Function at 0x4312a0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x298]
cmp eax, dword [ecx + 8]
jbe 0x4316cd
sub esp, 0x318
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x31c]
cmp dword [eax + 0x18], ecx
je 0x4316b6
test byte [ecx], al
lea eax, [ecx + 0x1c8]
mov dword [esp + 0x314], eax
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x431638
mov eax, dword [esp + 0x31c]
lea ecx, [eax + 0x1b4]
mov dword [esp + 0x30c], ecx
nop
mov dword [esp], ecx
call fcn.00409140
mov eax, dword [esp + 0x31c]
mov ecx, dword [eax + 0x1b8]
test ecx, ecx
jne 0x43138d
nop
nop
mov eax, dword [esp + 0x30c]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e20
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
add esp, 0x318
ret
mov dword [esp + 0x24], 0
mov ecx, dword [sym.imp.kernel32.dll_DuplicateHandle]
mov edx, dword [eax + 0x1b8]
lea ebx, [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.00431020
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43165b
nop
nop
mov eax, dword [esp + 0x30c]
mov dword [esp], eax
call fcn.00409340
mov dword [esp + 0x2d], 0
lea edi, [esp + 0x30]
mov ecx, 0xb6
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
and eax, 0xfffffff0
mov dword [esp + 0x310], eax
mov dword [eax], 0x10001
nop
lea ecx, [0x657284]
mov dword [esp], ecx
call fcn.00409140
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_SuspendThread]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e40
cmp dword [esp + 8], 0xffffffff
je 0x4315d9
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_GetThreadContext]
mov edx, dword [esp + 0x310]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00430e90
nop
lea eax, [0x657284]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x310]
mov ecx, dword [eax + 0xc4]
mov edx, dword [esp + 0x31c]
mov ebx, dword [edx]
test ebx, ebx
je 0x4314a6
cmp dword [ebx], ecx
jae 0x4314a6
cmp dword [ebx + 4], ecx
ja 0x4314c8
mov ebx, dword [edx + 0x2c]
test ebx, ebx
je 0x4314b6
cmp dword [ebx], ecx
jae 0x4314b6
cmp dword [ebx + 4], ecx
ja 0x4314c8
mov ebx, dword [edx + 0x4c]
test ebx, ebx
je 0x4314c6
cmp dword [ebx], ecx
jae 0x4314c6
cmp dword [ebx + 4], ecx
ja 0x4314c8
xor ebx, ebx
test ebx, ebx
jne 0x4314d0
xor ecx, ecx
jmp 0x4314fb
mov dword [esp + 0x308], ebx
mov dword [esp], ebx
call fcn.00434c60
movzx eax, byte [esp + 4]
mov edx, dword [esp + 0x31c]
mov ebx, dword [esp + 0x308]
mov ecx, eax
mov eax, dword [esp + 0x310]
test cl, cl
je 0x431573
mov ecx, dword [eax + 0xb8]
mov edx, dword [eax + 0xc4]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
call fcn.00434cd0
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
test al, al
je 0x431573
mov eax, dword [esp + 0x310]
mov edx, dword [eax + 0xc4]
add edx, 0xfffffffc
mov ebx, edx
lea ebp, [0x45fe80]
nop
mov dword [edx], ecx
nop
mov dword [eax + 0xc4], ebx
nop
mov dword [eax + 0xb8], ebp
mov ecx, dword [esp + 0x24]
mov edx, dword [sym.imp.kernel32.dll_SetThreadContext]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00430e90
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e20
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_ResumeThread]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e40
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e40
add esp, 0x318
ret
nop
lea eax, [0x657284]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x24]
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00430e40
mov eax, dword [esp + 0x314]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00401e20
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
add esp, 0x318
ret
mov eax, dword [esp + 0x31c]
add eax, 0x1ac
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
add esp, 0x318
ret
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x28], eax
call fcn.004351d0
lea eax, [0x5528cd]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x55165e]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00433a00
lea eax, [0x549c88]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004312a0