Function at 0x523670
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5238c9
sub esp, 0x3c
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x523709
cmp ecx, 1
jne 0x5236a3
mov edx, dword [esp + 0x40]
xor eax, eax
xor ebx, ebx
jmp 0x523743
mov edx, dword [esp + 0x40]
movzx ebx, byte [edx]
test bl, bl
jne 0x5236b9
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5236c7
cmp bl, 0xff
jne 0x523703
movzx ebx, byte [edx + 1]
test bl, 0x80
je 0x523703
lea eax, [0x5633d5]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x1d
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, eax
lea eax, [0x59a990]
jmp 0x523743
xor eax, eax
xor ebx, ebx
jmp 0x523743
lea eax, [0x55e4e2]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0xd
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, eax
lea eax, [0x59a990]
test eax, eax
jne 0x5237a7
cmp ecx, 8
jg 0x52375b
mov dword [esp + 0x20], ebx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x5237e3
lea eax, [0x55f480]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x11
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00408be0
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
lea ecx, [0x59a990]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
add esp, 0x3c
ret
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ebx
add esp, 0x3c
ret
lea edi, [ebp + 1]
mov ebx, dword [esp + 0x1c]
shl ebx, 8
movzx ebp, byte [edx + ebp]
or ebp, ebx
mov ebx, dword [esp + 0x20]
mov ebx, ebp
mov ebp, edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x1c], esi
cmp ecx, ebp
jle 0x5237fc
shl edi, 8
shr esi, 0x18
or esi, edi
cmp ecx, ebp
ja 0x5237c3
jmp 0x5238c1
mov dword [esp + 0x10], eax
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
cmp dl, 0x20
sbb ebp, ebp
lea ebx, [ecx - 0x20]
mov byte [esp + 0xf], bl
mov ecx, ebx
neg ebx
mov byte [esp + 0xe], bl
cmp bl, 0x20
sbb eax, eax
mov dword [esp + 0x18], eax
cmp cl, 0x20
sbb eax, eax
mov dword [esp + 0x14], eax
cmp dl, 0x20
sbb ebx, ebx
mov ecx, edx
shl edi, cl
movzx ecx, byte [esp + 0xf]
shr esi, cl
and esi, eax
and edi, ebp
or edi, esi
movzx ecx, byte [esp + 0xe]
mov eax, dword [esp + 0x1c]
shl eax, cl
mov esi, dword [esp + 0x18]
and esi, eax
or edi, esi
not ebx
or ebx, edx
mov eax, ecx
mov ecx, ebx
mov esi, edi
sar edi, cl
mov dword [esp + 0x50], edi
cmp al, 0x20
sbb ebx, ebx
mov ecx, edx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov edi, dword [esp + 0x1c]
shl edi, cl
and edi, ebp
not ebx
or ebx, eax
mov eax, ecx
mov ecx, ebx
mov ebx, esi
sar esi, cl
xor edx, 0xffffffff
and edx, esi
movzx ecx, byte [esp + 0xf]
shl ebx, cl
mov ecx, eax
shr edi, cl
mov eax, dword [esp + 0x14]
and ebx, eax
and edi, ebp
or edi, ebx
or edx, edi
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x58], eax
add esp, 0x3c
ret
mov eax, ebp
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00523670