Function at 0x407630
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x3c]
cmp eax, dword [ecx + 8]
jbe 0x407981
sub esp, 0xbc
mov eax, dword [esp + 0xbc]
mov dword [esp], eax
call fcn.0044f4c0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0044fba0
mov eax, dword [esp + 8]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x28
call fcn.00402380
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x40793e
lea ecx, [eax - 1]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x407939
lea ebx, [eax + 2]
cmp edx, ebx
jg 0x4076f4
mov dword [esp], 0
lea eax, [0x567574]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x31
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a80
jb 0x407932
cmp ebx, ecx
jb 0x407929
mov ebp, dword [esp + 0x6c]
lea esi, [eax + ebp - 1]
cmp word [esi], 0x282e
jne 0x4076b6
lea esi, [eax + ebp + 1]
cmp byte [esi], 0x2a
jne 0x4076b6
mov dword [esp + 0x1c], ecx
sub edx, eax
mov dword [esp + 0x28], edx
lea eax, [edx - 2]
mov dword [esp + 0x20], eax
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, ebx
add eax, ebp
mov dword [esp + 0x70], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x29
call fcn.00402380
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x4078e7
lea ecx, [eax + 2]
mov edx, dword [esp + 0x20]
cmp ecx, edx
jl 0x4077a0
mov dword [esp], 0
lea eax, [0x566de0]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2e
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a80
ja 0x4078e2
cmp eax, ecx
ja 0x4078dd
mov ebx, dword [esp + 0x70]
lea ebp, [ebx + eax]
cmp word [ebp], 0x2e29
jne 0x407762
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x74]
mov edx, eax
xor eax, eax
call fcn.0045f66e
lea ecx, [0x55e600]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], 0xd
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x80], ecx
lea ecx, [0x55c270]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], 1
mov ecx, dword [esp + 0x28]
sub ecx, edx
add ecx, 0xfffffffc
mov ebp, ecx
neg ecx
sar ecx, 0x1f
mov esi, dword [esp + 0x24]
and ecx, esi
add ecx, ebx
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], ebp
lea ecx, [0x55fb46]
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], 0x13
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], edx
lea ecx, [0x55cfb8]
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 8
mov dword [esp], 0
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
mov dword [esp + 8], 9
mov dword [esp + 0xc], 9
call fcn.0044cc80
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00408be0
mov ecx, dword [esp + 8]
lea edx, [0x54a860]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00433350
call fcn.0045f530
call fcn.0045f4f0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea eax, [0x560052]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a80
mov eax, ecx
mov ecx, ebx
call fcn.0045f530
mov ecx, ebx
call fcn.0045f4f0
call fcn.0045f4f0
lea eax, [esp + 0x4c]
mov dword [esp], eax
lea eax, [0x56003f]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00407630