Function at 0x40a370
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc84
mov eax, dword [0x4290b8]
xor eax, esp
mov dword [esp + 0xc80], eax
push ebp
xor ebp, ebp
cmp dword [0x5269b0], ebp
jne 0x40a3c6
call fcn.00407000
test eax, eax
jne 0x40a3a1
call fcn.00407070
test eax, eax
je 0x40a3c6
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40a3c6
mov eax, 0x20e
pop ebp
mov ecx, dword [esp + 0xc80]
xor ecx, esp
call fcn.0040b218
add esp, 0xc84
ret
push 0x104
lea eax, [esp + 0x878]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40a3f9
mov eax, 0x2ce
pop ebp
mov ecx, dword [esp + 0xc80]
xor ecx, esp
call fcn.0040b218
add esp, 0xc84
ret
lea ecx, [esp + 0x54]
push ecx
push 0x104
call fcn.00406bf0
add esp, 8
test eax, eax
jne 0x40a42a
mov eax, 0x2d2
pop ebp
mov ecx, dword [esp + 0xc80]
xor ecx, esp
call fcn.0040b218
add esp, 0xc84
ret
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x10], ebp
call fcn.00403720
test eax, eax
je 0x40a448
mov esi, str.USBENTCG_SYS
mov edi, str.USBENTCM_SYS
jmp 0x40a464
mov esi, 0x423eb0
mov edi, 0x423e8c
mov ebx, 0x423e68
mov ebp, str.USBENTCGEX_X64_EXE
mov dword [esp + 0x10], 0x423e14
push str.__UsbEnter.exe
lea edx, [esp + 0x64]
push str.UsbStart.exe
push edx
call fcn.00408bf0
add esp, 0xc
test eax, eax
jne 0x40a52c
push str.UsbStart.exe
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x270]
push 0x41f3a0
push ecx
call fcn.00404200
lea edx, [esp + 0x278]
push 0
push edx
call fcn.0040b905
add esp, 0x18
test eax, eax
jne 0x40a522
lea eax, [esp + 0x268]
push eax
push str._s_exists.
call fcn.00403f10
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x274]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.00404010
add esp, 0x10
test eax, eax
je 0x40a522
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
lea ecx, [esp + 0x278]
push ecx
push str._s__d._d._d._d_
call fcn.00403f10
add esp, 0x18
cmp dword [esp + 0x14], 6
jge 0x40a52c
mov eax, 0x2d1
jmp 0x40a81d
push str.USBENTCG_SRV
lea edx, [esp + 0x64]
push str.localhostserver.exe
push edx
call fcn.00408bf0
push str.USBENTCG_DLL
lea eax, [esp + 0x70]
push str.UsbEntCG3.dll
push eax
call fcn.00408bf0
add esp, 0x18
test esi, esi
je 0x40a5b3
push esi
lea ecx, [esp + 0x64]
push str.UsbEntCG6.sys
push ecx
call fcn.00408bf0
add esp, 0xc
test eax, eax
jne 0x40a5b3
push str.UsbEntCG6
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x478]
push str._s_s.sys
push eax
call fcn.00404200
push 2
push 0
push 0
push 7
lea eax, [esp + 0x490]
call fcn.0040a280
add esp, 0x20
test eax, eax
jne 0x40a5b3
mov eax, 0x33c
jmp 0x40a81d
test edi, edi
je 0x40a60f
push edi
lea ecx, [esp + 0x64]
push str.UsbEntCM2.sys
push ecx
call fcn.00408bf0
add esp, 0xc
test eax, eax
jne 0x40a60f
push str.UsbEntCM2
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x478]
push 0x423c9c
push eax
call fcn.00404200
push 0
push 2
push 0
push 1
lea eax, [esp + 0x490]
call fcn.0040a280
add esp, 0x20
test eax, eax
jne 0x40a60f
mov eax, 0x33d
jmp 0x40a81d
test ebx, ebx
je 0x40a626
push ebx
lea ecx, [esp + 0x64]
push str.UsbEntCG3_x64.dll
push ecx
call fcn.00408bf0
add esp, 0xc
test ebp, ebp
je 0x40a64b
push ebp
lea edx, [esp + 0x64]
push str.usbentcgex_x64.exe
push edx
call fcn.00408bf0
add esp, 0xc
test eax, eax
jne 0x40a64b
mov eax, 0x346
jmp 0x40a81d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40a666
push eax
lea eax, [esp + 0x64]
push str.hostmanageprocess.exe
push eax
call fcn.00408bf0
add esp, 0xc
push 0x423c04
lea ecx, [esp + 0x64]
push str.UsbEjectCheckCG.exe
push ecx
call fcn.00408bf0
add esp, 0xc
call fcn.00403720
test eax, eax
je 0x40a6ab
push 0x423bbc
lea edx, [esp + 0x64]
push str.UsbEjectHookCG32.dll
push edx
call fcn.00408bf0
push 0x423b70
push str.UsbEjectHookStartCG32.exe
lea eax, [esp + 0x74]
push eax
jmp 0x40a6ce
push 0x423b1c
lea ecx, [esp + 0x64]
push str.UsbEjectHookCG64.dll
push ecx
call fcn.00408bf0
push 0x423ad0
push str.UsbEjectHookStartCG64.exe
lea edx, [esp + 0x74]
push edx
call fcn.00408bf0
add esp, 0x18
call fcn.00403720
test eax, eax
je 0x40a704
push 0x423a7c
lea eax, [esp + 0x64]
push str.CkFolder1.sys
push eax
call fcn.00408bf0
push 0x423a40
push str.CkFolder1.exe
lea ecx, [esp + 0x74]
push ecx
jmp 0x40a727
push 0x423a04
lea edx, [esp + 0x64]
push str.CkFolder1.sys
push edx
call fcn.00408bf0
push 0x4239e4
push str.CkFolder1.exe
lea eax, [esp + 0x74]
push eax
call fcn.00408bf0
add esp, 0x18
push str.UsbEnter.lnk
lea ecx, [esp + 0x64]
push ecx
push 0x41f3a0
lea edx, [esp + 0x684]
push 0x104
push edx
call fcn.0040b5c1
push str.UsbStart.exe
mov esi, eax
lea eax, [esp + 0x78]
push eax
push 0x41f3a0
lea ecx, [esp + 0xaa8]
push 0x104
push ecx
call fcn.0040b5c1
add esp, 0x28
test esi, esi
jle 0x40a818
test eax, eax
jle 0x40a818
cmp dword [0x5269b0], 0
je 0x40a793
xor eax, eax
jmp 0x40a79e
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
inc eax
push eax
lea edx, [esp + 0x884]
push edx
lea eax, [esp + 0xa90]
push eax
lea ecx, [esp + 0x684]
push ecx
call fcn.0040a0e0
add esp, 0x10
test eax, eax
je 0x40a811
push 0x38
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.0040b920
add esp, 0xc
lea edx, [esp + 0x24]
lea eax, [esp + 0x678]
lea ecx, [esp + 0x60]
push edx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x44], 1
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, 0x1f5
jmp 0x40a81d
mov eax, 0x2dc
jmp 0x40a81d
mov eax, 0x2d0
mov ecx, dword [esp + 0xc90]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.0040b218
add esp, 0xc84
ret