Function at 0x4ff780
Capabilities:
Set registry value
Switch active desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
lea edi, [ebp - 0x414]
mov ecx, 0x105
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x6d010a
call fcn.004ccd9e
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x6cbd34]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x4ff8ce
mov esi, esp
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x6c700c]
push ecx
call dword [sym.imp.USER32.dll_CreateDesktopW]
cmp esi, esp
call fcn.004ccfb5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x6cbd34], ecx
cmp dword [ebp - 0x14], 0
je 0x4ff887
push 0
lea eax, [ebp - 0x50]
push eax
push 1
push str.S:_ML__NW___LW_
call fcn.004c9103
test eax, eax
je 0x4ff885
mov esi, esp
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
cmp esi, esp
call fcn.004ccfb5
test eax, eax
je 0x4ff872
mov esi, esp
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0x10
push 7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x6cbd34]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp esi, esp
call fcn.004ccfb5
mov esi, esp
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, esp
call fcn.004ccfb5
jmp 0x4ff8c7
mov esi, esp
push 0x10000000
push 0
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x6c700c]
push ecx
call dword [sym.imp.USER32.dll_OpenDesktopW]
cmp esi, esp
call fcn.004ccfb5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x6cbd34], ecx
cmp dword [ebp - 0x14], 0
jne 0x4ff8c7
xor eax, eax
jmp 0x4ff9e0
mov dword [ebp - 0x20], 1
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SwitchDesktop]
cmp esi, esp
call fcn.004ccfb5
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x6cbd34]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp esi, esp
call fcn.004ccfb5
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [0x6cbd30], eax
cmp dword [0x6cbd40], 0
je 0x4ff980
mov esi, esp
lea eax, [ebp - 0x26c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp esi, esp
call fcn.004ccfb5
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jne 0x4ff980
mov esi, esp
push 4
push 0x6cbd30
push 4
push 0
push str.SwitchDeskId
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.004ccfb5
mov esi, esp
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.004ccfb5
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x20], 0
je 0x4ff9dd
mov eax, dword [ebp + 8]
mov ecx, dword [eax*4 + 0x6cbd34]
push ecx
push 0
push 0x4cdd57
call fcn.004c805a
add esp, 0xc
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
je 0x4ff9dd
mov esi, esp
push 0
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.004ccfb5
mov esi, esp
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004ccfb5
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x4ffa08]
call fcn.004cd316
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x414
cmp ebp, esp
call fcn.004ccfb5
mov esp, ebp
pop ebp
ret