Function at 0x409ab0
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409ef1
sub esp, 0x28
cmp word [0x63fe84], 0x10
jne 0x409eda
xor eax, eax
jmp 0x409af2
lea edx, [eax + eax*4]
lea ebx, [0x63fe80]
movzx ebp, word [ebx + eax*2]
lea esi, [0x680b4c]
mov dword [esi + edx*4], ebp
inc eax
cmp eax, 0x44
jge 0x409afe
jb 0x409adb
jmp 0x409ed0
mov eax, dword [0x67e174]
test eax, eax
je 0x409eba
cmp eax, 0x80000
ja 0x409e2e
cmp eax, 0x1000
jb 0x409da2
lea edx, [eax - 1]
test edx, eax
jne 0x409d40
mov eax, dword [0x67e170]
lea edx, [eax - 1]
test edx, eax
jne 0x409cde
cmp eax, 0x400000
jbe 0x409b4f
mov dword [0x67e170], 0
mov eax, dword [0x67e170]
test eax, eax
jne 0x409cbd
lea eax, [0x65e100]
mov dword [esp], eax
call fcn.00423ae0
call fcn.00411e20
mov eax, dword [esp]
mov dword [0x67e13c], eax
mov dword [esp], 0
mov dword [esp + 4], 0x10232000
call fcn.00413550
mov eax, dword [esp + 8]
test eax, eax
je 0x409bc7
nop
lea ecx, [eax + 0x10232000]
cmp eax, ecx
jbe 0x409ba7
mov ecx, 0x10231fff
jmp 0x409bac
mov ecx, 0x10232000
mov dword [0x65e1e0], eax
mov dword [0x65e1e4], eax
add eax, ecx
mov dword [0x65e1e8], eax
mov byte [0x65e1ec], 1
mov eax, dword [0x641680]
cmp dword [0x65e1e0], eax
ja 0x409be1
mov ecx, dword [0x65e1e8]
cmp ecx, eax
jbe 0x409be1
mov eax, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0x20000000
mov dword [esp + 0x20], 0x10000000
mov dword [esp + 0x24], 0x8000000
add eax, 0x43ffff
and eax, 0xffc00000
mov dword [esp + 0x14], eax
xor ecx, ecx
jmp 0x409c2e
mov edx, dword [esp + 0x18]
lea ecx, [edx + 1]
mov eax, dword [esp + 0x14]
cmp ecx, 3
jge 0x409c85
mov dword [esp + 0x18], ecx
mov edx, dword [esp + ecx*4 + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0x400000
call fcn.0040a490
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x409c23
nop
lea edx, [ecx + eax]
cmp eax, edx
jbe 0x409c64
dec ecx
mov dword [0x65e1f4], eax
mov dword [0x65e1f8], eax
add ecx, eax
mov dword [0x65e1fc], ecx
mov byte [0x65e200], 0
mov eax, dword [0x65e1fc]
mov dword [esp + 0x14], eax
lea ecx, [0x662700]
mov dword [esp], ecx
call fcn.004144d0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [0x65e1f0]
mov dword [eax + 8], ecx
mov dword [0x65e1f0], eax
add esp, 0x28
ret
lea eax, [ecx + 1]
mov dword [0x67e16c], eax
mov ecx, dword [0x67e16c]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
cmp dword [0x67e170], edx
jne 0x409cb4
jmp 0x409b5d
call fcn.00435250
lea eax, [0x561931]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
mov eax, dword [0x67e170]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x56128b]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
call fcn.004352c0
lea eax, [0x5620dd]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a80
call fcn.00435250
lea eax, [0x55fac7]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e80
mov eax, dword [0x67e174]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x56128b]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
call fcn.004352c0
lea eax, [0x5603fd]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a80
call fcn.00435250
lea eax, [0x55fac7]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e80
mov eax, dword [0x67e174]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x5654f0]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00435e80
mov dword [esp + 4], 0
mov dword [esp], 0x1000
call fcn.00435c80
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x5603fd]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a80
call fcn.00435250
lea eax, [0x55fac7]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e80
mov eax, dword [0x67e174]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x565100]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e80
mov dword [esp + 4], 0
mov dword [esp], 0x80000
call fcn.00435c80
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x5603fd]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a80
lea eax, [0x563956]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a80
mov ecx, 0x44
call fcn.0045f4d0
lea eax, [0x55f3d6]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00409ab0