Function at 0x407660
Capabilities:
Clear windows event logs
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x3c]
cmp eax, dword [ecx + 8]
jbe 0x4079b1
sub esp, 0xbc
mov eax, dword [esp + 0xbc]
mov dword [esp], eax
call fcn.0044f440
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0044fb20
mov eax, dword [esp + 8]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x28
call fcn.004023b0
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x40796e
lea ecx, [eax - 1]
mov edx, dword [esp + 0x20]
cmp edx, ecx
jb 0x407969
lea ebx, [eax + 2]
cmp edx, ebx
jg 0x407724
mov dword [esp], 0
lea eax, [0x552b13]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x31
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a00
jb 0x407962
cmp ebx, ecx
jb 0x407959
mov ebp, dword [esp + 0x6c]
lea esi, [eax + ebp - 1]
cmp word [esi], 0x282e
jne 0x4076e6
lea esi, [eax + ebp + 1]
cmp byte [esi], 0x2a
jne 0x4076e6
mov dword [esp + 0x1c], ecx
sub edx, eax
mov dword [esp + 0x28], edx
lea eax, [edx - 2]
mov dword [esp + 0x20], eax
mov ecx, eax
neg eax
sar eax, 0x1f
and eax, ebx
add eax, ebp
mov dword [esp + 0x70], eax
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x29
call fcn.004023b0
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x407917
lea ecx, [eax + 2]
mov edx, dword [esp + 0x20]
cmp ecx, edx
jl 0x4077d0
mov dword [esp], 0
lea eax, [0x55243f]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2e
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a00
ja 0x407912
cmp eax, ecx
ja 0x40790d
mov ebx, dword [esp + 0x70]
lea ebp, [ebx + eax]
cmp word [ebp], 0x2e29
jne 0x407792
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x74]
mov edx, eax
xor eax, eax
call fcn.0045f5de
lea ecx, [0x54a05b]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], 0xd
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x80], ecx
lea ecx, [0x547e10]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], 1
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], 1
mov ecx, dword [esp + 0x28]
sub ecx, edx
add ecx, 0xfffffffc
mov ebp, ecx
neg ecx
sar ecx, 0x1f
mov esi, dword [esp + 0x24]
and ecx, esi
add ecx, ebx
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], ebp
lea ecx, [0x54b540]
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], 0x13
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], edx
lea ecx, [0x5489e8]
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], 8
mov dword [esp], 0
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
mov dword [esp + 8], 9
mov dword [esp + 0xc], 9
call fcn.0044cc00
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.00408c10
mov ecx, dword [esp + 8]
lea edx, [0x537fa0]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004332d0
call fcn.0045f4b0
call fcn.0045f470
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea eax, [0x54ba85]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a00
mov eax, ecx
mov ecx, ebx
call fcn.0045f4b0
mov ecx, ebx
call fcn.0045f470
call fcn.0045f470
lea eax, [esp + 0x4c]
mov dword [esp], eax
lea eax, [0x54ba72]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x13
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
call fcn.0044ce20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00407660