Function at 0x1007495
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x101b0f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
xor ebx, ebx
mov dword [ebp - 0xd8], ebx
cmp byte [0x101b19d], bl
jne 0x10074fd
lea eax, [ebp - 0xd8]
push eax
push 0x1001b10
call sub.slc.dll_SLGetWindowsInformationDWORD
cmp eax, ebx
jl 0x10074f6
cmp dword [ebp - 0xd8], ebx
jne 0x10074fd
mov eax, 0x80070005
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0101342b
leave
ret 4
mov byte [0x101b19d], 1
push 0xffffffffffffffff
mov byte [esi + 0x3c], bl
call sub.IMM32.dll_ImmDisableTextFrameService
push ebx
push 3
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_SetProcessShutdownParameters]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0xd4], 0x1001648
mov dword [ebp - 0xd0], ebx
call fcn.010059a2
lea ecx, [ebp - 0xc4]
call fcn.010059a2
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.01005c13
test al, al
jne 0x100757b
mov esi, 0x80004005
lea ecx, [ebp - 0xc4]
call fcn.01005aab
lea ecx, [ebp - 0x64]
call fcn.01005aab
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xd4], 0x1001648
call fcn.0100424b
mov eax, esi
jmp 0x10074e6
push ebx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0xd4]
call fcn.010049c8
push ebx
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xd4]
call fcn.01004a8d
lea ecx, [ebp - 0x100]
call fcn.01006c80
push ebx
push 0x15
lea eax, [ebp - 0x17c]
push eax
call fcn.01005b45
push eax
lea ecx, [ebp - 0x100]
call fcn.01006fbc
lea ecx, [ebp - 0x17c]
call fcn.01005aab
push ebx
push 0xb
lea eax, [ebp - 0x17c]
push eax
call fcn.01005b6f
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f05
lea ecx, [ebp - 0x17c]
call fcn.01005aab
push ebx
push 0xb
lea eax, [ebp - 0x17c]
push eax
call fcn.01005b99
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f05
lea ecx, [ebp - 0x17c]
call fcn.01005aab
push ebx
push 0xb
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x100]
call fcn.01006f05
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xd4]
call fcn.01004b52
push ebx
push ebx
push ebx
push 2
push 6
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
mov dword [ebp - 0xcc], eax
jl 0x100776e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0xe0]
push ecx
push ebx
push eax
push 0x100712c
push ebx
push ebx
mov dword [esi + 0x44], eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
push 0x43
mov dword [ebp - 0xdc], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne byte [ebp - 0xc5]
cmp byte [ebp - 0xc5], bl
jne 0x10076d6
cmp byte [0x101b19d], bl
jne 0x10076d6
push 5
push 4
push 0x101b334
call fcn.0100434b
cmp eax, ebx
mov dword [ebp - 0xcc], eax
jl 0x10076d6
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov dword [ebp - 0xcc], eax
mov eax, dword [esi + 0x44]
cmp eax, ebx
je 0x10076e7
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x44], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100770a
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
push eax
call edi
test eax, eax
jg 0x10076f0
pop edi
cmp byte [ebp - 0xc5], bl
jne 0x100773b
cmp dword [ebp - 0xcc], ebx
jl 0x100773b
push 0x101b334
call fcn.01004391
mov dword [ebp - 0xcc], eax
push ebx
push ebx
push 0x12
push dword [ebp - 0xe0]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0xffffffffffffffff
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xdc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
cmp dword [ebp - 0xcc], ebx
jne 0x1007788
cmp byte [0x101b19c], bl
je 0x1007788
mov dword [ebp - 0xcc], 0x16
lea ecx, [ebp - 0x100]
call fcn.010070b7
mov esi, dword [ebp - 0xcc]
jmp 0x100754c