Function at 0x431270
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x298]
cmp eax, dword [ecx + 8]
jbe 0x43169d
sub esp, 0x318
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x31c]
cmp dword [eax + 0x18], ecx
je 0x431686
test byte [ecx], al
lea eax, [ecx + 0x1c8]
mov dword [esp + 0x314], eax
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x431608
mov eax, dword [esp + 0x31c]
lea ecx, [eax + 0x1b4]
mov dword [esp + 0x30c], ecx
nop
mov dword [esp], ecx
call fcn.00409110
mov eax, dword [esp + 0x31c]
mov ecx, dword [eax + 0x1b8]
test ecx, ecx
jne 0x43135d
nop
nop
mov eax, dword [esp + 0x30c]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401df0
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
add esp, 0x318
ret
mov dword [esp + 0x24], 0
mov ecx, dword [sym.imp.kernel32.dll_DuplicateHandle]
mov edx, dword [eax + 0x1b8]
lea ebx, [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.00430ff0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43162b
nop
nop
mov eax, dword [esp + 0x30c]
mov dword [esp], eax
call fcn.00409310
mov dword [esp + 0x2d], 0
lea edi, [esp + 0x30]
mov ecx, 0xb6
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
and eax, 0xfffffff0
mov dword [esp + 0x310], eax
mov dword [eax], 0x10001
nop
lea ecx, [0x67e18c]
mov dword [esp], ecx
call fcn.00409110
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_SuspendThread]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e10
cmp dword [esp + 8], 0xffffffff
je 0x4315a9
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_GetThreadContext]
mov edx, dword [esp + 0x310]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00430e60
nop
lea eax, [0x67e18c]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x310]
mov ecx, dword [eax + 0xc4]
mov edx, dword [esp + 0x31c]
mov ebx, dword [edx]
test ebx, ebx
je 0x431476
cmp dword [ebx], ecx
jae 0x431476
cmp dword [ebx + 4], ecx
ja 0x431498
mov ebx, dword [edx + 0x2c]
test ebx, ebx
je 0x431486
cmp dword [ebx], ecx
jae 0x431486
cmp dword [ebx + 4], ecx
ja 0x431498
mov ebx, dword [edx + 0x4c]
test ebx, ebx
je 0x431496
cmp dword [ebx], ecx
jae 0x431496
cmp dword [ebx + 4], ecx
ja 0x431498
xor ebx, ebx
test ebx, ebx
jne 0x4314a0
xor ecx, ecx
jmp 0x4314cb
mov dword [esp + 0x308], ebx
mov dword [esp], ebx
call fcn.00434ce0
movzx eax, byte [esp + 4]
mov edx, dword [esp + 0x31c]
mov ebx, dword [esp + 0x308]
mov ecx, eax
mov eax, dword [esp + 0x310]
test cl, cl
je 0x431543
mov ecx, dword [eax + 0xb8]
mov edx, dword [eax + 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
call fcn.00434d50
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
test al, al
je 0x431543
mov eax, dword [esp + 0x310]
mov edx, dword [eax + 0xc4]
add edx, 0xfffffffc
mov ebx, edx
lea ebp, [0x45ff10]
nop
mov dword [edx], ecx
nop
mov dword [eax + 0xc4], ebx
nop
mov dword [eax + 0xb8], ebp
mov ecx, dword [esp + 0x24]
mov edx, dword [sym.imp.kernel32.dll_SetThreadContext]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00430e60
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401df0
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_ResumeThread]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e10
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e10
add esp, 0x318
ret
nop
lea eax, [0x67e18c]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e10
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401df0
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
add esp, 0x318
ret
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
add esp, 0x318
ret
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x28], eax
call fcn.00435250
lea eax, [0x5672cd]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x565fd2]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a80
lea eax, [0x55e253]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00431270