Function at 0x10074dc
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x101b0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
xor ebx, ebx
mov dword [ebp - 0xd8], ebx
cmp byte [0x101b19d], bl
jne 0x1007544
lea eax, [ebp - 0xd8]
push eax
push 0x1001b30
call sub.slc.dll_SLGetWindowsInformationDWORD
cmp eax, ebx
jl 0x100753d
cmp dword [ebp - 0xd8], ebx
jne 0x1007544
mov eax, 0x80070005
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101367b
leave
ret 4
mov byte [0x101b19d], 1
push 0xffffffffffffffff
mov byte [esi + 0x3c], bl
call sub.IMM32.dll_ImmDisableTextFrameService
push ebx
push 3
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_SetProcessShutdownParameters]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xd4], 0x1001648
mov dword [ebp - 0xd0], ebx
call fcn.010059e9
lea ecx, [ebp - 0xc4]
call fcn.010059e9
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.01005c5a
test al, al
jne 0x10075c2
mov esi, 0x80004005
lea ecx, [ebp - 0xc4]
call fcn.01005af2
lea ecx, [ebp - 0x64]
call fcn.01005af2
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x1001648
call fcn.0100426b
mov eax, esi
jmp 0x100752d
push ebx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0xd4]
call fcn.01004a0e
push ebx
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xd4]
call fcn.01004ad3
lea ecx, [ebp - 0x100]
call fcn.01006cc7
push ebx
push 0x15
lea eax, [ebp - 0x17c]
push eax
call fcn.01005b8c
push eax
lea ecx, [ebp - 0x100]
call fcn.01007003
lea ecx, [ebp - 0x17c]
call fcn.01005af2
push ebx
push 0xb
lea eax, [ebp - 0x17c]
push eax
call fcn.01005bb6
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f4c
lea ecx, [ebp - 0x17c]
call fcn.01005af2
push ebx
push 0xb
lea eax, [ebp - 0x17c]
push eax
call fcn.01005be0
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f4c
lea ecx, [ebp - 0x17c]
call fcn.01005af2
push ebx
push 0xb
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f4c
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xd4]
call fcn.01004b98
push ebx
push ebx
push ebx
push 2
push 6
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
mov dword [ebp - 0xcc], eax
jl 0x10077b5
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0xe0]
push ecx
push ebx
push eax
push 0x1007173
push ebx
push ebx
mov dword [esi + 0x44], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
push 0x43
mov dword [ebp - 0xdc], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne byte [ebp - 0xc5]
cmp byte [ebp - 0xc5], bl
jne 0x100771d
cmp byte [0x101b19d], bl
jne 0x100771d
push 5
push 4
push 0x101b334
call fcn.0100436b
cmp eax, ebx
mov dword [ebp - 0xcc], eax
jl 0x100771d
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov dword [ebp - 0xcc], eax
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x100772e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x44], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1007751
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
push eax
call edi
test eax, eax
jg 0x1007737
pop edi
cmp byte [ebp - 0xc5], bl
jne 0x1007782
cmp dword [ebp - 0xcc], ebx
jl 0x1007782
push 0x101b334
call fcn.010043b1
mov dword [ebp - 0xcc], eax
push ebx
push ebx
push 0x12
push dword [ebp - 0xe0]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0xffffffffffffffff
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
cmp dword [ebp - 0xcc], ebx
jne 0x10077cf
cmp byte [0x101b19c], bl
je 0x10077cf
mov dword [ebp - 0xcc], 0x16
lea ecx, [ebp - 0x100]
call fcn.010070fe
mov esi, dword [ebp - 0xcc]
jmp 0x1007593