Function at 0x453150
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45360b
sub esp, 0x44
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
mov edx, dword [esp + 0x48]
add edx, 0x34
mov dword [esp + 0x38], edx
mov ebx, ecx
test ecx, ecx
je 0x453193
mov ebp, dword [ecx + 0xc]
add ebp, 0xffff0210
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, edx
jge 0x4531b0
mov dword [esp], ebx
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
call fcn.00453830
mov ecx, dword [esp + 8]
nop
mov eax, ecx
mov edx, dword [esp + 0x54]
mov dword [edx], eax
mov dword [esp + 0x3c], ecx
call fcn.0045f300
mov eax, dword [esp + 4]
mov ecx, dword [esp]
shr ecx, 6
mov edx, eax
shl eax, 0x1a
or eax, ecx
mov ecx, dword [esp + 0x3c]
mov ebx, dword [ecx + 4]
mov ebp, eax
sub eax, ebx
mov dword [esp + 0x2c], eax
shr edx, 6
mov esi, dword [ecx + 8]
mov edi, ebp
sub ebp, ebx
mov ebp, edx
sbb edx, esi
test edx, edx
sete cl
test eax, eax
sete al
and ecx, eax
test cl, cl
je 0x453206
add ebx, 1
adc esi, 0
xor edx, edx
mov eax, 1
jmp 0x45320e
mov esi, ebp
mov ebx, edi
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x3c]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], esi
mov ebx, dword [esp + 0x5c]
test ebx, ebx
jl 0x453229
mov esi, dword [esp + 0x64]
lea edi, [esi + 1]
jmp 0x45322f
mov esi, dword [esp + 0x64]
mov edi, esi
xchg edi, eax
cmp al, 3
xchg edi, eax
jbe 0x45323b
mov edi, 3
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
mov ecx, ebx
mov ebx, dword [ebp + 0xc]
shl edi, 6
movzx esi, byte [esp + 0x58]
or edi, esi
cmp ebx, 0xfdf0
jae 0x4535fe
mov dword [esp + 0x34], ebx
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
mov esi, dword [ebp + 0xc]
inc esi
mov dword [ebp + 0xc], esi
movzx edi, byte [esp + 0x1f]
xchg edi, eax
cmp al, 3
xchg edi, eax
jne 0x45328f
mov dword [esp + 0x30], edx
xor edi, edi
xor edi, edi
mov dword [esp + 0x28], edi
xor edi, edi
jmp 0x45358a
xor esi, esi
mov dword [esp + 0x40], esi
mov edi, dword [ebp + 0xc]
jmp 0x4532c2
mov edx, eax
or eax, 0xffffff80
mov byte [ebp + edi + 0x210], al
shr edx, 7
mov eax, dword [esp + 0x24]
mov ebx, eax
shl eax, 0x19
or eax, edx
shr ebx, 7
inc edi
mov esi, dword [esp + 0x40]
mov edx, ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x24], edx
cmp eax, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test edx, edx
seta bl
sete dl
and edx, esi
or edx, ebx
test dl, dl
je 0x4532ef
cmp edi, 0xfdf0
jb 0x45329a
jmp 0x45354e
cmp edi, 0xfdf0
jae 0x453542
mov byte [ebp + edi + 0x210], al
lea edx, [edi + 1]
mov dword [ebp + 0xc], edx
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
xor eax, eax
jmp 0x453330
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
lea esi, [ebx + 1]
mov dword [ebp + 0xc], esi
inc eax
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
cmp edx, eax
jle 0x453352
lea esi, [ebx + eax*8]
mov edi, dword [esi]
mov esi, dword [esi + 4]
nop
mov ebx, dword [ebp + 0xc]
jmp 0x4534f5
cmp ebx, 0xfdf0
jb 0x453314
jmp 0x45352a
test ecx, ecx
jne 0x453362
mov edx, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
jmp 0x45346d
jle 0x45339c
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
lea eax, [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0x10], ecx
call fcn.00453620
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jmp 0x4533ee
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jg 0x4533be
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x4533ba
add eax, 0xfffffffe
mov byte [ecx], al
add esp, 0x44
ret
lea eax, [0x56340f]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
mov ebp, edx
or edx, 0xffffff80
mov byte [eax + ecx + 0x210], dl
shr ebp, 7
mov edx, ebx
shl edx, 0x19
or edx, ebp
shr ebx, 7
inc ecx
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edx, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test ebx, ebx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, ebp
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x453421
cmp ecx, 0xfdf0
jb 0x4533d4
jmp 0x453447
cmp ecx, 0xfdf0
jae 0x45343b
mov byte [eax + ecx + 0x210], dl
inc ecx
mov dword [eax + 0xc], ecx
mov ebp, eax
jmp 0x45339c
mov eax, ecx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, ecx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov ebx, eax
or eax, 0xffffff80
mov byte [ebp + edx + 0x210], al
shr ebx, 7
mov eax, ecx
shl eax, 0x19
or eax, ebx
shr ecx, 7
inc edx
test ecx, ecx
sete bl
cmp eax, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test ecx, ecx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, ebx
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x45349b
cmp edx, 0xfdf0
jb 0x453453
jmp 0x4534c1
cmp edx, 0xfdf0
jae 0x4534b5
mov byte [ebp + edx + 0x210], al
lea eax, [edx + 1]
mov dword [ebp + 0xc], eax
jmp 0x45339c
mov eax, edx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, edx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov edx, edi
or edi, 0xffffff80
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
shr edx, 7
mov edi, dword [esp + 0x20]
mov esi, edi
shl edi, 0x19
or edi, edx
shr esi, 7
inc ebx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x20], esi
cmp edi, 0x80
setae dl
test esi, esi
xchg esi, ebx
sete bl
xchg esi, ebx
xchg ebp, ebx
seta bl
xchg ebp, ebx
and esi, edx
or ebp, esi
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x453345
cmp ebx, 0xfdf0
jb 0x4534cd
jmp 0x453536
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, edi
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, edi
mov ecx, 0xfdf0
call fcn.0045f4d0
mov edx, edi
or edi, 0xffffff80
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + esi + 0x210], al
xchg edi, eax
shr edx, 7
mov edi, dword [esp + 0x28]
mov ebx, edi
shl edi, 0x19
or edi, edx
shr ebx, 7
inc esi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
test ebx, ebx
seta dl
sete bl
cmp edi, 0x80
xchg ebp, ebx
setae bl
xchg ebp, ebx
and ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4535b7
cmp esi, 0xfdf0
jb 0x45355a
jmp 0x4535f2
cmp esi, 0xfdf0
jae 0x4535e6
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + esi + 0x210], al
xchg edi, eax
lea edi, [esi + 1]
mov dword [ebp + 0xc], edi
lea esi, [ebp + esi + 0x210]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x453291
mov eax, esi
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, esi
mov ecx, 0xfdf0
call fcn.0045f4d0
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00453150