Function at 0x4a4d00
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x178]
cmp eax, dword [ecx + 8]
jbe 0x4a5307
sub esp, 0x1f8
lea edi, [esp + 0x20c]
xor eax, eax
call fcn.0045f669
mov ecx, dword [esp + 0x1fc]
movzx edx, byte [ecx + 0xf]
and edx, 0x1f
cmp edx, 0x13
jne 0x4a52a6
mov edx, dword [esp + 0x200]
test edx, edx
je 0x4a4d63
movzx ebx, byte [edx + 0xf]
and ebx, 0x1f
cmp ebx, 0x14
je 0x4a5246
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], edx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], edx
lea eax, [0x657fc0]
mov dword [esp], eax
lea ebx, [0x54c540]
mov dword [esp + 4], ebx
lea ebp, [esp + 0xbc]
mov dword [esp + 8], ebp
call fcn.00464d30
movzx eax, byte [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
test al, al
je 0x4a4e44
mov dword [esp + 0xb8], ecx
lea edi, [esp + 0x194]
xor eax, eax
call fcn.0045f667
mov ecx, dword [esp + 0xb8]
lea edx, [0x54f2c0]
cmp ecx, edx
jne 0x4a5230
lea edi, [esp + 0x194]
call fcn.0045fa96
lea edi, [esp + 0x130]
lea esi, [esp + 0x194]
call fcn.0045fa96
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov dword [esp + 0xb4], ecx
lea edi, [esp + 0x20c]
lea esi, [esp + 0x138]
call fcn.0045faaa
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x208], eax
add esp, 0x1f8
ret
mov eax, dword [esp + 0x1fc]
mov dword [esp], eax
mov ecx, dword [esp + 0x200]
mov dword [esp + 4], ecx
call fcn.004a1680
lea edi, [esp + 0x20c]
lea esi, [esp + 8]
call fcn.0045faaa
mov eax, dword [esp + 0x258]
add eax, dword [esp + 0x248]
mov dword [esp + 0x64], eax
lea ecx, [0x555500]
mov dword [esp], ecx
call fcn.0040b170
mov eax, dword [esp + 4]
mov byte [eax + 0xd], 4
mov ecx, dword [esp + 0x64]
add ecx, 3
and ecx, 0xfffffffc
mov dword [eax], ecx
mov ecx, dword [esp + 0x260]
mov ecx, dword [ecx]
shl ecx, 2
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x260]
mov edx, dword [ecx]
test edx, edx
jbe 0x4a4eff
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 4]
test edx, edx
jbe 0x4a5227
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4a4ee4
mov dword [eax + 0x14], ebx
mov ecx, dword [esp + 0x200]
test ecx, ecx
jmp 0x4a4f08
lea edi, [eax + 0x14]
mov ecx, eax
mov eax, ebx
call fcn.0045f450
mov edx, dword [esp + 0x200]
test edx, edx
mov eax, ecx
mov ecx, edx
jmp 0x4a4f08
mov ecx, dword [esp + 0x200]
test ecx, ecx
mov dword [esp + 0xac], eax
je 0x4a4fb1
mov dword [esp], ecx
call fcn.004a2870
mov eax, dword [esp + 4]
mov dword [esp + 0xb8], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x68], ecx
mov edx, dword [esp + 0x1fc]
mov dword [esp], edx
call fcn.004a2870
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x8c]
mov dword [esp], edx
lea edx, [0x55dd8f]
mov dword [esp + 4], edx
mov dword [esp + 8], 0xb
mov edx, dword [esp + 0xb8]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x10], edx
lea edx, [0x55c2c9]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
lea eax, [0x55c26b]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
call fcn.0044d090
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
jmp 0x4a5008
mov eax, dword [esp + 0x1fc]
mov dword [esp], eax
call fcn.004a2870
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x6c]
mov dword [esp], edx
lea edx, [0x55d53d]
mov dword [esp + 4], edx
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0x55c26b]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 1
call fcn.0044cf40
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
call fcn.004a2340
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0045c860
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xac]
mov dword [ecx + 0x18], eax
lea eax, [0x553280]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0xb4], eax
lea ecx, [0x549e00]
mov dword [esp], ecx
call fcn.0040b170
mov eax, dword [esp + 4]
lea ecx, [0x4a5320]
mov dword [eax], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x4a5096
mov ecx, dword [esp + 0xac]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0xb4]
mov dword [edx + 0x10], eax
jmp 0x4a50bc
lea edi, [eax + 4]
mov ecx, eax
mov eax, dword [esp + 0xac]
call fcn.0045f450
mov edx, dword [esp + 0xb4]
lea edi, [edx + 0x10]
mov ebx, eax
mov eax, ecx
call fcn.0045f450
mov ecx, ebx
mov ebx, dword [esp + 0x1fc]
mov dword [esp + 0xc4], ebx
mov ebx, dword [esp + 0x200]
mov dword [esp + 0xc8], ebx
lea edi, [esp + 0x194]
xor eax, eax
call fcn.0045f667
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x194], ecx
mov dword [esp + 0x198], edx
lea edi, [esp + 0x19c]
lea esi, [esp + 0x20c]
call fcn.0045faaa
lea ecx, [0x54c540]
mov dword [esp], ecx
lea edx, [esp + 0xc4]
mov dword [esp + 4], edx
call fcn.00408a00
mov ecx, dword [esp + 8]
mov dword [esp + 0xb0], ecx
lea edx, [0x54f2c0]
mov dword [esp], edx
lea ebx, [esp + 0x194]
mov dword [esp + 4], ebx
call fcn.00408a00
mov ecx, dword [esp + 8]
lea edx, [0x657fc0]
mov dword [esp], edx
lea edx, [0x54c540]
mov dword [esp + 4], edx
mov edx, dword [esp + 0xb0]
mov dword [esp + 8], edx
lea edx, [0x54f2c0]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.00464fb0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xb8], ecx
mov esi, dword [esp + 0x18]
lea edi, [esp + 0x194]
xor eax, eax
call fcn.0045f667
mov ecx, dword [esp + 0xb8]
lea edx, [0x54f2c0]
cmp ecx, edx
jne 0x4a5211
lea edi, [esp + 0x194]
call fcn.0045fa96
lea edi, [esp + 0xcc]
lea esi, [esp + 0x194]
call fcn.0045fa96
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0xb4], ecx
lea edi, [esp + 0x20c]
lea esi, [esp + 0xd4]
call fcn.0045faaa
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x208], eax
add esp, 0x1f8
ret
mov dword [esp], ecx
mov dword [esp + 4], edx
lea eax, [0x546ec0]
mov dword [esp + 8], eax
call fcn.004088a0
xor eax, eax
mov ecx, edx
call fcn.0045f4d0
mov dword [esp], ecx
mov dword [esp + 4], edx
lea eax, [0x546ec0]
mov dword [esp + 8], eax
call fcn.004088a0
mov dword [esp], edx
call fcn.004a2870
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x566a58]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x2c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
mov dword [esp], ecx
call fcn.004a2870
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x56578a]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x25
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004a4d00