Function at 0x445890
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x445b8f
sub esp, 0x30
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
jne 0x445b78
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445db0
movzx eax, byte [esp + 4]
test al, al
jne 0x445a22
call fcn.004368a0
mov eax, dword [esp]
mov dword [esp + 0x24], eax
nop
mov ecx, dword [esp + 0x34]
mov edx, ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x20], 0
shr ecx, 3
mov ebx, eax
mov eax, 0x828cbfbf
mov ebp, edx
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x3c]
test eax, 1
je 0x445996
mov edx, dword [0x6572b8]
test edx, edx
seta dl
mov esi, dword [0x6572bc]
test esi, esi
xchg esi, ebx
sete bl
xchg esi, ebx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, edx
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x445996
call fcn.0045f280
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x24]
mov dword [edx + 0x18], 0xffffffff
mov dword [edx + 0x1c], 0xffffffff
mov ebx, edx
mov ebp, dword [esp + 0x34]
mov edx, ecx
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
jmp 0x44599a
xor edx, edx
xor esi, esi
test eax, 2
je 0x445a04
mov eax, dword [0x6572e4]
test eax, eax
sete al
xchg edi, ebx
seta bl
xchg edi, ebx
mov ebp, dword [0x6572e0]
test ebp, ebp
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ebp, eax
or edi, ebp
xchg edi, eax
test al, al
xchg edi, eax
je 0x445a00
test edx, edx
sete al
test esi, esi
xchg ebp, ebx
sete bl
xchg ebp, ebx
and eax, ebp
test al, al
je 0x4459f4
call fcn.0045f280
mov esi, dword [esp]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], edx
mov ebp, dword [esp + 0x34]
jmp 0x445a04
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
shl ecx, 6
mov dword [esp + 0x18], ecx
lea eax, [0x633340]
lea edi, [eax + ecx]
mov dword [esp + 0x20], edi
jmp 0x445a30
add esp, 0x30
ret
lea eax, [0x633340]
mov ecx, dword [esp + 0x18]
lea edx, [eax + ecx]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00409140
mov eax, dword [esp + 0x18]
lea ecx, [0x633340]
lea edx, [ecx + eax + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445db0
movzx eax, byte [esp + 4]
test al, al
jne 0x445afa
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
movzx ebx, byte [esp + 0x38]
mov byte [esp + 0xc], bl
call fcn.00445e10
lea eax, [0x556220]
mov dword [esp], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x1912
mov ecx, dword [esp + 0x40]
lea edx, [ecx + 4]
mov dword [esp + 0xc], edx
call fcn.004366d0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x445ad9
mov ecx, 1
jmp 0x445af0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445db0
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, dword [esp + 0x24]
test cl, cl
je 0x445a26
jmp 0x445b20
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x18]
test ecx, ecx
seta dl
mov ebx, dword [eax + 0x1c]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
xchg esi, ebx
setg bl
xchg esi, ebx
and ebp, edx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
je 0x445b6c
mov eax, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x14]
sbb ebx, eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
mov eax, dword [esp + 0x40]
add eax, 3
mov dword [esp + 8], eax
call fcn.0042b5e0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00436ba0
add esp, 0x30
ret
lea eax, [0x54eee7]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00445890