Function at 0x41ed00
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x41f350
sub esp, 0x98
mov ecx, dword [0x6573b0]
mov eax, dword fs:[0x14]
mov eax, dword [eax]
test ecx, ecx
jne 0x41ed3f
mov dword [0x6310f4], eax
jmp 0x41ed4a
lea edi, [0x6310f4]
call fcn.0045f3d0
nop
lea eax, [0x6310f0]
mov dword [esp], eax
call fcn.00409140
mov byte [0x6310f8], 1
lea eax, [0x540260]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 4]
test eax, eax
jne 0x41ed8d
mov dword [0x6310fc], ecx
lea eax, [0x55613c]
mov dword [ecx + 0x14], eax
jmp 0x41eda8
lea edi, [0x6310fc]
mov eax, ecx
call fcn.0045f3d0
lea edi, [eax + 0x14]
lea eax, [0x55613c]
call fcn.0045f3d0
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
lea eax, [0x57d660]
mov dword [esp + 4], eax
call fcn.00404500
lea eax, [0x556220]
mov dword [esp], eax
lea ecx, [0x6310f0]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 1
call fcn.004366d0
lea edi, [esp + 0x64]
lea esi, [0x57df10]
call fcn.0045fa7e
mov eax, 0x3f50624d
mov ecx, 0xd2f1a9fc
xor edx, edx
xor ebx, ebx
jmp 0x41ee0d
mov ebp, eax
mov eax, edx
mov edx, ebp
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ecx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x41f178
mov ebp, dword [esp + 0x44]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
jmp 0x41ee42
mov ebp, dword [esp + 0x44]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
test ebp, ebp
je 0x41f11f
cmp dword [0x65726c], ebp
ja 0x41f334
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 4], 0x412e8480
mov dword [esp], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
call fcn.00449c00
movzx eax, byte [esp + 0x10]
test al, al
je 0x41ee8c
mov eax, 0x412e8480
xor ecx, ecx
jmp 0x41ee94
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 8], 0
call fcn.004485e0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x54], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov edx, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
call fcn.00448a60
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00449da0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0041ebe0
mov eax, dword [esp + 0x4c]
test eax, eax
seta cl
mov edx, dword [esp + 0x50]
test edx, edx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov dword [esp + 0x30], edi
and ebx, ecx
or ebp, ebx
mov ecx, dword [esp + 0xc]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x41efa3
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call fcn.00449da0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add ecx, eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x34]
adc edx, eax
mov eax, dword [esp + 0x50]
cmp eax, edx
setl bl
mov ebp, dword [esp + 0x4c]
cmp ecx, ebp
xchg esi, ebx
seta bl
xchg esi, ebx
cmp eax, edx
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, esi
or ebx, edi
test bl, bl
je 0x41ef90
xor eax, eax
xor ebp, ebp
jmp 0x41ef94
sub ebp, ecx
sbb eax, edx
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov ebx, ebp
jmp 0x41ee07
mov dword [esp + 0x38], esi
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00449d10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], ecx
call fcn.00447f60
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
mov edx, dword [0x657224]
mov dword [esp], edx
call fcn.00449cc0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x60]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call fcn.004485e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x58]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call fcn.00448a60
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x5c], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
call fcn.00449d10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
call fcn.00447f60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x64]
mov dword [esp], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x47ae147b
mov dword [esp + 0x10], 0x3f847ae1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.0041e330
movzx eax, byte [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
test al, al
je 0x41f0df
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
jmp 0x41ee07
nop
nop
lea eax, [0x6310f0]
mov dword [esp], eax
call fcn.00409140
mov byte [0x631104], 1
nop
nop
lea eax, [0x6310f0]
mov dword [esp], eax
call fcn.00409340
mov edx, 0x3f50624d
mov ecx, 0xd2f1a9fc
mov eax, 1
mov ebx, 0x2a05f200
jmp 0x41ee07
nop
nop
lea eax, [0x6310f0]
mov dword [esp], eax
call fcn.00409140
mov byte [0x6310f8], 1
lea eax, [0x556220]
mov dword [esp], eax
lea ecx, [0x6310f0]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 1
call fcn.004366d0
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
jmp 0x41ee07
mov esi, ecx
mov edi, ebp
mov ebp, edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], esi
mov dword [esp + 4], 0x412e8480
mov dword [esp], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
call fcn.00449c00
movzx eax, byte [esp + 0x10]
test al, al
je 0x41ee36
call fcn.0041e820
mov eax, dword [esp]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x40], ecx
lea edx, [0x6372c8]
mov dword [esp], edx
call fcn.00401e50
mov eax, dword [esp + 0x3c]
cmp dword [esp + 4], eax
setae al
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x40]
cmp edx, ecx
setb cl
sete dl
and eax, edx
or eax, ecx
test al, al
jne 0x41ee28
nop
call fcn.00460210
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x2c], ecx
lea edx, [0x637204]
mov dword [esp], edx
mov dword [esp + 4], 0x10000
call fcn.0041f360
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
lea ecx, [0x637278]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401cd0
nop
call fcn.00460210
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
setl dl
mov ebx, dword [esp]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
xchg esi, ebx
setbe bl
xchg esi, ebx
cmp eax, ecx
xchg edi, ebx
sete bl
xchg edi, ebx
and esi, edi
or esi, edx
xchg esi, eax
test al, al
xchg esi, eax
je 0x41f2d9
mov ecx, dword [0x65726c]
test ecx, ecx
je 0x41f34a
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
xor edx, edx
div ecx
mov dword [esp], eax
call fcn.00449d10
mov dword [esp + 4], 0x40c38800
mov dword [esp], 0
call fcn.004485e0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
call fcn.00447f60
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x41f305
sub ebx, ebp
sbb eax, ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00449d10
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.00447f60
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [0x6572c0]
test eax, eax
setne al
mov ebx, dword [0x6572c4]
test ebx, ebx
setne bl
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
add ebp, esi
or ebx, eax
test bl, bl
je 0x41f172
jmp 0x41ee42
lea eax, [0x55249b]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00433a00
call fcn.004320f0
nop
call fcn.0045e000
jmp fcn.0041ed00