Function at 0x40bd20
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Delete directory
Delete file
Resume thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x135c
call fcn.0041c7e0
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x12e8], edi
mov dword [ebp - 0x12e4], 0
call fcn.004013c0
push 0x28
push 0x4bbef0
mov dword [0x4bb244], eax
mov dword [0x4b6b24], 0x10000
call fcn.0040db30
push 0x28
push 0x4bbef0
call fcn.0040db80
push str.smmon.exe
call fcn.00401b36
push 0xc8
lea eax, [ebp - 0x3ec]
push eax
push str.WINRSH_START
push 0
call fcn.004017d5
add esp, 0x24
test eax, eax
jne 0x40bdc6
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x12e4]
push eax
push 0x4bb240
push 0x4bbef0
call fcn.0040d810
add esp, 0x10
mov dword [0x4bb21c], eax
push 0
lea eax, [ebp - 0x12e4]
push eax
push 0x4bb240
push 0x4bbef0
call fcn.0040d810
mov esi, dword [ebp - 0x12e4]
add esp, 0x10
cmp dword [0x4bb1a4], 0
mov dword [0x4bb21c], eax
je 0x40bede
call fcn.00401410
test eax, eax
je 0x40be55
push 0
call fcn.004010aa
add esp, 4
test eax, eax
je 0x40be55
push 0
push 0
call fcn.0040128a
push eax
push str._s_smmon.exe
lea eax, [ebp - 0xcc]
push 0xc8
push eax
call fcn.0041c5d0
push 0
push str._runkey
lea eax, [ebp - 0xcc]
push eax
push str.runas
push 0
call fcn.00401730
add esp, 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x4bb244]
dec eax
je 0x40becc
dec eax
je 0x40be85
push 0x10
push 0
push str.SMMON_does_not_support_this_Windows_operating_system_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret 0x10
push 2
push dword [0x4bb240]
push 0x4bbef0
push str.smmon.exe
call fcn.00401947
push dword [0x4bb244]
push esi
push str.smmon.exe
call fcn.00401028
add esp, 0x1c
dec eax
je 0x40beb8
sub eax, 2
jne 0x40bede
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret 0x10
push 1
push esi
push str.smmon.exe
call fcn.00401028
add esp, 0xc
jmp 0x40beb0
cmp esi, 3
jne 0x40befc
call fcn.0040e210
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret 0x10
push ebx
push str.Global62B0B8D7_B442_4077_94DA_852DEF55065C
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
mov dword [ebp - 0x12ec], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40bf41
test ebx, ebx
je 0x40bf2c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret 0x10
push edi
call fcn.0040d280
mov ebx, dword [0x4bb240]
add esp, 4
mov esi, eax
mov dword [ebp - 0x12e4], esi
cmp ebx, 1
jle 0x40c0ae
mov edi, dword [0x4bbef0]
xor esi, esi
mov edx, 0x49766c
mov ecx, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40bf90
test al, al
je 0x40bf8c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40bf90
add ecx, 2
add edx, 2
test al, al
jne 0x40bf70
xor eax, eax
jmp 0x40bf95
sbb eax, eax
or eax, 1
test eax, eax
je 0x40bfe0
dec ebx
lea ebx, [ebx]
cmp esi, ebx
jge 0x40bfda
mov eax, dword [esi*4 + 0x4bbef4]
inc esi
mov ecx, 0x49766c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bfd1
test dl, dl
je 0x40bfcd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bfd1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bfb1
xor eax, eax
jmp 0x40bfd6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40bfa0
mov ebx, dword [0x4bb240]
xor esi, esi
mov eax, str._parent_pid
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x40c007
test cl, cl
je 0x40c003
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x40c007
add edi, 2
add eax, 2
test cl, cl
jne 0x40bfe7
xor eax, eax
jmp 0x40c00c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40c04d
lea edi, [ebx - 1]
cmp esi, edi
jge 0x40c04d
mov eax, dword [esi*4 + 0x4bbef4]
inc esi
mov ecx, str._parent_pid
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40c044
test dl, dl
je 0x40c040
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40c044
add eax, 2
add ecx, 2
test dl, dl
jne 0x40c024
xor eax, eax
jmp 0x40c049
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40c013
lea eax, [ebx - 1]
cmp esi, eax
jge 0x40c0a2
push str.SMMONSTARTED
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0xa
push 0
push dword [esi*4 + 0x4bbef4]
mov edi, eax
call fcn.00422570
add esp, 0xc
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call eax
test esi, esi
je 0x40c0a2
push 0x1d4c0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp - 0x12e8]
mov esi, dword [ebp - 0x12e4]
push 0
push 0
call fcn.0040128a
push eax
push str._s_tmp
lea eax, [ebp - 0xcc]
push 0xc8
push eax
call fcn.0041c5d0
add esp, 0x18
lea eax, [ebp - 0x6c4]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c173
push 0
push 0
call fcn.0040128a
push eax
push str._s_smupdate.exe
lea eax, [ebp - 0x25c]
push 0xc8
push eax
call fcn.0041c5d0
push 0
push 0
call fcn.0040128a
push eax
push str._s_tmp_smupdate.exe
lea eax, [ebp - 0x324]
push 0xc8
push eax
call fcn.0041c5d0
add esp, 0x30
lea eax, [ebp - 0x25c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push str.Layered_Solutions__Inc.
push str.Copyright__c__1994_2024
push str.05.00.20
push str.Layered_Solutions_Monitor
push esi
push edi
call fcn.00401091
push str.Monitor_started_n
call fcn.004017cb
add esp, 0x1c
call fcn.0040e7b0
push 2
push 2
lea ecx, [ebp - 0x584]
call fcn.004014ab
mov edi, dword [ebp - 0x12e4]
push 1
push edi
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
push 0xbd9
push edi
lea ecx, [ebp - 0x12e0]
call fcn.00401924
push dword [ebp - 0x12d0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0
push 5
call fcn.00401389
push 0
push 0
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0
push 1
call fcn.00401389
add esp, 0x48
call fcn.0040eb70
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x1308]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov esi, eax
test esi, esi
jns 0x40c277
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x194]
push str.Monitor_GetMessage___returned__d_error_d_n
push eax
call fcn.0041bff0
lea eax, [ebp - 0x194]
push eax
call fcn.004017cb
add esp, 0x14
jmp 0x40c234
je 0x40c5fa
mov eax, dword [ebp - 0x1304]
cmp eax, 0x2b1
jne 0x40c360
mov eax, dword [ebp - 0x1300]
cmp eax, 8
je 0x40c2a5
cmp eax, 5
je 0x40c2a5
push str.Session_change_LOCK__skip_
jmp 0x40c2d0
push 0
call fcn.004229b0
mov esi, dword [0x4bb230]
mov ecx, dword [0x4bb234]
add esp, 4
add esi, 0x3c
adc ecx, 0
cmp ecx, edx
jl 0x40c2e6
jg 0x40c2cb
cmp esi, eax
jbe 0x40c2e6
push str.Session_change_UNLOCK___skip_as_already_had_event
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x10
jmp 0x40c234
push 0
call fcn.004229b0
push str.Session_change_UNLOCK
push 0x495ff1
push 0
push 3
mov dword [0x4bb230], eax
mov dword [0x4bb234], edx
call fcn.004017f8
push 0
push 0
push dword [0x4bb244]
push edi
call fcn.00401122
add esp, 0x24
push 0
push 0x834
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x4bbef0
call fcn.0040e910
push eax
push 0x4bbef0
push dword [0x4bb198]
mov dword [0x4bb240], eax
call fcn.0040dda0
add esp, 0x10
test eax, eax
jne 0x40c234
push str.Could_not_start_process___
jmp 0x40c2d0
cmp eax, 0xbd9
jne 0x40c504
mov edi, dword [0x4bb198]
push 0
call fcn.004229b0
mov esi, dword [0x4bb230]
mov ecx, dword [0x4bb234]
add esp, 4
add esi, 0x3c
adc ecx, 0
cmp ecx, edx
jl 0x40c3b8
jg 0x40c397
cmp esi, eax
jbe 0x40c3b8
push str.IP_Address_Change_event___skip_as_already_had_event
push 0x495ff1
push 0
push 3
call fcn.004017f8
mov edi, dword [ebp - 0x12e4]
add esp, 0x10
jmp 0x40c234
push 0
call fcn.004229b0
push str.IP_Address_Change_detected
push 0x495ff1
push 0
push 3
mov dword [0x4bb230], eax
mov dword [0x4bb234], edx
call fcn.004017f8
push 0x4bbef0
push dword [0x4bb240]
call fcn.0040dc90
push 0x4bbef0
push dword [0x4bb240]
push dword [0x4bb244]
push edi
call fcn.00401122
push 2
call fcn.0040e0e0
call fcn.00401195
push dword [0x4bb210]
push str.PowerBroadcast_bConnectionsPending__d
push 0x495ff1
push 1
push 3
call fcn.004017f8
add esp, 0x44
call fcn.0040e0f0
cmp eax, 2
jne 0x40c445
call fcn.00401ad2
push 0
call fcn.0040e0e0
add esp, 4
push 0x14
push 0x4bbef0
call fcn.0040db80
push 0x200
push 0
mov dword [0x4bb240], 0
call fcn.00401816
push 0xc8
lea eax, [ebp - 0xcc]
push eax
push str.WINRSH_START
push 0
call fcn.004017d5
add esp, 0x20
test eax, eax
jne 0x40c4ab
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x12e8]
push eax
push 0x4bb240
push 0x4bbef0
call fcn.0040d810
add esp, 0x10
mov dword [0x4bb21c], eax
push 0
lea eax, [ebp - 0x12e8]
push eax
push 0x4bb240
push 0x4bbef0
call fcn.0040d810
add esp, 0x10
cmp dword [0x4bb210], 0
mov dword [0x4bb21c], eax
jle 0x40c4ed
call fcn.004010e1
test eax, eax
je 0x40c4e7
push 1
call fcn.0040e0e0
add esp, 4
dec dword [0x4bb210]
push 0
push 0
push 0x40b
push edi
call ebx
mov edi, dword [ebp - 0x12e4]
jmp 0x40c234
cmp eax, 0x312
jne 0x40c555
push dword [ebp - 0x1300]
push str.HOTKEY_received__d
push 0x495ff1
push 1
push 3
call fcn.004017f8
push edi
push 0
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push dword [ebp - 0x1300]
push 8
call fcn.00401389
add esp, 0x38
jmp 0x40c234
cmp eax, 0x416
je 0x40c5ed
cmp eax, 0x417
jne 0x40c5ce
push str.Reload_HOTKEY_from_smsign
push 0x495ff1
push 0
push 3
call fcn.004017f8
push 0
push 0
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0
push 5
call fcn.00401389
push 0
push 0
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0x495ff1
push 0
push 1
call fcn.00401389
add esp, 0x58
jmp 0x40c234
lea eax, [ebp - 0x1308]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1308]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40c234
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
jmp 0x40c627
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push 0
lea eax, [ebp - 0x194]
push str.Monitor_GetMessage___returned__d_error_d_n
push eax
call fcn.0041bff0
lea eax, [ebp - 0x194]
push eax
call fcn.004017cb
add esp, 0x14
xor esi, esi
push dword [ebp - 0x6dc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x12e0]
mov byte [ebp - 0x6d8], 0
call fcn.004016a9
mov dword [ebp - method.SOL::WSAInitializer.virtual_0], vtable.SOL::WSAInitializer.0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x12ec]
mov dword [ebp - method.SOL::Object.virtual_0], vtable.SOL::Object.0
test eax, eax
je 0x40c670
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40c706
push 0x44
lea eax, [ebp - 0x135c]
push 0
push eax
call fcn.0041c510
xorps xmm0, xmm0
push 0
push 0
mov dword [ebp - 0x135c], 0x44
movq qword [ebp - 0x1318], xmm0
movq qword [ebp - 0x1310], xmm0
call fcn.0040128a
push eax
push str._s_smmon.exe
lea eax, [ebp - 0xcc]
push 0xc8
push eax
call fcn.0041c5d0
add esp, 0x24
lea eax, [ebp - 0x1318]
push eax
lea eax, [ebp - 0x135c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push str.Watchdog_restarting_monitor_n
call fcn.004017cb
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call ebx
push eax
lea eax, [ebp - 0x194]
push str.Monitor_exiting_error_d_n
push eax
call fcn.0041bff0
lea eax, [ebp - 0x194]
push eax
call fcn.004017cb
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1300]
add esp, 0x10
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret 0x10