Function at 0x41ecd0
Capabilities:
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x18]
cmp eax, dword [ecx + 8]
jbe 0x41f320
sub esp, 0x98
mov ecx, dword [0x67e2d0]
mov eax, dword fs:[0x14]
mov eax, dword [eax]
test ecx, ecx
jne 0x41ed0f
mov dword [0x658004], eax
jmp 0x41ed1a
lea edi, [0x658004]
call fcn.0045f450
nop
lea eax, [0x658000]
mov dword [esp], eax
call fcn.00409110
mov byte [0x658008], 1
lea eax, [0x553c80]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 4]
test eax, eax
jne 0x41ed5d
mov dword [0x65800c], ecx
lea eax, [0x571234]
mov dword [ecx + 0x14], eax
jmp 0x41ed78
lea edi, [0x65800c]
mov eax, ecx
call fcn.0045f450
lea edi, [eax + 0x14]
lea eax, [0x571234]
call fcn.0045f450
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
lea eax, [0x59a360]
mov dword [esp + 4], eax
call fcn.004044d0
lea eax, [0x571318]
mov dword [esp], eax
lea ecx, [0x658000]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 1
call fcn.00436750
lea edi, [esp + 0x64]
lea esi, [0x59acf0]
call fcn.0045fb0e
mov eax, 0x3f50624d
mov ecx, 0xd2f1a9fc
xor edx, edx
xor ebx, ebx
jmp 0x41eddd
mov ebp, eax
mov eax, edx
mov edx, ebp
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], edx
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ecx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x41f148
mov ebp, dword [esp + 0x44]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
jmp 0x41ee12
mov ebp, dword [esp + 0x44]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
test ebp, ebp
je 0x41f0ef
cmp dword [0x67e174], ebp
ja 0x41f304
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 4], 0x412e8480
mov dword [esp], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
call fcn.00449c80
movzx eax, byte [esp + 0x10]
test al, al
je 0x41ee5c
mov eax, 0x412e8480
xor ecx, ecx
jmp 0x41ee64
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 8], 0
call fcn.00448660
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x54], ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov edx, dword [esp + 0x60]
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
call fcn.00448ae0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00449e20
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0041ebb0
mov eax, dword [esp + 0x4c]
test eax, eax
seta cl
mov edx, dword [esp + 0x50]
test edx, edx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov dword [esp + 0x30], edi
and ebx, ecx
or ebp, ebx
mov ecx, dword [esp + 0xc]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x41ef73
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call fcn.00449e20
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add ecx, eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x34]
adc edx, eax
mov eax, dword [esp + 0x50]
cmp eax, edx
setl bl
mov ebp, dword [esp + 0x4c]
cmp ecx, ebp
xchg esi, ebx
seta bl
xchg esi, ebx
cmp eax, edx
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, esi
or ebx, edi
test bl, bl
je 0x41ef60
xor eax, eax
xor ebp, ebp
jmp 0x41ef64
sub ebp, ecx
sbb eax, edx
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov ebx, ebp
jmp 0x41edd7
mov dword [esp + 0x38], esi
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00449d90
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], ecx
call fcn.00447fe0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
mov edx, dword [0x67e12c]
mov dword [esp], edx
call fcn.00449d40
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x60]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call fcn.00448660
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x54]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x58]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
call fcn.00448ae0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x5c], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x30]
mov dword [esp], edx
call fcn.00449d90
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
call fcn.00447fe0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x64]
mov dword [esp], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x47ae147b
mov dword [esp + 0x10], 0x3f847ae1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call fcn.0041e300
movzx eax, byte [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
test al, al
je 0x41f0af
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
jmp 0x41edd7
nop
nop
lea eax, [0x658000]
mov dword [esp], eax
call fcn.00409110
mov byte [0x658014], 1
nop
nop
lea eax, [0x658000]
mov dword [esp], eax
call fcn.00409310
mov edx, 0x3f50624d
mov ecx, 0xd2f1a9fc
mov eax, 1
mov ebx, 0x2a05f200
jmp 0x41edd7
nop
nop
lea eax, [0x658000]
mov dword [esp], eax
call fcn.00409110
mov byte [0x658008], 1
lea eax, [0x571318]
mov dword [esp], eax
lea ecx, [0x658000]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x140d
mov dword [esp + 0xc], 1
call fcn.00436750
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
jmp 0x41edd7
mov esi, ecx
mov edi, ebp
mov ebp, edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], esi
mov dword [esp + 4], 0x412e8480
mov dword [esp], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
call fcn.00449c80
movzx eax, byte [esp + 0x10]
test al, al
je 0x41ee06
call fcn.0041e7f0
mov eax, dword [esp]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x40], ecx
lea edx, [0x65e1c8]
mov dword [esp], edx
call fcn.00401e20
mov eax, dword [esp + 0x3c]
cmp dword [esp + 4], eax
setae al
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x40]
cmp edx, ecx
setb cl
sete dl
and eax, edx
or eax, ecx
test al, al
jne 0x41edf8
nop
call fcn.004602a0
mov eax, dword [esp]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 4]
mov dword [esp + 0x2c], ecx
lea edx, [0x65e104]
mov dword [esp], edx
mov dword [esp + 4], 0x10000
call fcn.0041f330
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
lea ecx, [0x65e178]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401ca0
nop
call fcn.004602a0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
setl dl
mov ebx, dword [esp]
mov ebp, dword [esp + 0x28]
cmp ebx, ebp
xchg esi, ebx
setbe bl
xchg esi, ebx
cmp eax, ecx
xchg edi, ebx
sete bl
xchg edi, ebx
and esi, edi
or esi, edx
xchg esi, eax
test al, al
xchg esi, eax
je 0x41f2a9
mov ecx, dword [0x67e174]
test ecx, ecx
je 0x41f31a
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
xor edx, edx
div ecx
mov dword [esp], eax
call fcn.00449d90
mov dword [esp + 4], 0x40c38800
mov dword [esp], 0
call fcn.00448660
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
call fcn.00447fe0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
jmp 0x41f2d5
sub ebx, ebp
sbb eax, ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00449d90
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.00447fe0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [0x67e1c8]
test eax, eax
setne al
mov ebx, dword [0x67e1cc]
test ebx, ebx
setne bl
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
add ebp, esi
or ebx, eax
test bl, bl
je 0x41f142
jmp 0x41ee12
lea eax, [0x566e3c]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00433a80
call fcn.00432170
nop
call fcn.0045e080
jmp fcn.0041ecd0