Function at 0x43c4d0
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43c8d6
sub esp, 0x34
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x78]
test edx, edx
jne 0x43c8bf
mov dword [esp + 0x28], eax
mov ecx, dword [ecx + 0xbc]
test ecx, ecx
je 0x43c535
call fcn.0043a700
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0xbc]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.0043aa10
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
movzx ecx, byte [ecx + 0x88]
test cl, cl
je 0x43c554
jmp 0x43c8a9
mov dword [esp], eax
call fcn.0043a860
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov byte [ecx + 0x11a4], 0
mov edx, dword [0x658b70]
test edx, edx
jne 0x43c885
mov edx, dword [ecx + 0x1178]
test edx, edx
je 0x43c58c
mov dword [esp + 0x30], ecx
call fcn.00439300
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [eax + 0x18]
movzx edx, byte [edx + 0x84]
test dl, dl
je 0x43c5ba
mov edx, dword [ecx + 0x4f0]
test edx, edx
jne 0x43c893
mov edx, dword [ecx + 0xe8]
cmp dword [ecx + 0xec], edx
jne 0x43c893
mov dword [esp], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.0043c8e0
movzx eax, byte [0x662748]
test al, al
jne 0x43c5e8
movzx eax, byte [0x662749]
test al, al
je 0x43c62c
call fcn.00452f20
mov eax, dword [esp]
test eax, eax
je 0x43c627
mov dword [esp + 0x24], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437fc0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004545c0
mov eax, dword [esp + 0x24]
test eax, eax
setne cl
jmp 0x43c630
xor eax, eax
xor ecx, ecx
test eax, eax
jne 0x43c66e
mov edx, dword [0x67e120]
test edx, edx
je 0x43c66e
mov byte [esp + 0x21], cl
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
lea edx, [0x67e920]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0041d5b0
mov eax, dword [esp + 8]
test eax, eax
setne cl
movzx edx, byte [esp + 0x21]
or ecx, edx
mov byte [esp + 0x23], cl
test eax, eax
je 0x43c67c
mov edx, dword [esp + 0x28]
jmp 0x43c6ef
mov edx, dword [esp + 0x28]
mov ebx, dword [edx + 0x18]
mov ebx, dword [ebx + 0x54]
mov ebx, dword [ebx + 0xc]
imul ebx, ebx, 0xc10c9715
cmp ebx, 0x4325c53
ja 0x43c6ef
mov ebx, dword [0x658b38]
test ebx, ebx
jle 0x43c6ef
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00441d20
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], eax
nop
nop
lea ecx, [0x658af8]
mov dword [esp], ecx
call fcn.00409310
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x43c6f7
xor ebx, ebx
jmp 0x43c719
mov eax, dword [edx + 0x18]
mov eax, dword [eax + 0x54]
mov dword [esp], eax
call fcn.00442630
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
mov edx, dword [esp + 0x28]
mov ebx, ecx
movzx ecx, byte [esp + 0x23]
test eax, eax
jne 0x43c733
call fcn.0043ab50
mov eax, dword [esp]
movzx ebx, byte [esp + 4]
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
mov byte [esp + 0x22], bl
mov dword [esp + 0x2c], eax
mov ebp, dword [edx + 0x18]
movzx ebp, byte [ebp + 0x84]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x43c762
call fcn.0043c150
mov eax, dword [esp + 0x2c]
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x22]
movzx ebp, byte [0x658b3c]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x43c773
xor ebp, ebp
jmp 0x43c79c
mov dword [esp], eax
mov byte [esp + 4], 1
call fcn.004582a0
movzx eax, byte [esp + 8]
xor eax, 1
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x22]
mov ebp, eax
mov eax, dword [esp + 0x2c]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x43c851
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409110
movzx eax, byte [0x658b3c]
test al, al
jne 0x43c7c7
mov eax, 1
jmp 0x43c7dd
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov byte [esp + 4], 1
call fcn.004582a0
movzx eax, byte [esp + 8]
test al, al
jne 0x43c82f
nop
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x58], 0
mov ecx, dword [0x658b44]
test ecx, ecx
je 0x43c7fe
mov edx, eax
mov dword [ecx + 0x58], eax
jmp 0x43c809
nop
mov ecx, eax
mov dword [0x658b40], eax
mov edx, ecx
nop
mov dword [0x658b44], edx
inc dword [0x658b48]
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x28]
jmp 0x43c554
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x2c]
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x22]
test cl, cl
je 0x43c867
call fcn.0043a670
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
movzx ebx, byte [esp + 0x22]
mov ecx, dword [eax + 0x98]
test ecx, ecx
jne 0x43c548
mov dword [esp], eax
mov byte [esp + 4], bl
call fcn.0043aa10
add esp, 0x34
ret
call fcn.0043a910
mov eax, dword [esp + 0x28]
jmp 0x43c554
lea eax, [0x564c3c]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00433a80
lea eax, [0x55f1ab]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433a80
lea eax, [0x5618a7]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0043c4d0