Function at 0x43ab50
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xc]
cmp eax, dword [ecx + 8]
jbe 0x43b72f
sub esp, 0x8c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x80], eax
jmp 0x43ab8d
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov edx, dword [0x658b70]
test edx, edx
je 0x43abab
call fcn.0043a910
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
mov dword [esp + 0x88], ecx
test byte [ecx], al
mov edx, dword [ecx + 0x1178]
test edx, edx
je 0x43abca
call fcn.00439300
mov ecx, dword [esp + 0x88]
mov dword [esp], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.0043c8e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
movzx ecx, byte [0x67e089]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x18]
mov dword [esp + 0x3c], esi
test cl, cl
je 0x43ac52
movzx ecx, byte [0x67e08a]
test cl, cl
je 0x43ac52
call fcn.00413850
mov eax, dword [esp]
test eax, eax
je 0x43ac3e
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.00437b40
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
mov ecx, dword [0x652ea4]
mov ecx, dword [ecx]
test ecx, ecx
je 0x43ac6e
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0045f110
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.00442630
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
test eax, eax
jne 0x43b6c1
mov eax, dword [0x658b38]
test eax, eax
je 0x43ace2
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00441d20
mov eax, dword [esp + 8]
mov dword [esp + 0x74], eax
nop
nop
lea ecx, [0x658af8]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x43b6ab
lea eax, [0x67e150]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
jne 0x43acfc
xor ecx, ecx
jmp 0x43ad38
lea eax, [0x67e154]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
ja 0x43ad16
xor ecx, ecx
jmp 0x43ad38
lea eax, [0x658ae8]
mov dword [esp], eax
call fcn.00401e20
mov eax, dword [esp + 4]
test eax, eax
setne al
mov ecx, dword [esp + 8]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x43ad60
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0042e090
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
test eax, eax
jne 0x43b62d
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov edx, dword [0x67e12c]
movzx ecx, byte [ecx + 0x84]
test cl, cl
je 0x43ad82
mov ecx, 1
jmp 0x43adc6
mov dword [esp + 0x64], edx
lea eax, [0x658b2c]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
mov dword [esp + 0x60], eax
lea ecx, [0x658b28]
mov dword [esp], ecx
call fcn.00401be0
mov eax, dword [esp + 0x60]
shl eax, 1
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 4]
cmp ecx, eax
seta al
mov ecx, eax
mov eax, dword [esp + 0x80]
test cl, cl
jne 0x43addf
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
jmp 0x43aeb7
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x84]
test dl, dl
jne 0x43ae0a
mov byte [ecx + 0x84], 1
lea eax, [0x658b2c]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0043b840
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0x20]
movzx edx, byte [esp + 0xc]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
test eax, eax
jne 0x43b618
test cl, cl
je 0x43ae5c
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
mov dword [esp + 0x44], edi
test ebp, ebp
setne al
test ebx, ebx
setne cl
or ecx, eax
test cl, cl
je 0x43aea5
mov eax, dword [esp + 0x34]
test eax, eax
sete cl
mov edx, dword [esp + 0x38]
test edx, edx
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, ecx
xchg edi, eax
test al, al
xchg edi, eax
jne 0x43aeaf
cmp ebp, eax
setb cl
cmp ebx, edx
sete dl
setl bl
and edx, ecx
or ebx, edx
test bl, bl
jne 0x43aeaf
jmp 0x43aea9
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
mov ebp, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov edx, dword [0x67e120]
test edx, edx
jne 0x43aed5
xor edx, edx
jmp 0x43aefb
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.00417210
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
mov edx, eax
mov eax, dword [esp + 0x44]
test dl, dl
je 0x43af19
lea eax, [0x67e1d0]
mov dword [esp], eax
call fcn.00409000
mov eax, dword [esp + 4]
test eax, eax
jne 0x43b5a6
mov eax, dword [0x657ee0]
mov dword [esp + 0x78], eax
mov ecx, dword [0x657ee4]
mov dword [esp + 0x58], ecx
mov edx, dword [0x657ee8]
mov dword [esp + 0x5c], edx
mov ebx, dword [0x657f10]
mov dword [esp + 0x6c], ebx
mov ebp, dword [0x657f14]
mov dword [esp + 0x50], ebp
mov esi, dword [0x657f18]
mov dword [esp + 0x54], esi
mov edi, dword [0x657f30]
mov dword [esp + 0x68], edi
mov edi, dword [0x657f34]
mov dword [esp + 0x2c], edi
mov edi, dword [0x657f38]
mov dword [esp + 0x30], edi
nop
lea edi, [0x658af8]
mov dword [esp], edi
call fcn.00409110
mov eax, dword [0x658b70]
test eax, eax
jne 0x43af9d
mov eax, dword [esp + 0x88]
mov ecx, dword [eax + 0x1178]
test ecx, ecx
je 0x43afb9
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
mov ecx, dword [0x658b38]
test ecx, ecx
jne 0x43b564
call fcn.00440160
mov eax, dword [esp + 0x88]
cmp dword [esp], eax
jne 0x43b718
mov dword [esp], eax
call fcn.00441fc0
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x84]
mov byte [esp + 0x2b], dl
test dl, dl
jne 0x43b01a
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
jmp 0x43b11a
mov byte [ecx + 0x84], 0
lea eax, [0x658b2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d30
mov eax, dword [esp + 8]
test eax, eax
jl 0x43b702
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x5c]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x14], ebx
call fcn.0043bd40
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43b0ba
mov dword [esp], eax
call fcn.0043ffe0
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x84], 1
lea ecx, [0x658b2c]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
call fcn.0043bf40
mov eax, dword [esp]
mov ecx, dword [esp + 4]
test eax, eax
jne 0x43b4c1
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
call fcn.0043be20
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], esi
lea eax, [0x67e150]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
jne 0x43b144
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
xor ecx, ecx
jmp 0x43b1b0
lea eax, [0x67e154]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
ja 0x43b172
mov eax, dword [esp + 0x34]
test eax, eax
setne cl
mov edx, dword [esp + 0x3c]
test edx, edx
setne bl
or ebx, ecx
test bl, bl
je 0x43b1ae
lea eax, [0x658ae8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401db0
mov eax, dword [esp + 0x10]
test eax, eax
setne al
mov ecx, dword [esp + 0xc]
test ecx, ecx
setne cl
or ecx, eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
jmp 0x43b1b0
xor ecx, ecx
test cl, cl
jne 0x43b246
test eax, eax
setne cl
test edx, edx
setne bl
or ebx, ecx
test bl, bl
jne 0x43b1cc
xor ecx, ecx
jmp 0x43b1ed
lea eax, [0x67e150]
mov dword [esp], eax
call fcn.00401be0
mov eax, dword [esp + 4]
test eax, eax
setne al
mov edx, dword [esp + 0x3c]
mov ecx, eax
mov eax, dword [esp + 0x34]
test cl, cl
je 0x43b4b0
lea eax, [0x658af0]
mov dword [esp], eax
call fcn.00401e20
mov eax, dword [esp + 8]
test eax, eax
sete cl
mov edx, dword [esp + 4]
test edx, edx
sete bl
and ebx, ecx
test bl, bl
jne 0x43b23c
mov ecx, dword [esp + 0x34]
cmp ecx, edx
setb cl
mov edx, dword [esp + 0x3c]
cmp edx, eax
setl al
sete dl
and edx, ecx
or edx, eax
test dl, dl
je 0x43b4b0
call fcn.0042df90
jmp 0x43b4b0
lea ecx, [0x658af0]
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.00401e40
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
test edx, edx
jne 0x43b6ec
movzx ecx, byte [ecx + 0x84]
test cl, cl
jne 0x43b6d6
mov ecx, dword [esp + 0x3c]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x34]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
je 0x43b2ec
mov edx, dword [esp + 0x40]
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov esi, dword [esp + 0x44]
test esi, esi
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, ebp
xchg edi, eax
test al, al
xchg edi, eax
je 0x43b2de
nop
call fcn.004602a0
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x34]
mov esi, eax
mov edx, ecx
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x3c]
sub ebx, edx
sbb ecx, esi
test ecx, ecx
jge 0x43b2f6
xor ecx, ecx
xor ebx, ebx
jmp 0x43b2f6
mov ecx, 0xffffffff
mov ebx, 0xffffffff
mov edx, dword [0x67e1c8]
test edx, edx
setne dl
mov ebp, dword [0x67e1cc]
test ebp, ebp
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x43b31c
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.0042e090
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
lea eax, [0x658af0]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e40
call fcn.004602a0
mov eax, dword [esp + 4]
mov ecx, dword [esp]
lea edx, [0x658ae8]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00401e40
mov eax, dword [0x67e1c8]
test eax, eax
setne al
mov ecx, dword [0x67e1cc]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x43b3a5
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x43b3a5
call fcn.00439fa0
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409110
call fcn.004420b0
mov eax, dword [esp]
mov dword [esp + 0x7c], eax
nop
nop
lea ecx, [0x658af8]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x43b4a4
mov dword [esp], eax
call fcn.0043ffe0
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x43b426
movzx eax, byte [esp + 0x2b]
test al, al
je 0x43ab86
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x84], 1
lea ecx, [0x658b2c]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d30
jmp 0x43ab86
nop
nop
mov dword [esp + 0x88], eax
test eax, eax
je 0x43b43a
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x48], ecx
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.0043c1f0
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437fc0
movzx eax, byte [0x662748]
test al, al
je 0x43b487
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004545c0
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.0043c1f0
call fcn.00439fa0
mov eax, dword [esp + 0x80]
jmp 0x43ab8d
mov dword [esp + 0x7c], eax
mov dword [esp + 0x84], ecx
call fcn.0043ffe0
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x84], 1
lea eax, [0x658b2c]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x7c]
mov dword [eax + 0x948], 3
mov eax, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437fc0
movzx eax, byte [0x662748]
test al, al
je 0x43b547
mov eax, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004545c0
mov eax, dword [esp + 0x84]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00441d20
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
nop
nop
lea ecx, [0x658af8]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov ecx, dword [esp + 0x88]
mov dword [ecx + 0x948], 3
mov eax, dword [eax + 0xc]
mov dword [esp + 0x88], eax
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437fc0
movzx eax, byte [0x662748]
test al, al
je 0x43b5fb
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004545c0
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], dl
add esp, 0x8c
ret
nop
nop
mov dword [esp + 0x88], eax
test eax, eax
je 0x43b641
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x4c], ecx
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.0043c1f0
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437fc0
movzx eax, byte [0x662748]
test al, al
je 0x43b68e
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004545c0
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], cl
add esp, 0x8c
ret
lea eax, [0x564dfe]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a80
lea eax, [0x562fba]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a80
lea eax, [0x564594]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
lea eax, [0x560aa7]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0043ab50