Function at 0x4435e0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443bd2
sub esp, 0x48
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x24], 0
xor eax, eax
mov ecx, 0x1e
mov edx, 0xb3a
mov ebx, 0x4b57ce31
jmp 0x44364d
dec ecx
test ecx, ecx
jl 0x4436f1
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
lea ebp, [ecx - 0x20]
mov esi, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
cmp esi, 0x20
sbb eax, eax
mov ecx, esi
mov ebx, 0x3b9aca00
shl ebx, cl
mov ecx, ebp
mov ebp, 0x3b9aca00
shr ebp, cl
and ebp, edi
and eax, ebx
or ebp, eax
cmp edx, ebp
sete al
mov ecx, dword [esp + 0x34]
cmp ecx, 0x20
sbb ebx, ebx
mov esi, 0x3b9aca00
shl esi, cl
and esi, ebx
mov ebx, dword [esp + 0x1c]
cmp ebx, esi
xchg edi, ebx
setae bl
xchg edi, ebx
cmp edx, ebp
setg dl
and edi, eax
or edx, edi
test dl, dl
je 0x4436e4
sub ebx, esi
mov edx, dword [esp + 0x20]
sbb edx, ebp
cmp ecx, 0x20
sbb eax, eax
mov ebp, 1
shl ebp, cl
and eax, ebp
mov ebp, dword [esp + 0x14]
or eax, ebp
jmp 0x44364c
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
jmp 0x44364c
test edx, edx
setg cl
cmp ebx, 0x3b9aca00
xchg ebp, ebx
setae bl
xchg ebp, ebx
test edx, edx
sete dl
and edx, ebp
or edx, ecx
test dl, dl
je 0x44371f
mov dword [esp + 0x30], 0
mov eax, 0x7fffffff
jmp 0x443723
mov dword [esp + 0x30], ebx
cmp eax, 0x3039
jne 0x443bbb
cmp dword [esp + 0x30], 0xd431
jne 0x443bbb
mov dword [esp + 0x18], 0
mov dword [esp + 0x18], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 2
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x443ba5
cmp dword [esp + 0x18], 2
jne 0x443b8f
mov dword [esp + 0x18], 4
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 5
mov dword [esp + 8], 6
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
jne 0x443b79
cmp dword [esp + 0x18], 4
jne 0x443b63
mov dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
call fcn.00401c00
movzx eax, byte [esp + 0xc]
test al, al
je 0x443b4d
cmp dword [esp + 0x18], 0xfffffffe
jne 0x443b37
mov dword [esp + 0x24], 0
mov dword [esp + 0x24], 0x1010101
lea eax, [esp + 0x25]
mov dword [esp], eax
mov byte [esp + 4], 0xf0
call fcn.00401e70
cmp byte [esp + 0x24], 1
jne 0x443b21
cmp byte [esp + 0x25], 0xf1
jne 0x443b21
cmp byte [esp + 0x26], 1
jne 0x443b21
cmp byte [esp + 0x27], 1
jne 0x443b21
mov dword [esp + 0x24], 0
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x25]
mov dword [esp], eax
mov byte [esp + 4], 1
call fcn.00401e80
cmp byte [esp + 0x24], 0xff
jne 0x443b0b
cmp byte [esp + 0x25], 1
jne 0x443b0b
cmp byte [esp + 0x26], 0xff
jne 0x443b0b
cmp byte [esp + 0x27], 0xff
jne 0x443b0b
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
call fcn.00449c20
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443af5
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00449c20
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443adf
mov dword [esp + 0x38], 0xfffffffe
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xfffffffe
call fcn.00449c20
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443ac9
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
call fcn.00449c20
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443ab3
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
call fcn.00449b90
movzx eax, byte [esp + 8]
test al, al
jne 0x443a9d
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
call fcn.00449b90
movzx eax, byte [esp + 8]
test al, al
jne 0x443a87
mov dword [esp + 0x28], 0xfffffffe
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xfffffffe
call fcn.00449b90
movzx eax, byte [esp + 8]
test al, al
jne 0x443a71
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00449b90
movzx eax, byte [esp + 8]
test al, al
jne 0x443a5b
call fcn.00443290
xor eax, eax
jmp 0x443a04
inc eax
cmp eax, 0x20
sbb edx, edx
mov ecx, eax
mov ebx, 1
shl ebx, cl
and ebx, edx
cmp ebx, 0x1000
jl 0x443a03
jne 0x443a45
call fcn.0045f410
movzx eax, byte [esp]
test al, al
je 0x443a2f
add esp, 0x48
ret
lea eax, [0x560f31]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
lea eax, [0x562e86]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a80
lea eax, [0x55dd21]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55dd16]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55dd0b]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55d8ae]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a80
lea eax, [0x55dd42]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55dd37]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55dd2c]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
lea eax, [0x55d8b8]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a80
lea eax, [0x55d87c]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a80
lea eax, [0x55d4da]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00433a80
lea eax, [0x55c728]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55c724]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55c720]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55c71c]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55c718]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55c714]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a80
lea eax, [0x55dc9d]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.004435e0