Function at 0x4530d0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45358b
sub esp, 0x44
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
mov edx, dword [esp + 0x48]
add edx, 0x34
mov dword [esp + 0x38], edx
mov ebx, ecx
test ecx, ecx
je 0x453113
mov ebp, dword [ecx + 0xc]
add ebp, 0xffff0210
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, edx
jge 0x453130
mov dword [esp], ebx
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
call fcn.004537b0
mov ecx, dword [esp + 8]
nop
mov eax, ecx
mov edx, dword [esp + 0x54]
mov dword [edx], eax
mov dword [esp + 0x3c], ecx
call fcn.0045f280
mov eax, dword [esp + 4]
mov ecx, dword [esp]
shr ecx, 6
mov edx, eax
shl eax, 0x1a
or eax, ecx
mov ecx, dword [esp + 0x3c]
mov ebx, dword [ecx + 4]
mov ebp, eax
sub eax, ebx
mov dword [esp + 0x2c], eax
shr edx, 6
mov esi, dword [ecx + 8]
mov edi, ebp
sub ebp, ebx
mov ebp, edx
sbb edx, esi
test edx, edx
sete cl
test eax, eax
sete al
and ecx, eax
test cl, cl
je 0x453186
add ebx, 1
adc esi, 0
xor edx, edx
mov eax, 1
jmp 0x45318e
mov esi, ebp
mov ebx, edi
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x3c]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], esi
mov ebx, dword [esp + 0x5c]
test ebx, ebx
jl 0x4531a9
mov esi, dword [esp + 0x64]
lea edi, [esi + 1]
jmp 0x4531af
mov esi, dword [esp + 0x64]
mov edi, esi
xchg edi, eax
cmp al, 3
xchg edi, eax
jbe 0x4531bb
mov edi, 3
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
mov ecx, ebx
mov ebx, dword [ebp + 0xc]
shl edi, 6
movzx esi, byte [esp + 0x58]
or edi, esi
cmp ebx, 0xfdf0
jae 0x45357e
mov dword [esp + 0x34], ebx
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
mov esi, dword [ebp + 0xc]
inc esi
mov dword [ebp + 0xc], esi
movzx edi, byte [esp + 0x1f]
xchg edi, eax
cmp al, 3
xchg edi, eax
jne 0x45320f
mov dword [esp + 0x30], edx
xor edi, edi
xor edi, edi
mov dword [esp + 0x28], edi
xor edi, edi
jmp 0x45350a
xor esi, esi
mov dword [esp + 0x40], esi
mov edi, dword [ebp + 0xc]
jmp 0x453242
mov edx, eax
or eax, 0xffffff80
mov byte [ebp + edi + 0x210], al
shr edx, 7
mov eax, dword [esp + 0x24]
mov ebx, eax
shl eax, 0x19
or eax, edx
shr ebx, 7
inc edi
mov esi, dword [esp + 0x40]
mov edx, ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x24], edx
cmp eax, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test edx, edx
seta bl
sete dl
and edx, esi
or edx, ebx
test dl, dl
je 0x45326f
cmp edi, 0xfdf0
jb 0x45321a
jmp 0x4534ce
cmp edi, 0xfdf0
jae 0x4534c2
mov byte [ebp + edi + 0x210], al
lea edx, [edi + 1]
mov dword [ebp + 0xc], edx
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
xor eax, eax
jmp 0x4532b0
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
lea esi, [ebx + 1]
mov dword [ebp + 0xc], esi
inc eax
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
cmp edx, eax
jle 0x4532d2
lea esi, [ebx + eax*8]
mov edi, dword [esi]
mov esi, dword [esi + 4]
nop
mov ebx, dword [ebp + 0xc]
jmp 0x453475
cmp ebx, 0xfdf0
jb 0x453294
jmp 0x4534aa
test ecx, ecx
jne 0x4532e2
mov edx, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
jmp 0x4533ed
jle 0x45331c
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
lea eax, [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0x10], ecx
call fcn.004535a0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jmp 0x45336e
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x34]
sub eax, ecx
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jg 0x45333e
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x45333a
add eax, 0xfffffffe
mov byte [ecx], al
add esp, 0x44
ret
lea eax, [0x54ec69]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
mov ebp, edx
or edx, 0xffffff80
mov byte [eax + ecx + 0x210], dl
shr ebp, 7
mov edx, ebx
shl edx, 0x19
or edx, ebp
shr ebx, 7
inc ecx
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edx, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test ebx, ebx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, ebp
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x4533a1
cmp ecx, 0xfdf0
jb 0x453354
jmp 0x4533c7
cmp ecx, 0xfdf0
jae 0x4533bb
mov byte [eax + ecx + 0x210], dl
inc ecx
mov dword [eax + 0xc], ecx
mov ebp, eax
jmp 0x45331c
mov eax, ecx
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, ecx
mov ecx, 0xfdf0
call fcn.0045f450
mov ebx, eax
or eax, 0xffffff80
mov byte [ebp + edx + 0x210], al
shr ebx, 7
mov eax, ecx
shl eax, 0x19
or eax, ebx
shr ecx, 7
inc edx
test ecx, ecx
sete bl
cmp eax, 0x80
xchg esi, ebx
setae bl
xchg esi, ebx
test ecx, ecx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, ebx
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x45341b
cmp edx, 0xfdf0
jb 0x4533d3
jmp 0x453441
cmp edx, 0xfdf0
jae 0x453435
mov byte [ebp + edx + 0x210], al
lea eax, [edx + 1]
mov dword [ebp + 0xc], eax
jmp 0x45331c
mov eax, edx
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, edx
mov ecx, 0xfdf0
call fcn.0045f450
mov edx, edi
or edi, 0xffffff80
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + ebx + 0x210], al
xchg edi, eax
shr edx, 7
mov edi, dword [esp + 0x20]
mov esi, edi
shl edi, 0x19
or edi, edx
shr esi, 7
inc ebx
mov edx, dword [esp + 0x64]
mov dword [esp + 0x20], esi
cmp edi, 0x80
setae dl
test esi, esi
xchg esi, ebx
sete bl
xchg esi, ebx
xchg ebp, ebx
seta bl
xchg ebp, ebx
and esi, edx
or ebp, esi
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4532c5
cmp ebx, 0xfdf0
jb 0x45344d
jmp 0x4534b6
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, edi
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, edi
mov ecx, 0xfdf0
call fcn.0045f450
mov edx, edi
or edi, 0xffffff80
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + esi + 0x210], al
xchg edi, eax
shr edx, 7
mov edi, dword [esp + 0x28]
mov ebx, edi
shl edi, 0x19
or edi, edx
shr ebx, 7
inc esi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
test ebx, ebx
seta dl
sete bl
cmp edi, 0x80
xchg ebp, ebx
setae bl
xchg ebp, ebx
and ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x453537
cmp esi, 0xfdf0
jb 0x4534da
jmp 0x453572
cmp esi, 0xfdf0
jae 0x453566
mov ebp, dword [esp + 0x3c]
xchg edi, eax
mov byte [ebp + esi + 0x210], al
xchg edi, eax
lea edi, [esi + 1]
mov dword [ebp + 0xc], edi
lea esi, [ebp + esi + 0x210]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x453211
mov eax, esi
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, esi
mov ecx, 0xfdf0
call fcn.0045f450
mov eax, ebx
mov ecx, 0xfdf0
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.004530d0