Function at 0xb8f560
Capabilities:
Create thread
Lock the desktop

Disassembly:
push 0x188
mov eax, 0xbc8b32
call fcn.00bc132b
mov esi, dword [ebp + 0xc]
mov ecx, 0x1f7
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
cmp esi, ecx
jbe 0xbd4fcd
mov eax, 0x1388
cmp esi, eax
jbe 0xbd5630
sub esi, 0x1389
je 0xbd5741
sub esi, 0x8ca7
je 0xbd5612
sub esi, 0x35
jne 0xbd5729
mov ecx, dword [edi + 0x1c4]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xd4]
cmp esi, fcn.00ba5720
jne 0xbd5621
call fcn.00ba5720
call fcn.00bc12da
ret 0x14
je 0xbd51dd
lea eax, [esi - 0x191]
cmp eax, 0x2f
ja case.0xbd4fe9.406
movzx eax, byte [eax + 0xbd57c9]
jmp dword [eax*4 + 0xbd5765]
xor ebx, ebx
push ebx
push 0x2001
push ebx
push 0xc368a0
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
jmp case.0xbd4fe9.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
push 1
push 0xb2f6c4
push dword [edi + 0x1c0]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetPropW]
push edi
mov byte [edi + 0x1bc], 1
call fcn.00b8ffb0
push dword [0xd0a20c]
call dword [sym.imp.SHELL32.dll_Ordinal_54]
jmp case.0xbd4fe9.406
cmp byte [edi + 0xda], 0
jne case.0xbd4fe9.406
cmp byte [ebp + 0x18], 0
lea ecx, [edi - 0x1c]
je 0xbd506b
call fcn.00c37559
jmp case.0xbd4fe9.406
mov eax, dword [0xd0aff8]
neg eax
sbb eax, eax
add eax, 3
push eax
call fcn.00b5af3e
cmp dword [0xd0aff8], 0
lea ecx, [ebp - 0x18d]
sete byte [ebp - 0x18d]
call fcn.00c28aeb
jmp case.0xbd4fe9.406
lea ecx, [edi - 0x1c]
call fcn.00c35fbb
jmp case.0xbd4fe9.406
lea ecx, [edi - 0x1c]
call fcn.00c38066
jmp case.0xbd4fe9.406
cmp byte [edi + 0xda], 0
jne case.0xbd4fe9.406
push 1
push ecx
lea ecx, [edi - 0x1c]
call fcn.00b50f16
jmp case.0xbd4fe9.406
cmp byte [edi + 0xda], 0
jne case.0xbd4fe9.406
xor ebx, ebx
lea ecx, [edi - 0x1c]
push ebx
push ebx
call fcn.00b510f0
jmp case.0xbd4fe9.406
cmp byte [edi + 0xda], 0
jne case.0xbd4fe9.406
push ecx
push 0xb3eca4
lea ecx, [ebp - 0x188]
call fcn.00b80bc1
mov esi, 0xb164f0
lea ecx, [ebp - 0x188]
push 1
mov dword [ebp - 0x188], esi
call fcn.00c3557a
xor ebx, ebx
lea ecx, [ebp - 0x188]
mov dword [ebp - 4], ebx
call fcn.00c35e9e
push ebx
push ebx
lea ecx, [edi - 0x1c]
call fcn.00c37f84
push ebx
lea ecx, [ebp - 0x188]
call fcn.00b80b25
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x188], esi
call fcn.00b80a8a
lea ecx, [ebp - 0xd0]
call fcn.00b84d89
lea ecx, [ebp - 0xdc]
call fcn.00b845a1
lea ecx, [ebp - 0x144]
call fcn.00b8458c
cmp dword [ebp - 0x16c], 1
jne 0xbd51a9
push 0xc21420
mov dword [ebp - 0x16c], 2
call fcn.00b63419
lea edx, [ebp - 0x164]
mov ecx, dword [eax + 4]
call fcn.00c22b6a
mov dword [ebp - 0x16c], 3
cmp dword [ebp - 0x178], ebx
je case.0xbd4fe9.406
lea ecx, [ebp - 0x184]
jmp 0xbd51cd
lea ecx, [ebp - 0xc8]
call fcn.00b54a44
jmp case.0xbd4fe9.406
push 0
push 2
jmp 0xbd51e1
push 0
push 4
xor dl, dl
pop ecx
jmp 0xbd51ee
push dword [edi - 0x18]
xor ecx, ecx
mov dl, 1
inc ecx
call fcn.00c752ea
jmp case.0xbd4fe9.406
test byte [0xd0a5c0], 1
mov ebx, 0xd08200
je 0xbd5212
mov edx, 0xb3d638
mov ecx, ebx
call fcn.00b8e628
mov eax, dword [edi + 0x1c4]
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xcc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [edi + 0x1c4]
push eax
mov edx, dword [eax]
mov esi, dword [edx + 0x118]
mov ecx, esi
call dword [0xd0cffc]
call esi
test byte [0xd0a5c0], 1
je case.0xbd4fe9.406
mov edx, 0xb3d608
mov ecx, ebx
call fcn.00b8e628
jmp case.0xbd4fe9.406
call fcn.00c71a24
call fcn.00c29215
jmp case.0xbd4fe9.406
push ecx
xor ebx, ebx
lea ecx, [ebp - 0xcc]
push 0xb3eca4
mov dword [ebp - 0x18c], ebx
call fcn.00b80bc1
push 1
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xb164f0
call fcn.00c3557a
push edi
mov dword [ebp - 4], 1
call fcn.00c290d0
test eax, eax
je 0xbd53db
cmp esi, 0x193
jne 0xbd52c7
mov eax, 0x217
jmp 0xbd52d9
xor eax, eax
cmp esi, 0x194
setne al
lea eax, [eax*2 + 0x218]
push eax
lea ecx, [edi - 0x1c]
call fcn.00b5114e
push 1
push ebx
push 3
push ebx
push edi
call fcn.00b5bbe0
push ebx
push ebx
push ebx
cmp esi, 0x193
jne 0xbd5350
push ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
test ax, ax
je 0xbd5314
mov dword [ebp - 0x18c], ebx
jmp 0xbd5343
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x18c], esi
test esi, esi
jle 0xbd5337
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0x18c], esi
test esi, esi
js 0xbd5343
mov dword [ebp - 0x18c], 0x80004005
lea ecx, [ebp - 0xcc]
call fcn.00c290f0
jmp 0xbd53bc
xor eax, eax
cmp esi, 0x194
setne al
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
test ax, ax
je 0xbd5376
mov dword [ebp - 0x18c], ebx
jmp 0xbd53a2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0x18c], eax
test eax, eax
jle 0xbd5396
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0x18c], eax
test eax, eax
js 0xbd53a2
mov dword [ebp - 0x18c], 0x80004005
lea ecx, [ebp - 0xcc]
cmp esi, 0x194
jne 0xbd53b7
call fcn.00c35f56
jmp 0xbd53bc
call fcn.00c352db
push ebx
push 0x1f4
push 0x12
push dword [edi - 0x18]
mov dword [edi + 0x5c], ebx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetTimer]
push ebx
push ebx
push 3
push ebx
push edi
call fcn.00b5bbe0
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xcc]
call fcn.00b80b25
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0xb164f0
call fcn.00b80a8a
lea ecx, [ebp - 0x14]
call fcn.00b84d89
lea ecx, [ebp - 0x20]
call fcn.00b845a1
lea ecx, [ebp - 0x88]
call fcn.00b8458c
cmp dword [ebp - 0xb0], 1
jne 0xbd5447
push 0xc21420
mov dword [ebp - 0xb0], 2
call fcn.00b63419
lea edx, [ebp - 0xa8]
mov ecx, dword [eax + 4]
call fcn.00c22b6a
cmp dword [ebp - 0xbc], 0
mov dword [ebp - 0xb0], 3
je case.0xbd4fe9.406
jmp 0xbd51c7
mov eax, dword [edi + 0x1c4]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd0]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp case.0xbd4fe9.406
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xdc]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe0]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe4]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xec]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xe8]
jmp 0xbd5620
push esi
call fcn.00c369cc
jmp case.0xbd4fe9.406
xor ebx, ebx
mov edx, 0xb29030
push ebx
mov ecx, 0xb28430
call fcn.00b9e7ee
neg eax
mov edx, 0xb28430
push 4
sbb esi, esi
mov ecx, reloc.SHCORE.dll_Ordinal_1
lea eax, [ebp - 0x18c]
inc esi
push eax
push 4
push 0xb29030
mov dword [ebp - 0x18c], esi
call fcn.00c26185
test eax, eax
jle 0xbd5536
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xbd5557
mov edx, 0x1522
jmp 0xbd5544
mov edx, 0x152c
mov ecx, dword [ebp + 4]
push eax
push 0xb2b1d4
call fcn.00b913f8
jmp case.0xbd4fe9.406
push ebx
push 1
push 0x5ca
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test esi, esi
mov byte [ebp - 0x18e], bl
lea edx, [ebp - 0x18e]
lea ecx, [ebp - 0x18f]
setne byte [ebp - 0x18f]
call fcn.00c28bc9
jmp case.0xbd4fe9.406
xor ebx, ebx
mov esi, 0xb28430
push ebx
mov edx, 0xb2db58
mov ecx, esi
call fcn.00b9e7ee
neg eax
mov edx, esi
push 4
sbb eax, eax
mov ecx, reloc.SHCORE.dll_Ordinal_1
inc eax
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x194]
push eax
push 4
push 0xb2db58
call fcn.00c26185
test eax, eax
jle 0xbd55d6
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xbd553f
push ebx
push 0xa
push 0x5ca
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
jmp case.0xbd4fe9.406
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf0]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf4]
jmp 0xbd5620
mov eax, dword [edi + 0x1c4]
mov ecx, dword [eax]
mov esi, dword [ecx + 0xd8]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp case.0xbd4fe9.406
je 0xbd5707
sub esi, 0x1fa
je 0xbd56ca
sub esi, 0xb
je 0xbd567e
sub esi, 1
je 0xbd5664
sub esi, 1
jne case.0xbd4fe9.406
push 0x1f
lea ecx, [edi - 0x1c]
call fcn.00c374d2
jmp case.0xbd4fe9.406
xor ebx, ebx
push ebx
push ebx
push 0x5b4
push dword [0xd0ac3c]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_PostMessageW]
jmp case.0xbd4fe9.406
mov eax, dword [0xd0a5c0]
mov esi, 0x4000000
mov ebx, 0xd08200
test esi, eax
je 0xbd56b2
mov edx, 0xb3db70
mov ecx, ebx
call fcn.00b8e628
mov eax, dword [0xd0a5c0]
test esi, eax
je 0xbd56b2
mov edx, 0xb3da30
mov ecx, ebx
call fcn.00b8e628
call fcn.00c360a0
test eax, eax
je case.0xbd4fe9.406
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp case.0xbd4fe9.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
push 1
push 0xb2f6c4
push dword [edi + 0x1c0]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetPropW]
push dword [ebp + 0x10]
mov byte [edi + 0x1bc], 1
push ecx
push ecx
lea ecx, [edi - 0x1c]
call fcn.00c3679a
jmp case.0xbd4fe9.406
push dword [edi - 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_UpdateWindow]
push 0x64
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
push dword [0xd0a20c]
call dword [sym.imp.SHELL32.dll_Ordinal_254]
jmp case.0xbd4fe9.406
sub esi, 0x21
jne case.0xbd4fe9.406
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_Ordinal_91]
jmp case.0xbd4fe9.406
push 3
call dword [sym.imp.SHLWAPI.dll_Ordinal_413]
test eax, eax
je case.0xbd4fe9.406
xor ebx, ebx
push ebx
push ebx
push 0xd
push 0xffffffffffffffff
push ebx
call dword [sym.imp.WINSTA.dll_WinStationSetInformationW]
jmp case.0xbd4fe9.406