Function at 0x4062fd
Capabilities:
Switch active desktop
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x13c
mov eax, dword [0x4223b0]
mov dword [ebp + 0x68], eax
call fcn.0040aeed
test eax, eax
je 0x406321
push 2
pop eax
jmp 0x40654b
push ebx
push esi
push edi
xor ebx, ebx
push 0xe6
lea eax, [ebp - 0xa0]
push ebx
push eax
xor esi, esi
mov dword [ebp - 0xa4], ebx
call fcn.0040f3c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0xb4], eax
push 7
xor eax, eax
pop ecx
mov byte [ebp + 0x48], bl
lea edi, [ebp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp + 0x48]
push eax
push ebx
mov dword [ebp - 0xa8], 0x20
call fcn.00404855
add esp, 0xc
test eax, eax
jl 0x406546
push dword [ebp - 0xa8]
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040f480
movzx eax, byte [ebp + 0x78]
mov dword [ebp - 0x17], eax
mov al, byte [ebp - 0xa8]
mov byte [ebp - 0x60], al
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 3], eax
lea eax, [ebp + 5]
push 0x43e74c
push eax
mov dword [ebp - 7], 1
call fcn.0040f1f0
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp + 1], ebx
call fcn.0040b514
add esp, 0x18
mov esi, 0x10000000
push esi
push ebx
push ebx
mov edi, str.comydesk20
push edi
call dword [sym.imp.USER32.dll_OpenDesktopA]
cmp eax, ebx
mov dword [ebp - 0xac], eax
jne 0x406418
push ebx
push esi
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_CreateDesktopA]
cmp eax, ebx
mov dword [ebp - 0xac], eax
jne 0x406418
or esi, 0xffffffff
jmp 0x406546
mov al, byte [ebp + 0x78]
cmp al, 1
je 0x406447
cmp al, 4
je 0x406447
cmp al, 2
jne 0x406435
lea eax, [ebp - 0xa4]
push eax
push str.__cp
jmp 0x406453
cmp al, 3
jne 0x40645a
lea eax, [ebp - 0xa4]
push eax
push str.__createpin
jmp 0x406453
lea eax, [ebp - 0xa4]
push eax
push str.__vp
call fcn.0040b669
pop ecx
pop ecx
push dword [ebp - 0xac]
mov esi, dword [sym.imp.USER32.dll_SwitchDesktop]
call esi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 0xb0], ebx
jmp 0x4064a0
push ebx
push ebx
push ebx
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xd0]
push ebx
push eax
call edi
test eax, eax
jne 0x406476
push 0x50
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040b572
cmp dword [ebp + 1], ebx
pop ecx
jne 0x406516
push dword [ebp - 0xac]
call esi
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp + 0x48]
push eax
push ebx
call fcn.00404855
add esp, 0xc
test eax, eax
jl 0x406516
movzx eax, byte [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.0040fd60
add esp, 0xc
test eax, eax
jne 0x406516
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x2710
jle 0x4064a0
push dword [ebp - 0xb4]
call esi
push dword [ebp - 0xac]
call dword [sym.imp.USER32.dll_CloseDesktop]
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x43b938]
call fcn.00404b29
mov esi, dword [ebp + 1]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp + 0x68]
call fcn.0040f3ac
add ebp, 0x6c
leave
ret