Function at 0x401700
Capabilities:
Link many functions at runtime
Lock the desktop

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4091c8
push 0x402908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x848
push ebx
push esi
push edi
mov edx, dword [ebp + 0x10]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x400
jae 0x402131
cmp byte [edx], 0x20
jne 0x40174d
inc eax
cmp byte [eax + edx], 0x20
je 0x401746
lea edi, [eax + edx]
lea edx, [ebp - 0x418]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.LockWorkStation
lea ecx, [ebp - 0x418]
push ecx
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x401796
call dword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x402131
push 5
push str._Msg
lea edx, [ebp - 0x418]
push edx
call fcn.00408d00
add esp, 0xc
test eax, eax
jne 0x401ab5
mov dword [ebp - 0x46c], 0x40030
lea eax, [ebp - 0x413]
mov dword [ebp - 0x488], eax
cmp byte [ebp - 0x413], 0x20
jne 0x4017df
inc eax
cmp byte [eax], 0x20
je 0x4017d3
mov dword [ebp - 0x488], eax
cmp byte [eax], 0x22
jne 0x4017eb
inc eax
mov dword [ebp - 0x488], eax
push 0x40b2c0
push eax
call fcn.00402790
add esp, 8
mov esi, eax
test esi, esi
je 0x40185a
mov byte [esi], 0
add esi, 2
cmp byte [esi], 0x20
jne 0x401810
inc esi
cmp byte [esi], 0x20
je 0x40180a
cmp byte [esi], 0x22
jne 0x401816
inc esi
xor eax, eax
mov cl, byte [esi]
cmp cl, 0x22
je 0x40182c
test cl, cl
je 0x40182c
inc eax
mov cl, byte [esi + eax]
cmp cl, 0x22
jne 0x40181f
cmp byte [esi + eax], 0x22
jne 0x401837
mov byte [esi + eax], 0
inc eax
cmp byte [esi + eax], 0x20
jne 0x401844
inc eax
cmp byte [esi + eax], 0x20
je 0x40183d
add eax, esi
cmp byte [eax], 0
je 0x40185a
push eax
call fcn.0040277b
add esp, 4
mov dword [ebp - 0x46c], eax
push str.MWRtl.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x460], eax
test eax, eax
jne 0x401885
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x3fc
mov eax, dword [ebp - 0x460]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
mov edi, eax
push 0x41a
mov ecx, dword [ebp - 0x460]
push ecx
call ebx
mov ebx, eax
test edi, edi
je 0x401a90
test ebx, ebx
je 0x401a90
lea edx, [ebp - 0x47c]
push edx
push esi
call edi
mov al, byte [0x40deb0]
mov byte [ebp - 0x45c], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x45b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x45c]
push ecx
push 0x10
lea edx, [ebp - 0x47c]
push edx
call ebx
mov dword [ebp - 0x484], 2
push 0
lea eax, [ebp - 0x45c]
push eax
push 0x40b2ac
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
mov ebx, eax
cmp ebx, 4
jbe 0x4019c8
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x490], eax
test eax, eax
je 0x4019c8
mov dl, byte [0x40deb0]
mov byte [ebp - 0x594], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x593]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x698], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x697]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x594]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea edx, [ebp - 0x698]
push edx
push 0
mov eax, dword [ebp - 0x490]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea ecx, [ebp - 0x698]
push ecx
lea edx, [ebp - 0x594]
push edx
call fcn.00408db0
add esp, 8
test eax, eax
je 0x4019b9
xor ebx, ebx
mov eax, dword [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019ca
xor ebx, ebx
test ebx, ebx
jne 0x401a68
push 0xa
lea ecx, [ebp - 0x6b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00408cd2
add esp, 0xc
push eax
lea edx, [ebp - 0x45c]
push edx
push 0x40b2ac
mov edi, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
call edi
push 0x47
push ebx
push ebx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push eax
call fcn.00401560
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x46c]
push eax
mov ecx, dword [ebp - 0x488]
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
push ebx
call fcn.00401560
add esp, 4
push 0
lea edx, [ebp - 0x45c]
push edx
push 0x40b2ac
call edi
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x484]
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xb
push str._SuperHook
lea edx, [ebp - 0x418]
push edx
call fcn.00408d00
add esp, 0xc
test eax, eax
jne 0x401ba1
lea esi, [ebp - 0x40d]
cmp byte [ebp - 0x40d], 0x20
jne 0x401ae8
inc esi
cmp byte [esi], 0x20
je 0x401ae2
push esi
call fcn.004026f0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x402131
mov edx, esi
mov al, byte [0x40deb0]
mov byte [ebp - 0x7c0], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x7bf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [esi]
cmp al, 0x20
je 0x401b2b
test al, al
je 0x401b2b
inc edx
mov al, byte [edx]
cmp al, 0x20
jne 0x401b20
cmp byte [edx], 0x20
jne 0x401b36
inc edx
cmp byte [edx], 0x20
je 0x401b30
cmp byte [edx], 0
jne 0x401b60
lea edx, [ebp - 0x7c0]
mov edi, str.MWShHook.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x401b82
lea esi, [ebp - 0x7c0]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov eax, esi
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401590
lea ecx, [ebp - 0x7c0]
push ecx
push ebx
call fcn.004010d0
add esp, 8
jmp 0x402131
push str._RefreshShellView
lea edx, [ebp - 0x418]
push edx
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x401bc3
call fcn.00401610
jmp 0x402131
push 0xf
push str._ScreenCapture
lea eax, [ebp - 0x418]
push eax
call fcn.00408d00
add esp, 0xc
test eax, eax
jne 0x401ca6
lea ecx, [ebp - 0x7cc]
push ecx
lea edx, [ebp - 0x7dc]
push edx
lea eax, [ebp - 0x7d4]
push eax
push str._d__d__d
lea ecx, [ebp - 0x409]
push ecx
call fcn.004026bc
add esp, 0x14
cmp eax, 3
je 0x401c27
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x22
lea edx, [ebp - 0x409]
push edx
call fcn.00402600
add esp, 8
mov esi, eax
test esi, esi
jne 0x401c56
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc esi
push 0x22
push esi
call fcn.00402600
add esp, 8
test eax, eax
je 0x401c69
mov byte [eax], 0
push 0x41
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push eax
call fcn.00401560
mov edi, eax
mov eax, dword [ebp - 0x7cc]
push eax
mov ecx, dword [ebp - 0x7dc]
push ecx
mov edx, dword [ebp - 0x7d4]
push edx
push esi
call fcn.00402210
push edi
call fcn.00401560
add esp, 0x18
jmp 0x402131
push str._WatermarkChange
lea eax, [ebp - 0x418]
push eax
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x401d0e
push eax
push str.MWCbdV_Class
push eax
push eax
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
call edi
mov esi, eax
test esi, esi
je 0x402131
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
push 0xffffffffffffffec
push esi
call ebx
test al, 0x20
je 0x401cf7
push 0
push 0
push 0x470
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push str.MWCbdV_Class
push esi
push 0
call edi
mov esi, eax
test esi, esi
jne 0x401cde
jmp 0x402131
push str._ICHardwareMessage
lea ecx, [ebp - 0x418]
push ecx
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x401eed
push str.MWHwMan.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x401d51
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x406
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov ebx, eax
push 0x410
push edi
call esi
mov dword [ebp - 0x7ec], eax
push 0xbfe
push edi
call esi
mov dword [ebp - 0x80c], eax
push 0xc08
push edi
call esi
mov dword [ebp - 0x7fc], eax
push 0x1f40
push edi
call esi
mov dword [ebp - 0x7f8], eax
push 0x1f4a
push edi
call esi
mov dword [ebp - 0x818], eax
push 0x1f54
push edi
call esi
mov dword [ebp - 0x808], eax
push 0x1f5e
push edi
call esi
mov dword [ebp - 0x81c], eax
test ebx, ebx
je 0x401ece
mov eax, dword [ebp - 0x7ec]
test eax, eax
je 0x401ece
push 0x46
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x810], eax
push eax
call fcn.00401560
add esp, 4
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x80c]
test eax, eax
je 0x401e06
call eax
mov eax, dword [ebp - 0x7f8]
test eax, eax
je 0x401e26
mov esi, dword [ebp - 0x808]
test esi, esi
je 0x401e26
push 0
call eax
test eax, eax
je 0x401e26
push 0
call esi
call dword [ebp - 0x7ec]
mov esi, eax
push 0
call ebx
mov eax, dword [ebp - 0x7fc]
test eax, eax
je 0x401e3e
call eax
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x401e4a
call eax
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x401e56
call eax
mov edx, dword [ebp - 0x814]
push edx
call fcn.00401560
add esp, 4
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
call dword [ebp - 0x7ec]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, esi
je 0x402131
push 0x1ff
push 0
push 0
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov edi, eax
push edi
call fcn.00401560
add esp, 4
mov esi, eax
call fcn.00401610
cmp ebx, 1
jne 0x401eb9
call fcn.004013c0
push esi
call fcn.00401560
add esp, 4
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x402131
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str._DevReinit
lea ecx, [ebp - 0x418]
push ecx
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x401f0f
call sub.MWDevIo.dll_Ordinal_430
jmp 0x402131
push 6
push str._SecU
lea edx, [ebp - 0x418]
push edx
call fcn.00408d00
add esp, 0xc
test eax, eax
jne 0x402131
lea esi, [ebp - 0x412]
cmp byte [ebp - 0x412], 0x20
jne 0x401f42
inc esi
cmp byte [esi], 0x20
je 0x401f3c
push str.start
push esi
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x4020e4
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x830]
push ecx
call fcn.00401510
add esp, 8
test eax, eax
jne 0x401f88
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.GlobalMWUSER_SECU_524FD2DC_0CA7_43CE_91E7_C9F23D9466A5
push 0
push 0
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
mov dword [ebp - 0x834], edi
test edi, edi
jne 0x401fc2
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401fee
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.MWSecU32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x824], esi
test esi, esi
jne 0x402024
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffc
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0
push 1
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov ebx, eax
mov dword [ebp - 0x850], ebx
push 2
push esi
call edi
mov edi, eax
mov dword [ebp - 0x84c], edi
test ebx, ebx
je 0x4020a1
test edi, edi
je 0x4020a1
call ebx
test eax, eax
jne 0x40207f
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.00402852
add esp, 8
mov eax, 0xfffffffa
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x834]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call edi
mov dword [ebp - 4], 0xffffffff
call fcn.004020cd
jmp 0x402131
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call fcn.00402852
add esp, 8
mov eax, 0xfffffffb
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.stop
push esi
call fcn.00408db0
add esp, 8
test eax, eax
jne 0x402131
push str.GlobalMWUSER_SECU_524FD2DC_0CA7_43CE_91E7_C9F23D9466A5
push eax
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
test esi, esi
jne 0x402123
or eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10