Function at 0x4308f0
Capabilities:
Clear windows event logs
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x430c22
sub esp, 0x58
mov dword [esp + 0x24], 0
mov eax, dword [sym.imp.kernel32.dll_DuplicateHandle]
lea ecx, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.00430ff0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x430bc6
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x50], eax
test byte [eax], al
lea ecx, [eax + 0x1b4]
mov dword [esp + 0x54], ecx
nop
mov dword [esp], ecx
call fcn.00409110
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1b8], eax
mov eax, dword [ecx + 0x1c4]
test eax, eax
jne 0x4309f3
movzx eax, byte [0x67e08b]
test al, al
je 0x4309f3
mov eax, dword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0x100003
call fcn.00430f00
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1c4], eax
test eax, eax
je 0x430b6b
nop
nop
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.00409310
lea edi, [esp + 0x34]
xor eax, eax
call fcn.0045f679
mov eax, dword [sym.imp.kernel32.dll_VirtualQuery]
lea ecx, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x1c
call fcn.00430eb0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x430b10
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x4000]
mov dword [esp + 0x28], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov ebx, dword [edx + 4]
mov dword [esp + 0x30], ebx
cmp ebx, ecx
jb 0x430a86
sub ebx, eax
add ebx, 0xffffc000
cmp ebx, 0x4000000
ja 0x430a86
mov dword [edx], ecx
add eax, 0x4ba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
call fcn.0045f2d0
add esp, 0x58
ret
call fcn.00435250
lea eax, [0x5600c4]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c26e]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55c2cb]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
lea eax, [0x55e0eb]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a80
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.00435250
lea eax, [0x56531c]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x5649fa]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00433a80
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.00435250
lea eax, [0x566c18]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x5671dd]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00433a80
call fcn.004600f0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.00435250
lea eax, [0x566beb]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435b20
call fcn.00435470
call fcn.004352c0
lea eax, [0x5657af]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004308f0