Function at 0x406a09
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4566c8]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x24
mov eax, 0x43bfc5
call fcn.004212a4
mov edi, dword [ebp + 0x230]
mov dword [ebp - 0x14], edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00421420
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
mov esi, 0x3f1
push esi
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
lea eax, [ebp + 0x234]
push eax
lea ecx, [ebp - 0x30]
call fcn.004020d0
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
jne 0x406a84
xor eax, eax
jmp 0x406a8c
push ebx
mov ecx, eax
call fcn.004019dc
lea ecx, [ebp + 0x1c]
push ecx
push eax
call fcn.00422ffb
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x30]
setne byte [ebp - 0xd]
call fcn.00401e77
cmp byte [ebp - 0xd], bl
je 0x406b51
push 0x440f00
push 0x457bc8
call fcn.00406ca1
pop ecx
pop ecx
push 0x10
push 0x454478
cmp dword [0x457b94], ebx
je 0x406ad6
push 0x440f68
jmp 0x406adb
push str.Text_is_wrong._Try_again.
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x3e8
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x440fd4
push esi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
push dword [ebp - 0x14]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp + 0x234]
call fcn.00414fbd
push dword [ebp + 0x234]
call fcn.004205ee
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0042090d
add ebp, 0x228
leave
ret
mov ecx, 0x208
lea eax, [ebp + 0x1c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x406b59
call fcn.0041c3d9
mov esi, eax
cmp esi, 0xffffffff
je 0x406b78
push ebx
push esi
call fcn.0041c2e6
push esi
call fcn.0041c269
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x440fd8
push str._Main_::_Set_privilege___s
mov esi, 0x457bc8
push esi
call fcn.00406300
push 1
push str.SeDebugPrivilege
push dword [ebp - 0x18]
call fcn.00406876
push 0x4069f8
call fcn.00407964
push 0x40214d
call fcn.0040795a
add esp, 0x20
call fcn.0041387b
cmp dword [0x457b94], ebx
je 0x406bdf
mov edi, 0x4544c0
mov ecx, 0x454528
jmp 0x406be9
mov edi, 0x4544f4
mov ecx, 0x4545f0
cmp dword [ebp + 0x24c], ebx
je 0x406bf8
push 1
jmp 0x406c93
test al, 8
je 0x406c80
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.00402e07
push str._Main_::_Not_possible_to_complete_the_removal_process_now__requires_a_system_reboot._After_reboot__run_the_program_again_to_complete_the_removal_anti_virus.
push esi
mov byte [ebp - 4], 1
call fcn.00406ca1
pop ecx
pop ecx
lea ecx, [ebp]
cmp dword [0x457b94], ebx
je 0x406c33
push 0x441198
jmp 0x406c38
push str.Not_possible_to_complete_the_removal_process_now__requires_a_system_reboot._After_reboot__run_the_program_again_to_complete_the_removal_anti_virus._Reboot_system_now_
call fcn.00405145
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x406c49
lea eax, [ebp + 4]
push 0x44
push edi
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
cmp eax, 6
jne 0x406c74
call fcn.0040696c
pop ecx
push ebx
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp]
call fcn.00403f19
jmp 0x406b15
push 1
lea ecx, [ebp]
call fcn.00403f19
jmp 0x406c99
push 0x44
push edi
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x406c99
push ebx
call fcn.0040696c
pop ecx
xor ebx, ebx
inc ebx
jmp 0x406b15