Function at 0x10001950
Capabilities:
Check for debugger via api
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc2c
mov eax, dword [0x10024010]
xor eax, esp
mov dword [esp + 0xc28], eax
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.USER32.dll_DisableProcessWindowsGhosting]
push 1
push 0x3ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.10002880
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x10001d39
cmp dword [esp + 0x2c], eax
jne 0x10001d39
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
cmp byte [0x1002664d], al
jne 0x10001b42
lea edx, [eax + 4]
mov ecx, str.WSearch
call fcn.10002730
push 1
push str.NoAutoUpdate
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
mov edx, 0x100
call fcn.10002a80
add esp, 0xc
mov edx, 0x100
push 1
push str.AUOptions
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
call fcn.10002a80
add esp, 0xc
mov edx, 0x100
push 1
push str.NoAutoRebootWithLoggedOnUsers
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
call fcn.10002a80
add esp, 0xc
call fcn.10002400
mov edx, 4
mov ecx, str.Wuauserv
call fcn.10002730
mov edx, 4
mov ecx, str.WaaSMedicSvc
call fcn.10002730
mov edx, 4
mov ecx, str.dosvc
call fcn.10002730
mov edx, 4
mov ecx, str.BITS
call fcn.10002730
mov edx, 3
mov ecx, str.UsoSvc
call fcn.10002730
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [0x10026650], eax
test eax, eax
je 0x10001ad0
push 0xf01ff
push str.wuauserv
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [0x10026654], eax
test eax, eax
jne 0x10001ae0
mov eax, dword [0x10026650]
test eax, eax
je 0x10001ad0
cmp eax, 0xffffffff
je 0x10001ad0
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [0x10026650], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov edi, eax
or eax, ebx
je 0x10001b2d
jmp 0x10001b35
push str.AutobioWuauservEvent
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10026658], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x10002230
push 0
push 0
mov byte [0x10024a30], 1
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10001b2d
cmp eax, 0xffffffff
je 0x10001b2d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, edi
mov byte [0x1002664d], 1
or eax, ebx
jne 0x10001b4a
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
call fcn.10001160
mov ecx, eax
or ecx, edx
je 0x10001b59
mov edi, eax
mov ebx, edx
call fcn.10001380
mov ecx, eax
or ecx, edx
je 0x10001b68
mov edi, eax
mov ebx, edx
push 0x400
lea eax, [esp + 0x834]
xorps xmm0, xmm0
push 0
push eax
movlpd qword [esp + 0x1c], xmm0
call fcn.10008640
add esp, 0xc
mov dword [esp + 0x20], 0x200
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x834]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea eax, [esp + 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x400
mov esi, eax
lea eax, [esp + 0x34]
push 0
push eax
call fcn.10008640
add esp, 8
lea eax, [esp + 0x834]
mov edx, 0x100
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.10001100
lea eax, [esp + 0x30]
push 0x5c
push eax
call fcn.10007985
xor ecx, ecx
add esp, 4
mov word [eax], cx
lea ecx, [esp + 0x34]
call fcn.10001090
push 0x400
lea eax, [esp + 0x434]
push 0
push eax
call fcn.10008640
add esp, 0xc
lea eax, [esp + 0x430]
push esi
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingLocalDumps_s
push 0x200
push eax
call fcn.10001050
push 2
lea eax, [esp + 0x444]
mov edx, 0x100
push str.DumpType
push eax
call fcn.10002a80
mov esi, eax
mov dword [esp + 0x38], edx
mov eax, edx
mov ecx, esi
add esp, 0x1c
or ecx, eax
jne 0x10001c65
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
push 6
lea eax, [esp + 0x434]
mov edx, 0x100
push str.DumpCount
push eax
call fcn.10002a80
mov ecx, eax
add esp, 0xc
or ecx, edx
je 0x10001c8d
mov esi, eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x30]
mov edx, 0x100
push eax
lea eax, [esp + 0x434]
push str.DumpFolder
push eax
call fcn.10002ba0
mov ecx, eax
add esp, 0xc
or ecx, edx
je 0x10001cb8
mov esi, eax
mov ecx, edx
jmp 0x10001cbc
mov ecx, dword [esp + 0x1c]
mov eax, esi
or eax, ecx
je 0x10001cc6
mov edi, esi
mov ebx, ecx
cmp byte [0x1002664c], 0
jne 0x10001d20
call fcn.10005780
call fcn.10004980
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10004e50
push 0x10001780
push 0x10026648
call fcn.10004200
call fcn.100049e0
test eax, eax
je 0x10001d19
neg eax
cdq
mov edi, eax
mov ebx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc28]
xor ecx, esp
call fcn.10006816
mov esp, ebp
pop ebp
ret
mov byte [0x1002664c], 1
mov eax, edi
mov edx, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc28]
xor ecx, esp
call fcn.10006816
mov esp, ebp
pop ebp
ret
call sym.CrashDumpHelper.dll_UnInitCrashDumpHelper
mov ecx, dword [esp + 0xc34]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
or edx, eax
call fcn.10006816
mov esp, ebp
pop ebp
ret