Function at 0x437c90
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x437e47
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0x1001]
cmp ecx, 3
jbe 0x437cc3
cmp eax, 0x1009
jne 0x437d9f
mov ecx, eax
and eax, 0xffffefff
mov edx, dword [esp + 0x1c]
cmp edx, eax
jne 0x437cf8
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ebx, [eax + 0x48]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x437cf8
add esp, 0x10
ret
call fcn.004351d0
lea eax, [0x551394]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.00435e00
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435d80
lea eax, [0x548dd7]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435c80
lea eax, str.__newval__oldval__size____tail___07:00:00244140625:_statusAuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSeptemberSundaneseTypeCNAMETypeHINFOTypeMINFOWSASendToWednesdayWriteFileZ07:00:00atomicor8bad_indirbus_errorchan_sendcomplex64copystackcrypted:_ctxt___0d.nx___0debugLockfork_execfuncargs_hchanLeafinittraceinterfaceinterruptinvalid_nipv6_icmpmSpanDeadmSpanFreenet_stop_ntdll.dllomitemptypanicwaitpclmulqdqpreemptedprintablepsapi.dllrecover:_reflect:_rwxrwxrwxscavtracestackpooltracebackunderflowwbufSpans_stack__MB_goal___flushGen__gfreecnt_pages_at__ptrSize__runqsize_runqueue_s.base___spinning_stopwait_sweepgen__sweepgen_targetpc_throwing_until_pc___NOVERB___Weekday__BADINDEX___bound____limit___dev_stdin12207031256103515625AdditionalBad_varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDeprecatedDevanagariDnsQuery_WException_GC_forced_nGOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianRIPEMD_160SYSTEMROOTSaurashtraTMBMServerTMResponseWSACleanupWSASocketWWSAStartupatomicand8avgsvc.execomplex128debug_calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine_impossibleinvalidptrmSpanInUsenotifyListntuser.datowner_diedruntime:_gs.state__schedtracesemacquiresetsockoptstackLarget.Kind__terminatedticks.locktime.Date_time.Localtracefree_tracegc___nunixpacketunknown_pcws2_32.dll__of_size____targetpc___plugin:__KiB_work___exp.__for__freeindex_gcwaiting_idleprocs_in_status__mallocing_ms_clock___nBSSRoots_p__status_s.nelems__schedtick_span.list_timerslen___BADPREC___elemsize__npages___dev_stderr_dev_stdout30517578125:_frame.spAOTAgentSvcBLAKE2b_256BLAKE2b_384BLAKE2b_512BLAKE2s_256CETASvc.exeClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauProgramDataRegCloseKeySHA_512_224SHA_512_256SYSTEMROOTSetFileTimeSignWritingSoft_DottedTrend_MicroUSERPROFILEVirtualLockWSARecvFromWarang_CitiWhite_Spacealarm_clockapplicationassistQueuebad_addressbad_argSizebad_m_valuebad_messagebad_timedivbroken_pipecgocall_nilclobberfreeclosesocketcreated_by_crypt32.dlldesktop.inifile_existsfloat32nan1float32nan2float32nan3float64nan1float64nan2float64nan3gccheckmarkgeneralizedgetpeernamegetsocknamei_o_timeoutmSpanManualmethodargs_mswsock.dllnetpollInitparse_errorreflect.SetreflectOffsruntime:_P_runtime:_p_scheddetailsecur32.dllshell32.dllshort_writetracealloc_unreachableuserenv.dllvastsvc.exe_B__goal__KiB_total___MB_stacks____recovered__allocCount__found_at___gcscandone__m__gsignal_nDataRoots_nSpanRoots_pages_byte_n_preemptoff_s.elemsize_s.sweepgen_span.limit_span.state_sysmonwait_wbuf1_nil__wbuf2_nil__Recycle.Bin___BADWIDTH___p__status__cons_mark__byte_limit_n152587890625762939453125AOTAgent.exeBidi_ControlFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibraryWMeetei_MayekPahawh_HmongPccNTMon.exeRCodeRefusedRCodeSuccessReadConsoleWRevertToSelfRtlGenRandomSERIALNUMBERSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExabi_mismatchadvapi32.dllbad_flushGenbad_g_statusbad_g0_stackbad_recoverycant_happencas64_failedchan_receivedumping_heapend_tracegc_nentersyscallexit_status_gcBitsArenasgcpacertraceharddecommithost_is_downiVPAgent.exeillegal_seekinvalid_baseinvalid_slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllno_such_hostnot_pollablepagefile.syspowerpnt.exeraceFiniLockreflect.Copyreleasep:_mruntime:_gpruntime:_spself_preemptshort_bufferspanSetSpineswapfile.syssweepWaiterstmwscsvc.exetraceStringswirep:_p__mworker_mode____sweepgen___default__q___default__v__MB_globals___MB__workers_called_from__flushedWork__idlethreads_is_nil__not__nStackRoots_not_exist_.._out_of_range_pluginpath__s.spanclass_span.base___syscalltick_work
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437600
lea eax, [0x552dfe]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00433a00
call fcn.004351d0
lea eax, [0x551e82]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00435e00
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435d80
lea eax, [0x548dd7]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435c80
lea eax, str.__newval__oldval__size____tail___07:00:00244140625:_statusAuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSeptemberSundaneseTypeCNAMETypeHINFOTypeMINFOWSASendToWednesdayWriteFileZ07:00:00atomicor8bad_indirbus_errorchan_sendcomplex64copystackcrypted:_ctxt___0d.nx___0debugLockfork_execfuncargs_hchanLeafinittraceinterfaceinterruptinvalid_nipv6_icmpmSpanDeadmSpanFreenet_stop_ntdll.dllomitemptypanicwaitpclmulqdqpreemptedprintablepsapi.dllrecover:_reflect:_rwxrwxrwxscavtracestackpooltracebackunderflowwbufSpans_stack__MB_goal___flushGen__gfreecnt_pages_at__ptrSize__runqsize_runqueue_s.base___spinning_stopwait_sweepgen__sweepgen_targetpc_throwing_until_pc___NOVERB___Weekday__BADINDEX___bound____limit___dev_stdin12207031256103515625AdditionalBad_varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDeprecatedDevanagariDnsQuery_WException_GC_forced_nGOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianRIPEMD_160SYSTEMROOTSaurashtraTMBMServerTMResponseWSACleanupWSASocketWWSAStartupatomicand8avgsvc.execomplex128debug_calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine_impossibleinvalidptrmSpanInUsenotifyListntuser.datowner_diedruntime:_gs.state__schedtracesemacquiresetsockoptstackLarget.Kind__terminatedticks.locktime.Date_time.Localtracefree_tracegc___nunixpacketunknown_pcws2_32.dll__of_size____targetpc___plugin:__KiB_work___exp.__for__freeindex_gcwaiting_idleprocs_in_status__mallocing_ms_clock___nBSSRoots_p__status_s.nelems__schedtick_span.list_timerslen___BADPREC___elemsize__npages___dev_stderr_dev_stdout30517578125:_frame.spAOTAgentSvcBLAKE2b_256BLAKE2b_384BLAKE2b_512BLAKE2s_256CETASvc.exeClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauProgramDataRegCloseKeySHA_512_224SHA_512_256SYSTEMROOTSetFileTimeSignWritingSoft_DottedTrend_MicroUSERPROFILEVirtualLockWSARecvFromWarang_CitiWhite_Spacealarm_clockapplicationassistQueuebad_addressbad_argSizebad_m_valuebad_messagebad_timedivbroken_pipecgocall_nilclobberfreeclosesocketcreated_by_crypt32.dlldesktop.inifile_existsfloat32nan1float32nan2float32nan3float64nan1float64nan2float64nan3gccheckmarkgeneralizedgetpeernamegetsocknamei_o_timeoutmSpanManualmethodargs_mswsock.dllnetpollInitparse_errorreflect.SetreflectOffsruntime:_P_runtime:_p_scheddetailsecur32.dllshell32.dllshort_writetracealloc_unreachableuserenv.dllvastsvc.exe_B__goal__KiB_total___MB_stacks____recovered__allocCount__found_at___gcscandone__m__gsignal_nDataRoots_nSpanRoots_pages_byte_n_preemptoff_s.elemsize_s.sweepgen_span.limit_span.state_sysmonwait_wbuf1_nil__wbuf2_nil__Recycle.Bin___BADWIDTH___p__status__cons_mark__byte_limit_n152587890625762939453125AOTAgent.exeBidi_ControlFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibraryWMeetei_MayekPahawh_HmongPccNTMon.exeRCodeRefusedRCodeSuccessReadConsoleWRevertToSelfRtlGenRandomSERIALNUMBERSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExabi_mismatchadvapi32.dllbad_flushGenbad_g_statusbad_g0_stackbad_recoverycant_happencas64_failedchan_receivedumping_heapend_tracegc_nentersyscallexit_status_gcBitsArenasgcpacertraceharddecommithost_is_downiVPAgent.exeillegal_seekinvalid_baseinvalid_slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllno_such_hostnot_pollablepagefile.syspowerpnt.exeraceFiniLockreflect.Copyreleasep:_mruntime:_gpruntime:_spself_preemptshort_bufferspanSetSpineswapfile.syssweepWaiterstmwscsvc.exetraceStringswirep:_p__mworker_mode____sweepgen___default__q___default__v__MB_globals___MB__workers_called_from__flushedWork__idlethreads_is_nil__not__nStackRoots_not_exist_.._out_of_range_pluginpath__s.spanclass_span.base___syscalltick_work
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00437600
lea eax, [0x553228]
mov dword [esp], eax
mov dword [esp + 4], 0x37
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00437c90