Function at 0x402600
Capabilities:
Accept command line arguments
Switch active desktop

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004253fe
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x2f
push eax
call fcn.00425584
mov edi, eax
add esp, 8
test edi, edi
je 0x402905
movzx eax, word [edi + 2]
push ebx
push esi
mov ebx, 2
cmp ax, 0x64
je 0x40264c
cmp ax, 0x44
jne 0x402723
mov dword [0x45bc84], 1
mov esi, 0x45aa88
jmp 0x402660
call fcn.00425410
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
mov word [esi], dx
add esi, ebx
cmp esi, 0x45aa94
jl 0x402660
push 0x10000000
xor edx, edx
push 1
push edx
mov word [0x45aa94], dx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push 8
push 0x40
mov dword [0x45aa7c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x402713
push 1
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x402713
push ebx
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x402713
push 0
push esi
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x402713
push 0
push 0x10000000
push 0
push 0
push 0
push 0x45aa88
call dword [sym.imp.USER32.dll_CreateDesktopW]
mov dword [0x45aa80], eax
test eax, eax
je 0x402713
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
je 0x402713
mov edx, dword [0x45aa80]
push edx
call dword [sym.imp.USER32.dll_SwitchDesktop]
push 0x2f
add edi, 4
push edi
call fcn.00425584
add esp, 8
mov edi, eax
test edi, edi
je 0x4028f9
jmp 0x402730
movzx eax, word [edi + 2]
cmp ax, 0x70
je 0x402880
cmp ax, 0x50
je 0x402880
cmp ax, 0x73
je 0x402874
cmp ax, 0x53
je 0x402874
cmp ax, 0x74
je 0x402868
cmp ax, 0x54
je 0x402868
cmp ax, 0x72
je 0x4027f8
cmp ax, 0x52
je 0x4027f8
cmp ax, 0x69
je 0x402803
cmp ax, 0x49
je 0x402803
cmp ax, 0x63
je 0x4027a0
cmp ax, 0x43
jne 0x4028e1
add edi, 6
push 0x20
push edi
call fcn.00425584
add esp, 8
test eax, eax
je 0x4027d3
xor ecx, ecx
mov esi, 0x45aaf0
mov word [eax], cx
mov ecx, edi
sub esi, edi
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, ebx
test dx, dx
jne 0x4027c0
lea edi, [eax - 2]
jmp 0x4027ee
mov edx, 0x45aaf0
mov eax, edi
sub edx, edi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4027e0
mov dword [0x45aa84], 1
mov dword [0x45dc88], ebx
jmp 0x4028e1
add edi, 4
push 0x22
push edi
call fcn.00425584
mov esi, eax
add esp, 8
test esi, esi
je 0x402859
add esi, ebx
push 0x22
push esi
call fcn.00425584
add esp, 8
test eax, eax
je 0x4028e1
xor edx, edx
mov word [eax], dx
mov edx, 0x45ac80
lea edi, [eax - 2]
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x402840
mov dword [0x45dc88], ebx
jmp 0x4028e1
mov dword [0x45dc88], 4
jmp 0x4028e1
mov dword [0x45dc8c], 1
jmp 0x4028e1
mov dword [0x45dc88], 1
jmp 0x4028e1
add edi, 6
push 0x20
push edi
call fcn.00425584
add esp, 8
test eax, eax
je 0x402899
xor ecx, ecx
mov word [eax], cx
add eax, ebx
mov esi, 0x45bc88
mov ecx, edi
sub esi, edi
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, ebx
test dx, dx
jne 0x4028a2
test eax, eax
je 0x4028ce
mov edx, 0x45cc88
sub edx, eax
jmp 0x4028c0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4028c0
cmp dword [0x45dc88], 0
je 0x4028e1
mov dword [0x45dc88], 3
push 0x2f
add edi, 4
push edi
call fcn.00425584
mov edi, eax
add esp, 8
test edi, edi
jne 0x402730
pop esi
pop ebx
mov eax, 0x45ee9c
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x45ee9c
pop edi
mov esp, ebp
pop ebp
ret