Function at 0x40eb00
Capabilities:
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40ee87
sub esp, 0x40
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40ee6e
movzx ecx, byte [eax + 4]
test cl, 4
jne 0x40ee58
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx + 0x2c]
mov ebx, dword [edx]
mov ebp, dword [eax + 8]
lea esi, [esp + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], ebp
call ebx
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x48]
movzx ebx, byte [ecx + 4]
xor ebx, 4
mov byte [ecx + 4], bl
mov ebx, dword [ecx + 0xc]
test ebx, ebx
jne 0x40ebad
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x28]
mov edx, dword [ecx]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov byte [esp + 8], 1
call fcn.0040a8f0
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0xc]
test eax, eax
jne 0x40eb99
mov edx, dword [esp + 0x48]
mov dword [edx + 0xc], ecx
jmp 0x40eba7
mov edx, dword [esp + 0x48]
lea edi, [edx + 0xc]
mov eax, ecx
call fcn.0045f450
mov eax, dword [esp + 0x18]
mov ecx, edx
mov edx, dword [esp + 0x44]
jmp 0x40ebd5
mov dword [esp], edx
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
call fcn.0040d080
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x18]
mov eax, edx
mov edx, dword [esp + 0x44]
movzx ebx, byte [ecx + 5]
mov ebp, ecx
mov ecx, ebx
mov esi, 1
shl esi, cl
lea ebx, [esi - 1]
and ebx, eax
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40ec14
mov dword [esp + 0x1c], ebx
mov dword [esp], edx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.0040eea0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x48]
movzx esi, word [edx + 0x32]
imul ebx, esi
add ebx, dword [ebp + 0xc]
mov esi, eax
shr eax, 0x18
cmp al, 5
jae 0x40ec2b
add eax, 5
mov byte [esp + 0x13], al
xor ecx, ecx
xor edi, edi
jmp 0x40ecaa
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x48]
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x40edc7
mov dword [esp + 0x3c], ecx
mov esi, dword [ebp]
inc esi
movzx ebx, byte [ebp + 5]
cmp esi, 8
jle 0x40ec7e
mov ecx, ebx
mov ebp, 1
shl ebp, cl
shr ebp, 1
lea ebx, [ebp + ebp*2]
lea ebx, [ebp + ebx*4]
cmp ebx, esi
jb 0x40ebb3
mov ebx, ecx
mov ebp, dword [esp + 0x48]
mov ecx, dword [esp + 0x3c]
movzx esi, word [ebp + 6]
cmp bl, 0xf
jbe 0x40ec8c
mov ebx, 0xf
and ebx, 0xf
mov ecx, ebx
mov ebp, 1
shl ebp, cl
cmp si, bp
jae 0x40ebb3
jmp 0x40edbb
mov esi, dword [esp + 0x18]
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], al
xor eax, eax
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 0x28]
jmp 0x40ece1
movzx esi, word [edx + 0x32]
lea ebx, [ebx + esi - 4]
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40eca6
jmp 0x40ec35
lea ebp, [esi + 1]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x14]
cmp esi, 8
jae 0x40ecbf
test byte [ebx], al
movzx ebp, byte [ebx + esi]
xchg ebp, ebx
cmp al, bl
xchg ebp, ebx
je 0x40ed12
xchg ebp, eax
cmp al, 1
xchg ebp, eax
ja 0x40ed07
test ecx, ecx
jne 0x40ed07
mov ecx, ebx
mov edi, esi
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x40ecd2
jmp 0x40ec39
mov ebp, ebx
lea ebx, [ebx + esi*8 + 8]
nop
mov edx, dword [esp + 0x50]
cmp dword [ebx + 4], edx
je 0x40ed2a
mov edx, dword [esp + 0x44]
mov ebx, ebp
jmp 0x40ecd2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], edx
mov ebx, dword [ebx]
mov edx, dword [esp + 0x4c]
cmp edx, ebx
jne 0x40ed40
xor edx, edx
jmp 0x40ed7b
mov dword [esp + 0x20], edi
mov dword [esp + 0x34], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
call fcn.00402340
movzx eax, byte [esp + 0xc]
xor eax, 1
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
mov edx, eax
movzx eax, byte [esp + 0x13]
test dl, dl
je 0x40ed8a
mov edx, dword [esp + 0x44]
mov ebx, ebp
jmp 0x40ecd2
mov ecx, dword [0x67e2d0]
mov eax, dword [esp + 0x4c]
test ecx, ecx
jne 0x40eda0
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
jmp 0x40eda9
mov edi, dword [esp + 0x30]
call fcn.0045f450
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
jmp 0x40ee20
mov ecx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x48]
test ecx, ecx
jne 0x40edee
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
call fcn.0040bb30
mov ecx, dword [esp + 0xc]
movzx eax, byte [esp + 0x13]
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
xor edi, edi
test byte [ecx], al
mov ebx, edi
and edi, 7
mov byte [ecx + edi], al
mov esi, ecx
lea edi, [ecx + ebx*8 + 8]
nop
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov dword [edi + 4], ecx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x40ee18
mov dword [edi], eax
jmp 0x40ee1d
call fcn.0045f450
inc dword [ebp]
movzx eax, byte [edx + 0x31]
imul eax, ebx
movzx ecx, byte [ebp + 4]
lea eax, [eax + esi + 0x48]
test cl, 4
je 0x40ee42
and ecx, 0xfffffffb
mov byte [ebp + 4], cl
mov dword [esp + 0x54], eax
add esp, 0x40
ret
lea eax, [0x560a68]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a80
lea eax, [0x560a68]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a80
lea eax, [0x54a860]
mov dword [esp], eax
lea eax, [0x59a674]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.0040eb00