as above

thx.

Hi WoZX,

The usual final API is ExitProcess. It's usually called directly after the main window procedure, in MASM something like

invoke WinMain
invoke ExitProcess, eax

in Softice something like

Call xxxxxxxx ; start of main code
push eax ; zero
Call ExitProcess

There's usually common shutdown API's just before the return as well such as CloseHandle, FreeLibrary, EndDialog. A protection routine might use its own call to ExitProcess with its own particular shutdown routine such as writing to the registry.

TerminateProcess is used in unconditional process killers of other programs like Procdump and PEDump have as a feature.

Hope this helps,

Kayaker