Function at 0x10011147
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push esi
mov esi, esp
add esp, 0xffffffdc
mov eax, dword [section..data]
xor eax, esi
mov dword [esi - 4], eax
mov eax, dword [esi + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push edi
xor edi, edi
push ebp
mov dword [esi - 0x1c], eax
mov eax, dword [esi + 0xc]
push edi
mov dword [esi - 0x20], eax
call ebx
mov ebp, eax
mov dword [esi - 0x18], ebp
call fcn.1000c36d
mov dword [esi - 0x14], eax
cmp dword [0x10020138], edi
jne 0x1001123a
push 0x800
push edi
push 0x1001a5fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebp, eax
or ebp, ebp
jne 0x100111c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1001131a
push edi
push edi
push 0x1001a5fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebp, eax
test ebp, ebp
je 0x1001131a
push str.MessageBoxW
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001131a
push eax
call ebx
push str.GetActiveWindow
push ebp
mov dword [0x10020138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push ebp
mov dword [0x1002013c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push ebp
mov dword [0x10020140], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10020148], eax
or eax, eax
je 0x10011237
push str.GetProcessWindowStation
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10020144], eax
mov ebp, dword [esi - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
or eax, eax
je 0x1001125f
mov eax, dword [esi - 0x1c]
test eax, eax
je 0x10011252
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi - 0x14], edi
je 0x10011274
push 4
pop eax
jmp 0x1001131c
cmp dword [esi - 0x14], edi
je 0x10011274
push dword [0x10020138]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10011259
mov eax, dword [0x10020144]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ebp
je 0x100112d2
cmp dword [0x10020148], ebp
je 0x100112d2
push eax
call ebx
push dword [0x10020148]
mov dword [esi - 0x14], eax
call ebx
mov ecx, dword [esi - 0x14]
mov dword [esi - 0x18], eax
or ecx, ecx
je 0x100112d2
test eax, eax
je 0x100112d2
call ecx
test eax, eax
je 0x100112c7
lea ecx, [esi - 0x24]
push ecx
lea ecx, [esi - 0x10]
push 0xc
push ecx
push 1
push eax
call dword [esi - 0x18]
test eax, eax
je 0x100112c7
test byte [esi - 8], 1
jne 0x100112d2
mov ebp, dword [esi + 0x10]
or ebp, 0x200000
jmp 0x10011302
mov eax, dword [0x1002013c]
cmp eax, ebp
je 0x100112ff
push eax
call ebx
test eax, eax
je 0x100112ff
call eax
mov edi, eax
test edi, edi
je 0x100112ff
mov eax, dword [0x10020140]
cmp eax, ebp
je 0x100112ff
push eax
call ebx
test eax, eax
je 0x100112ff
push edi
call eax
mov edi, eax
mov ebp, dword [esi + 0x10]
push dword [0x10020138]
call ebx
or eax, eax
je 0x1001131a
push ebp
push dword [esi - 0x20]
push dword [esi - 0x1c]
push edi
call eax
jmp 0x1001131c
xor eax, eax
pop ebp
mov ecx, dword [esi - 4]
pop edi
pop ebx
xor ecx, esi
call fcn.10006e5b
mov esp, esi
pop esi
ret