Function at 0x40a620
Capabilities:
Acquire debug privileges
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
call fcn.00409330
mov dword [ebp - 0x2c], 0
push 0x40a2e0
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
push str.__auto_clean
mov eax, dword [ebp + 0x10]
push eax
call fcn.0060b654
add esp, 8
test eax, eax
jne 0x40a672
mov dword [0x72ca30], 1
mov dword [ebp - 0x2c], 1
jmp 0x40a691
push str.__log
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0060b654
add esp, 8
test eax, eax
jne 0x40a691
mov dword [0x72ca30], 1
push 0x6d3740
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00409350
test eax, eax
jne 0x40a6bd
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x28]
call fcn.0040a8c0
mov eax, dword [ebp - 0x34]
jmp 0x40a8a8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40a72d
push 0
push str.HRKILLUI
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40a716
push 5
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xf120
push 0x112
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x28]
call fcn.0040a8c0
mov eax, dword [ebp - 0x38]
jmp 0x40a8a8
push 0x6d3768
call fcn.0040a210
add esp, 4
push 0x6d378c
call fcn.0040a210
add esp, 4
push 0x6d37b4
call fcn.0040a210
add esp, 4
test eax, eax
jne 0x40a76f
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.0040a8c0
mov eax, dword [ebp - 0x3c]
jmp 0x40a8a8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jge 0x40a785
jmp 0x40a890
push 0x6d37d8
push 0
call fcn.0060b893
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.0040d3a0
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.0040a3f0
add esp, 4
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov ecx, 0x746b00
call fcn.00412690
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x40a862
call fcn.0041c530
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x40a81e
mov dword [0x72c9ec], 1
call fcn.0040a4f0
test eax, eax
je 0x40a81c
push str._Error__Is_Kernel_Isolation_Mode
call fcn.004093a0
add esp, 4
cmp dword [ebp - 0x2c], 0
jne 0x40a81a
push str.msgbox_secure_mod.xml
push 0
call fcn.00409cd0
add esp, 8
jmp 0x40a890
jmp 0x40a840
push str._warning_Loader_Driver_Error.
call fcn.004093a0
add esp, 4
cmp dword [ebp - 0x2c], 0
jne 0x40a840
push str.msgbox_driver_error.xml
push 0
call fcn.00409cd0
add esp, 8
call fcn.0041c5a0
mov edx, dword [ebp - 0x2c]
push edx
mov ecx, 0x746b00
call fcn.00412930
mov ecx, 0x746b00
call fcn.004126d0
call fcn.0041c680
mov ecx, 0x746b00
call fcn.00412960
test eax, eax
je 0x40a888
lea ecx, [ebp - 0x20]
call fcn.004067d0
lea ecx, [ebp - 0x20]
call fcn.00407020
lea ecx, [ebp - 0x20]
call fcn.00406b30
xor eax, eax
jne 0x40a77a
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x28]
call fcn.0040a8c0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret 0x10