Function at 0x43a110
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43a38b
sub esp, 0x24
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
nop
inc dword [ecx + 0x78]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x18], eax
nop
lea ecx, [0x658af8]
mov dword [esp], ecx
call fcn.00409110
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x43a16b
call fcn.004420b0
mov eax, dword [esp]
test eax, eax
je 0x43a2c8
nop
mov ecx, dword [0x658afc]
test ecx, ecx
je 0x43a18a
mov edx, dword [ecx + 0xb8]
mov dword [0x658afc], edx
dec dword [0x658b00]
test ecx, ecx
mov dword [esp + 0x1c], eax
jne 0x43a21e
call fcn.004378d0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
nop
nop
lea edx, [0x658af8]
mov dword [esp], edx
call fcn.00409310
movzx eax, byte [esp + 0x2c]
test al, al
je 0x43a1c9
lea eax, [0x571300]
jmp 0x43a1cb
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
call fcn.00439b20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a21a
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a21a
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
mov dword [esp + 0x20], ecx
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x84]
test cl, cl
jne 0x43a374
mov ecx, dword [eax + 0x58]
test ecx, ecx
jne 0x43a35e
movzx ecx, byte [esp + 0x2c]
test cl, cl
je 0x43a27b
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004421a0
movzx eax, byte [esp + 4]
test al, al
je 0x43a348
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x2c]
mov byte [eax + 0x84], cl
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x58], ecx
add eax, 0xb0
mov dword [esp], eax
call fcn.00409400
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a2c4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a2c4
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
nop
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
movzx eax, byte [esp + 0x2c]
test al, al
je 0x43a2ff
lea eax, [0x658b2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d30
mov eax, dword [esp + 8]
test eax, eax
jl 0x43a332
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a32e
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a32e
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
lea eax, [0x562ce8]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a80
lea eax, [0x562303]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a80
lea eax, [0x55ed7e]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00433a80
lea eax, [0x560c36]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0043a110