000ede0
nop
mov r14, qword [r15]
mov r8, qword [r14 + 8]
mov qword [rbp + 7], r8
mov dword [rbp + 0xf], r12d
mov r10, r14
mov rax, qword [rbp + 0x7f]
cmp byte [r8 + 0x19], 0
jne 0x140036362
nop dword [rax]
mov qword [rbp + 7], r8
test rax, rax
je 0x1400364d9
mov rcx, qword [r8 + 0x20]
mov r9, rax
sub r9, rcx
nop word [rax + rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r9]
jne 0x140036338
add rcx, 2
test dx, dx
jne 0x140036320
mov ecx, r12d
jmp 0x14003633d
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x14003634e
mov dword [rbp + 0xf], r12d
mov r8, qword [r8 + 0x10]
jmp 0x14003635b
mov dword [rbp + 0xf], 1
mov r10, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x140036300
cmp byte [r10 + 0x19], 0
jne 0x1400363a8
mov r8, qword [r10 + 0x20]
test r8, r8
je 0x1400364ce
mov rcx, rax
sub r8, rax
nop dword [rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x140036398
add rcx, 2
test dx, dx
jne 0x140036380
mov ecx, r12d
jmp 0x14003639d
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x14003642e
cmp qword [r15 + 8], r13
je 0x1400364e4
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x39], r12
mov ecx, 0x30
call fcn.1400dc988
mov rbx, rax
mov qword [rbp - 0x39], rax
mov rcx, qword [rbp + 0x7f]
add rcx, 0xffffffffffffffe8
call fcn.1400284a0
add rax, 0x18
mov qword [rbx + 0x20], rax
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140036486
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], 0
movups xmm0, xmmword [rbp + 7]
movaps xmmword [rbp - 0x19], xmm0
mov r8, rbx
lea rdx, [rbp - 0x19]
mov rcx, r15
call fcn.1400187c0
mov r10, rax
mov rax, qword [rbp + 0x7f]
lea rbx, [r10 + 0x28]
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003644b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.double_click_to_confirm_the_position_and_the_size_of_the_picture_adjusting
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140036452
mov r8d, edi
mov rcx, rbx
call fcn.14000ede0
nop
mov rax, rsi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
call fcn.140018ae0
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
mov ecx, 0x80004005
call fcn.14000d650
nop
call fcn.140018ae0
int3