Function at 0x536840
Capabilities:
Migrate process to active window station

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c6489
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x318
push esi
push edi
push 0x2000000
push 0
push str.WinSta0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov edi, eax
test edi, edi
je 0x536f8c
push edi
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push edi
call dword [sym.imp.USER32.dll_CloseWindowStation]
push 0x212
lea eax, [ebp - 0x328]
mov byte [ebp - 0x11], 0
push 0
push eax
call fcn.00585a40
add esp, 0xc
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edi, eax
test edi, edi
je 0x536de0
push 0
push 0x212
lea eax, [ebp - 0x328]
push eax
push 2
push edi
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
cmp eax, 1
jne 0x536984
lea ecx, [ebp - 0x328]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x536900
sub ecx, edx
sar ecx, 1
je 0x536984
lea ecx, [ebp - 0x328]
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x536946
test dx, dx
je 0x536942
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x536946
add eax, 4
add ecx, 4
test dx, dx
jne 0x536920
xor eax, eax
jmp 0x53694b
sbb eax, eax
or eax, 1
test eax, eax
je 0x536984
push edi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, 1
jne 0x536a14
lea ecx, [ebp - 0x328]
mov edx, esi
mov eax, ecx
sub edx, eax
jmp 0x536970
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x536970
mov byte [ebp - 0x11], 1
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [ebp - 0x328]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x536994
sub ecx, edx
sar ecx, 1
jne 0x5369fe
push 0x2000000
push 0
push 0
push str.Default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov edi, eax
test edi, edi
je 0x536c34
push edi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, 1
jne 0x536b00
mov ecx, dword [str.Default]
mov dword [esi], ecx
mov eax, dword [0x5f3d08]
mov dword [esi + 4], eax
mov eax, dword [0x5f3d0c]
mov dword [esi + 8], eax
mov eax, dword [0x5f3d10]
push edi
mov dword [esi + 0xc], eax
mov byte [ebp - 0x11], 1
call dword [sym.imp.USER32.dll_CloseDesktop]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
test eax, eax
jns 0x536a2a
fadd qword [0x5f4758]
push str.error
lea ecx, [ebp - 0xd0]
fstp qword [ebp - 0x20]
call fcn.004471f0
fld qword [ebp - 0x20]
lea eax, [ebp - 0xd0]
sub esp, 8
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xb8]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 6
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.004456c0
push str.SetThreadDesktop_
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.004471f0
push str.set_thread_desktop
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 8
call fcn.004471f0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 9
push eax
push 0xc1
lea eax, [ebp - 0x68]
mov ecx, 2
push str.CaptureBuffer.cpp
push eax
lea edx, [ebp - 0x38]
call fcn.004d4b60
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.004470b0
lea ecx, [ebp - 0x68]
call fcn.004470b0
lea ecx, [ebp - 0x44]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 5
push eax
call fcn.00583d37
lea ecx, [ebp - 0xd0]
call fcn.004470b0
jmp 0x537188
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
test eax, eax
jns 0x536b16
fadd qword [0x5f4758]
push str.error
lea ecx, [ebp - 0x68]
fstp qword [ebp - 0x20]
call fcn.004471f0
fld qword [ebp - 0x20]
lea eax, [ebp - 0x68]
sub esp, 8
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xb8]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.004456c0
push 0x20
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.0044a110
mov ecx, dword [str.SetThreadDesktop_]
mov edx, eax
mov dword [ebp - 0x28], 0x13
mov dword [ebp - 0x24], 0x1f
mov dword [ebp - 0x38], edx
mov dword [edx], ecx
mov ecx, dword [0x5f3d50]
mov dword [edx + 4], ecx
mov ecx, dword [0x5f3d54]
mov dword [edx + 8], ecx
mov eax, dword [0x5f3d58]
mov dword [edx + 0xc], eax
mov ax, word [0x5f3d5c]
mov word [edx + 0x10], ax
mov al, byte [0x5f3d5e]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push str.set_thread_desktop
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x12
call fcn.004471f0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x13
push eax
push 0xd7
lea eax, [ebp - 0x38]
mov ecx, 2
push str.CaptureBuffer.cpp
push eax
lea edx, [ebp - 0xd0]
call fcn.004d4b60
add esp, 0x10
lea ecx, [ebp - 0xd0]
call fcn.004470b0
lea ecx, [ebp - 0x38]
call fcn.004470b0
lea ecx, [ebp - 0x44]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0xf
push eax
call fcn.00583d37
lea ecx, [ebp - 0x68]
call fcn.004470b0
jmp 0x537188
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
test eax, eax
jns 0x536c4a
fadd qword [0x5f4758]
mov eax, dword [str.error]
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x38], eax
mov al, byte [0x5e7ec4]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 5
mov byte [ebp - 0x34], al
mov byte [ebp - 0x33], 0
sub esp, 8
mov dword [ebp - 4], 0x14
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x110]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x15
push ecx
lea eax, [ebp - 0xd0]
push eax
push ecx
lea ecx, [ebp - 0x74]
call fcn.004456c0
mov eax, dword [str.OpenDesktop_]
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x68], eax
mov eax, dword [0x5f3d18]
mov dword [ebp - 0x64], eax
mov eax, dword [0x5f3d1c]
mov dword [ebp - 0x60], eax
mov ax, word [0x5f3d20]
mov dword [ebp - 0x54], 0xf
mov dword [ebp - 0x58], 0xe
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], 0
mov eax, dword [str.open_desktop]
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x50], 0
mov dword [ebp - 0x50], eax
mov eax, dword [0x5f3d28]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x5f3d2c]
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x18
push eax
push 0xdd
lea eax, [ebp - 0x68]
mov ecx, 2
push str.CaptureBuffer.cpp
push eax
lea edx, [ebp - 0x50]
call fcn.004d4b60
mov byte [ebp - 4], 0x17
add esp, 0x10
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x536d80
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x536d76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53719d
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x68]
call fcn.004470b0
lea ecx, [ebp - 0x74]
call fcn.00449240
push fcn.00438e00
push 1
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x110]
push 0x40
push eax
call fcn.00583d37
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x10
jb 0x537188
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x53717e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53719d
jmp 0x53717e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
test eax, eax
jns 0x536df6
fadd qword [0x5f4758]
mov eax, dword [str.error]
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x38], eax
movzx eax, byte [0x5e7ec4]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 5
mov byte [ebp - 0x34], al
mov byte [ebp - 0x33], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0xb8]
call fcn.00447260
fld qword [ebp - 0x20]
mov dword [ebp - 0xa0], 0
fstp qword [ebp - 0x88]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
mov byte [ebp - 0x80], 0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x74]
call fcn.004456c0
push 0x20
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xc
call fcn.0044a110
mov ecx, dword [str.OpenInputDesktop_]
mov edx, eax
mov dword [ebp - 0x40], 0x13
mov dword [ebp - 0x3c], 0x1f
mov dword [ebp - 0x50], edx
mov dword [edx], ecx
mov ecx, dword [0x5f3d78]
mov dword [edx + 4], ecx
mov ecx, dword [0x5f3d7c]
mov dword [edx + 8], ecx
mov eax, dword [0x5f3d80]
mov dword [edx + 0xc], eax
movzx eax, word [0x5f3d84]
mov word [edx + 0x10], ax
movzx eax, byte [0x5f3d86]
mov byte [edx + 0x12], al
mov byte [edx + 0x13], 0
push 0x20
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xd
call fcn.0044a110
mov ecx, dword [str.open_input_desktop]
mov edx, eax
mov dword [ebp - 0x58], 0x12
mov dword [ebp - 0x54], 0x1f
mov dword [ebp - 0x68], edx
mov dword [edx], ecx
mov ecx, dword [0x5f3cf4]
mov dword [edx + 4], ecx
mov ecx, dword [0x5f3cf8]
mov dword [edx + 8], ecx
mov eax, dword [0x5f3cfc]
mov dword [edx + 0xc], eax
movzx eax, word [0x5f3d00]
mov word [edx + 0x10], ax
mov byte [edx + 0x12], 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xe
push eax
push 0xc9
push str.CaptureBuffer.cpp
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x68]
mov ecx, 2
call fcn.004d4b60
add esp, 0x10
lea ecx, [ebp - 0x68]
call fcn.004470b0
lea ecx, [ebp - 0x50]
call fcn.004470b0
lea ecx, [ebp - 0x74]
call fcn.00449240
push fcn.00438e00
push 1
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xb8]
push 0x40
jmp 0x536da3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
test eax, eax
jns 0x536fa2
fadd qword [0x5f4758]
mov eax, dword [str.error]
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x38], eax
mov al, byte [0x5e7ec4]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 5
mov byte [ebp - 0x34], al
mov byte [ebp - 0x33], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xb8]
call fcn.00447260
fld qword [ebp - 0x20]
mov dword [ebp - 0xa0], 0
fstp qword [ebp - 0x88]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
mov byte [ebp - 0x80], 0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x74]
call fcn.004456c0
push 0x20
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0044a110
mov ecx, dword [str.OpenWindowStation_]
mov edx, eax
mov dword [ebp - 0x40], 0x14
mov dword [ebp - 0x3c], 0x1f
mov dword [ebp - 0x50], edx
mov dword [edx], ecx
mov ecx, dword [0x5f3cac]
mov dword [edx + 4], ecx
mov ecx, dword [0x5f3cb0]
mov dword [edx + 8], ecx
mov eax, dword [0x5f3cb4]
mov dword [edx + 0xc], eax
mov eax, dword [0x5f3cb8]
mov dword [edx + 0x10], eax
mov byte [edx + 0x14], 0
push 0x20
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.0044a110
mov ecx, dword [str.open_windows_station]
mov edx, eax
mov dword [ebp - 0x58], 0x14
mov dword [ebp - 0x54], 0x1f
mov dword [ebp - 0x68], edx
mov dword [edx], ecx
mov ecx, dword [0x5f3d38]
mov dword [edx + 4], ecx
mov ecx, dword [0x5f3d3c]
mov dword [edx + 8], ecx
mov eax, dword [0x5f3d40]
mov dword [edx + 0xc], eax
mov eax, dword [0x5f3d44]
mov dword [edx + 0x10], eax
mov byte [edx + 0x14], 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 4
push eax
push 0xb0
push str.CaptureBuffer.cpp
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x68]
mov ecx, 2
call fcn.004d4b60
mov byte [ebp - 4], 3
add esp, 0x10
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x53712a
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x537120
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53719d
push ecx
push edx
call fcn.00583877
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x53715e
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x537154
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x53719d
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [ebp - 0x74]
call fcn.00449240
push fcn.00438e00
push 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0xb8]
push 0x40
jmp 0x536da3
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00591c98
int3