Function at 0x401120
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40160b
sub esp, 0x44
mov ebx, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
jmp 0x401147
mov ebp, ecx
mov ebx, esi
test ebp, ebp
je 0x40135f
xor eax, eax
jmp 0x40141a
mov eax, 0xffffffff
test eax, eax
jge 0x401167
xor ecx, ecx
xor esi, esi
mov eax, ebp
jmp 0x40118e
cmp eax, ebp
ja 0x4015fa
lea esi, [eax + 1]
cmp ebp, esi
jb 0x4015f1
sub ebp, eax
lea edi, [ebp - 1]
mov ecx, edi
xchg edi, ebx
neg ebx
xchg edi, ebx
sar edi, 0x1f
and esi, edi
add esi, ebx
cmp eax, 4
jl 0x401143
cmp dword [ebx], 0x2e757063
jne 0x401143
xor edx, edx
jmp 0x401436
mov edx, 0xffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x40], esi
test edx, edx
jl 0x401300
cmp edx, eax
ja 0x4015df
cmp edx, 4
jb 0x4015d3
lea ebp, [edx - 4]
mov dword [esp + 0x18], ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, 4
lea esi, [ebx + ebp]
lea edi, [edx + 1]
cmp eax, edi
jb 0x4015ca
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], esi
sub eax, edx
lea ebp, [eax - 1]
mov dword [esp + 0x14], ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and edi, ebp
lea ebp, [ebx + edi]
mov dword [esp + 0x30], ebp
cmp eax, 3
jne 0x40121e
cmp word [ebp], 0x6e6f
jne 0x40127f
cmp eax, 3
jmp 0x401237
cmp eax, 4
jne 0x40127f
cmp word [ebp], 0x666f
jne 0x40127f
lea edi, [ebx + edi + 2]
cmp byte [edi], 0x66
jne 0x40127f
cmp eax, 3
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edx, 7
jne 0x401264
cmp word [esi], 0x6c61
jne 0x401264
mov edi, dword [esp + 0x28]
lea ebx, [ebx + edi + 2]
cmp byte [ebx], 0x6c
jne 0x401264
mov ebx, dword [0x630f04]
xor eax, eax
jmp 0x40157f
xchg ebp, eax
mov byte [esp + 0x13], al
xchg ebp, eax
mov edx, dword [0x630f04]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x18]
xor eax, eax
jmp 0x40145e
call fcn.004351d0
lea eax, [0x54a8da]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435e00
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x54f86c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00435e00
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x547ecb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401143
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], ebx
call fcn.004351d0
lea eax, [0x54fc6f]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00435e00
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x547ecb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401143
mov eax, dword [0x630f04]
mov ecx, dword [0x630f00]
test eax, eax
je 0x401377
mov dword [esp + 0x2c], eax
xor edx, edx
jmp 0x40137e
add esp, 0x44
ret
add ecx, 0x10
movzx ebx, byte [ecx + 0xd]
movzx ebp, byte [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx]
mov dword [esp + 0x40], edi
mov edi, dword [ecx + 4]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x40140b
test bl, bl
je 0x401409
movzx ebp, byte [esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x401409
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x3c], ecx
call fcn.004351d0
lea eax, [0x54d8a0]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e00
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x54cf92]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e00
call fcn.00435240
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
jmp 0x40140b
mov byte [esi], bl
inc edx
cmp eax, edx
jg 0x40137b
jmp 0x401377
inc eax
cmp eax, ebp
jge 0x401156
jae 0x401603
lea esi, [ebx + eax]
cmp byte [esi], 0x2c
jne 0x401419
jmp 0x40115b
inc edx
cmp edx, eax
jge 0x4011a2
jae 0x4015e8
lea ebp, [ebx + edx]
cmp byte [ebp], 0x3d
jne 0x401435
jmp 0x4011a7
lea eax, [ebp + 1]
movzx ebp, byte [esp + 0x13]
mov esi, dword [esp + 0x34]
cmp eax, edx
jge 0x40150a
mov edi, dword [0x630f00]
mov ebp, dword [0x630f04]
cmp eax, ebp
jae 0x40156b
mov ebp, eax
shl eax, 4
mov esi, dword [edi + eax + 4]
mov edi, dword [edi + eax]
cmp esi, ebx
jne 0x401452
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov dword [esp], edi
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00402370
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4014c1
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
jmp 0x401452
mov ecx, dword [0x630f04]
mov ebx, dword [0x630f00]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x401566
mov ebp, dword [esp + 0x20]
mov byte [ebx + ebp + 0xc], 1
mov ecx, dword [0x630f04]
mov ebx, dword [0x630f00]
cmp eax, ecx
jae 0x401561
movzx edi, byte [esp + 0x13]
xchg edi, eax
mov byte [ebx + ebp + 0xd], al
xchg edi, eax
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401143
call fcn.004351d0
lea eax, [0x54f0a2]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e00
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x547ecb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401143
call fcn.0045f450
call fcn.0045f450
mov ecx, ebp
call fcn.0045f450
xchg ebp, ecx
mov byte [ebx + eax + 0xd], cl
xchg ebp, ecx
lea eax, [esi + 1]
mov ebx, edx
cmp eax, ebx
jge 0x4015b1
mov esi, dword [0x630f04]
mov edi, dword [0x630f00]
cmp eax, esi
jae 0x4015c3
mov esi, eax
shl eax, 4
mov byte [edi + eax + 0xc], 1
mov edi, dword [0x630f04]
mov edx, ebx
mov ebx, dword [0x630f00]
cmp esi, edi
jb 0x401572
jmp 0x4015ba
mov esi, dword [esp + 0x40]
jmp 0x401143
mov eax, esi
mov ecx, edi
call fcn.0045f450
mov ecx, esi
call fcn.0045f450
mov ecx, eax
mov eax, edi
call fcn.0045f4b0
mov eax, 4
mov ecx, edx
call fcn.0045f4b0
mov ecx, edx
mov edx, eax
call fcn.0045f470
mov ecx, eax
mov eax, edx
call fcn.0045f450
mov eax, esi
mov ecx, ebp
call fcn.0045f4b0
mov ecx, eax
mov edx, ebp
call fcn.0045f470
mov ecx, ebp
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00401120