Function at 0x4112d0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411592
sub esp, 0x40
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
cmp ecx, edx
je 0x411355
test edx, edx
je 0x41158c
lea edi, [esp + 0x18]
xor eax, eax
call fcn.0045f676
mov eax, dword [esp + 0x5c]
mov ecx, edx
xor edx, edx
div ecx
mov edx, ecx
shr ecx, 2
mov ebx, dword [esp + 0x54]
mov ebp, ebx
shr ebx, 2
mov esi, ecx
sub ecx, ebx
test ecx, ecx
jbe 0x41134e
mov byte [esp + 0x18], 1
cmp ecx, 1
jbe 0x411344
mov byte [esp + 0x1a], 0x81
lea ebx, [ecx - 1]
mov ecx, 3
jmp 0x411556
mov ecx, 2
jmp 0x411430
xor ecx, ecx
jmp 0x411430
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
call fcn.00411680
mov eax, dword [esp + 0x10]
mov ecx, eax
shl eax, 2
mov edx, dword [esp + 0x54]
cmp edx, eax
jne 0x4113b3
lea eax, [ecx + 3]
shr eax, 2
mov ecx, dword [esp + 0x60]
shr ecx, 4
mov edx, dword [esp + 0x44]
add ecx, edx
add eax, edx
mov edx, eax
mov dword [esp], edx
sub ecx, eax
mov dword [esp + 4], ecx
call fcn.0045fba0
add esp, 0x40
ret
mov dword [esp + 0x14], ecx
call fcn.00435250
lea eax, [0x566821]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55e634]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x566673]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a80
cmp ecx, 0x28
jae 0x411538
mov byte [esp + ecx + 0x18], pe_nt_image_headers32
lea ebx, [ecx + 1]
jmp 0x411457
mov edi, esi
or esi, 0x80
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
shr edi, 7
inc ebx
mov esi, edi
cmp esi, 0x80
jb 0x411469
cmp ebx, 0x28
jb 0x411443
jmp 0x41152c
cmp ebx, 0x28
jae 0x411520
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
inc ebx
lea esi, [eax - 1]
mov eax, esi
jmp 0x411494
mov edi, esi
or esi, 0x80
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
shr edi, 7
inc ebx
mov esi, edi
cmp esi, 0x80
jb 0x4114a3
cmp ebx, 0x28
jb 0x411480
jmp 0x411514
cmp ebx, 0x28
jae 0x411508
xchg esi, eax
mov byte [esp + ebx + 0x18], al
xchg esi, eax
lea esi, [ebx + 1]
cmp esi, 0x28
jae 0x4114fc
mov dword [esp + 0x14], eax
mov byte [esp + ebx + 0x19], 0
mov eax, dword [esp + 0x64]
mov dword [esp], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
call fcn.00411680
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x14]
imul eax, ecx
mov ecx, dword [esp + 0x54]
add ecx, eax
shr ecx, 2
jmp 0x41138a
mov eax, esi
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ecx
mov ecx, 0x28
call fcn.0045f4d0
mov edi, ebx
or ebx, 0x80
mov byte [esp + ecx + 0x18], bl
shr edi, 7
inc ecx
mov ebx, edi
cmp ebx, 0x80
jb 0x411565
cmp ecx, 0x28
jb 0x411544
jmp 0x411580
cmp ecx, 0x28
jae 0x411574
mov byte [esp + ecx + 0x18], bl
inc ecx
jmp 0x411430
mov eax, ecx
mov ecx, 0x28
call fcn.0045f4d0
mov eax, ecx
mov ecx, 0x28
call fcn.0045f4d0
call fcn.00432170
nop
call fcn.0045e080
jmp fcn.004112d0