Function at 0x44e7f0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44ef87
sub esp, 0x74
mov edx, dword [esp + 0x78]
mov ebx, dword [edx]
mov ebp, dword [ebx]
mov dword [esp + 0x48], ebp
cmp ebp, 0xfffffff0
jne 0x44edcf
movzx esi, byte [ebx + 4]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x44edcf
movzx esi, byte [ebx + 5]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x44edcf
cmp byte [ebx + 6], 1
jne 0x44edcf
cmp byte [ebx + 7], 4
jne 0x44edcf
mov esi, dword [ebx + 0x10]
cmp dword [edx + 0x58], esi
jne 0x44edcf
mov ecx, dword [edx + 0x44]
mov ebx, dword [edx + 0x40]
lea ebp, [ecx - 1]
xor eax, eax
jmp 0x44e86d
mov edx, dword [esp + 0x78]
mov eax, edi
cmp eax, ebp
jge 0x44ea3a
cmp eax, ecx
jae 0x44edca
lea esi, [ebx + eax*8]
mov esi, dword [esi]
lea edi, [eax + 1]
cmp ecx, edi
jbe 0x44edc3
lea edx, [ebx + eax*8 + 8]
cmp dword [edx], esi
jae 0x44e867
mov edx, dword [esp + 0x78]
mov ecx, dword [edx + 0x38]
mov esi, dword [edx + 0x34]
lea edx, [ebx + eax*8 + 4]
mov edx, dword [edx]
cmp ecx, edx
jbe 0x44edbc
add edx, esi
lea ebx, [ebx + eax*8 + 0xc]
mov ebx, dword [ebx]
cmp ebx, ecx
jae 0x44edb5
mov dword [esp + 0x20], eax
mov dword [esp + 0x44], edi
lea ecx, [ebx + esi]
cmp edi, ebp
jl 0x44e8d9
mov ecx, 3
lea ebx, [0x548087]
jmp 0x44e8fb
mov dword [esp + 0x5c], edx
mov dword [esp], ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
call fcn.0044fb20
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x5c]
mov ebx, eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x24], ecx
mov dword [esp], edx
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
call fcn.0044fb20
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x40]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
cmp esi, ecx
jae 0x44edae
mov dword [esp + 0x40], ebp
lea edi, [edx + esi*8]
mov edi, dword [edi]
mov ebp, dword [esp + 0x44]
cmp ecx, ebp
jbe 0x44eda7
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], ebx
lea ecx, [edx + esi*8 + 8]
mov ecx, dword [ecx]
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 0xcc]
mov dword [esp + 0x54], edx
mov ebx, dword [eax + 0xd0]
mov dword [esp + 0x44], ebx
call fcn.004351d0
lea eax, [0x552722]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353b0
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x547f07]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353b0
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x5493e6]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e00
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e00
call fcn.004353f0
call fcn.00435240
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x78]
xor edx, edx
jmp 0x44ed28
test ecx, ecx
jbe 0x44ecaf
mov dword [esp + 0x10], ebp
mov dword [esp + 0x44], ecx
mov eax, dword [ebx]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0044efa0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x78]
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x40]
mov ebp, dword [esp + 0x10]
cmp edx, ebp
jbe 0x44eca6
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
lea eax, [ebx + eax*8 - 8]
mov eax, dword [eax]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0044efa0
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x78]
mov edx, dword [ecx + 0x50]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x14]
cmp edx, ebx
jne 0x44ebd2
cmp dword [ecx + 0x54], eax
jne 0x44ebd2
mov eax, dword [ecx + 0xec]
mov edx, dword [ecx + 0xe8]
test eax, eax
je 0x44eacc
mov dword [esp + 0x44], eax
xor ebx, ebx
jmp 0x44eae1
add esp, 0x74
ret
mov ebp, dword [esp + 0x50]
lea edx, [ebp + 0x14]
mov ecx, dword [esp + 0x78]
mov ebx, eax
mov eax, dword [esp + 0x44]
lea edi, [esp + 0x60]
mov esi, edx
call fcn.0045face
mov ecx, dword [esp + 0x70]
mov ebp, dword [esp + 0x6c]
mov esi, edx
mov edx, dword [esp + 0x68]
mov eax, dword [ecx]
cmp dword [ecx + 4], ebp
jne 0x44eb31
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.00402370
movzx eax, byte [esp + 0xc]
test al, al
je 0x44eb31
mov eax, dword [esp + 0x40]
inc eax
mov ecx, dword [esp + 0x44]
cmp ecx, eax
jg 0x44ead0
jmp 0x44eacc
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0xe0]
mov dword [esp + 0x58], ecx
mov eax, dword [eax + 0xe4]
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x60]
mov dword [esp + 0x54], edx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x40], ebx
call fcn.004351d0
lea eax, [0x54f11a]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e00
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e00
lea eax, [0x5482a5]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.00435e00
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call fcn.00435e00
call fcn.004353f0
call fcn.00435240
lea eax, [0x549ad8]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a00
mov eax, dword [ecx + 0x54]
mov dword [esp + 0x34], eax
call fcn.004351d0
lea eax, [0x54894b]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x5484a2]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x5489b0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x54849c]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353f0
call fcn.00435240
lea eax, [0x54ca2f]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
mov eax, ebp
mov ecx, edx
call fcn.0045f450
xor eax, eax
call fcn.0045f450
mov dword [esp + 0x44], ebp
mov dword [esp + 0x58], ebx
lea eax, [edx + esi*8]
mov eax, dword [eax]
mov dword [esp + 0x48], eax
call fcn.004351d0
lea eax, [0x547ed3]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435c80
call fcn.004353b0
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e00
call fcn.004353f0
call fcn.00435240
mov eax, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x78]
cmp edx, eax
jg 0x44ed91
mov ebx, dword [ecx + 0x38]
mov ebp, dword [ecx + 0x34]
mov esi, dword [ecx + 0x44]
mov edi, dword [ecx + 0x40]
cmp edx, esi
jae 0x44ed88
lea esi, [edi + edx*8 + 4]
mov esi, dword [esi]
cmp ebx, esi
jbe 0x44ed7f
mov dword [esp + 0x1c], edx
lea eax, [ebp + esi]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0044fb20
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x40]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
cmp esi, ecx
jb 0x44ecb6
mov eax, esi
call fcn.0045f450
mov eax, esi
mov ecx, ebx
call fcn.0045f460
mov eax, edx
mov ecx, esi
call fcn.0045f450
lea eax, [0x54e912]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
mov eax, ebp
call fcn.0045f450
mov eax, esi
call fcn.0045f450
mov eax, ebx
call fcn.0045f460
mov eax, edx
call fcn.0045f460
mov eax, edi
call fcn.0045f450
call fcn.0045f450
movzx eax, byte [ebx + 4]
mov dword [esp + 0x3c], eax
movzx ecx, byte [ebx + 5]
mov dword [esp + 0x30], ecx
movzx ebp, byte [ebx + 6]
mov dword [esp + 0x2c], ebp
movzx esi, byte [ebx + 7]
mov dword [esp + 0x28], esi
mov ebx, dword [ebx + 0x10]
mov dword [esp + 0x38], ebx
mov edi, dword [edx + 0x58]
mov dword [esp + 0x34], edi
mov edi, dword [edx + 0xcc]
mov dword [esp + 0x58], edi
mov edx, dword [edx + 0xd0]
mov dword [esp + 0x44], edx
call fcn.004351d0
lea eax, [0x54e0e1]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x5486f1]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x5486f8]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x5489c0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54907e]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54c129]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x548706]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x549d90]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e00
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e00
call fcn.004353f0
call fcn.00435240
lea eax, [0x54ec4c]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0044e7f0