Function at 0x44e870
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44f007
sub esp, 0x74
mov edx, dword [esp + 0x78]
mov ebx, dword [edx]
mov ebp, dword [ebx]
mov dword [esp + 0x48], ebp
cmp ebp, 0xfffffff0
jne 0x44ee4f
movzx esi, byte [ebx + 4]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x44ee4f
movzx esi, byte [ebx + 5]
xchg esi, eax
test al, al
xchg esi, eax
jne 0x44ee4f
cmp byte [ebx + 6], 1
jne 0x44ee4f
cmp byte [ebx + 7], 4
jne 0x44ee4f
mov esi, dword [ebx + 0x10]
cmp dword [edx + 0x58], esi
jne 0x44ee4f
mov ecx, dword [edx + 0x44]
mov ebx, dword [edx + 0x40]
lea ebp, [ecx - 1]
xor eax, eax
jmp 0x44e8ed
mov edx, dword [esp + 0x78]
mov eax, edi
cmp eax, ebp
jge 0x44eaba
cmp eax, ecx
jae 0x44ee4a
lea esi, [ebx + eax*8]
mov esi, dword [esi]
lea edi, [eax + 1]
cmp ecx, edi
jbe 0x44ee43
lea edx, [ebx + eax*8 + 8]
cmp dword [edx], esi
jae 0x44e8e7
mov edx, dword [esp + 0x78]
mov ecx, dword [edx + 0x38]
mov esi, dword [edx + 0x34]
lea edx, [ebx + eax*8 + 4]
mov edx, dword [edx]
cmp ecx, edx
jbe 0x44ee3c
add edx, esi
lea ebx, [ebx + eax*8 + 0xc]
mov ebx, dword [ebx]
cmp ebx, ecx
jae 0x44ee35
mov dword [esp + 0x20], eax
mov dword [esp + 0x44], edi
lea ecx, [ebx + esi]
cmp edi, ebp
jl 0x44e959
mov ecx, 3
lea ebx, [0x55c51d]
jmp 0x44e97b
mov dword [esp + 0x5c], edx
mov dword [esp], ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
call fcn.0044fba0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x5c]
mov ebx, eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x24], ecx
mov dword [esp], edx
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
call fcn.0044fba0
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x40]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
cmp esi, ecx
jae 0x44ee2e
mov dword [esp + 0x40], ebp
lea edi, [edx + esi*8]
mov edi, dword [edi]
mov ebp, dword [esp + 0x44]
cmp ecx, ebp
jbe 0x44ee27
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], ebx
lea ecx, [edx + esi*8 + 8]
mov ecx, dword [ecx]
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 0xcc]
mov dword [esp + 0x54], edx
mov ebx, dword [eax + 0xd0]
mov dword [esp + 0x44], ebx
call fcn.00435250
lea eax, [0x5670f2]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435430
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55c397]
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435430
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55d9d2]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e80
call fcn.00435470
call fcn.004352c0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x78]
xor edx, edx
jmp 0x44eda8
test ecx, ecx
jbe 0x44ed2f
mov dword [esp + 0x10], ebp
mov dword [esp + 0x44], ecx
mov eax, dword [ebx]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0044f020
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x78]
mov edx, dword [ecx + 0x44]
mov ebx, dword [ecx + 0x40]
mov ebp, dword [esp + 0x10]
cmp edx, ebp
jbe 0x44ed26
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
lea eax, [ebx + eax*8 - 8]
mov eax, dword [eax]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0044f020
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x78]
mov edx, dword [ecx + 0x50]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x14]
cmp edx, ebx
jne 0x44ec52
cmp dword [ecx + 0x54], eax
jne 0x44ec52
mov eax, dword [ecx + 0xec]
mov edx, dword [ecx + 0xe8]
test eax, eax
je 0x44eb4c
mov dword [esp + 0x44], eax
xor ebx, ebx
jmp 0x44eb61
add esp, 0x74
ret
mov ebp, dword [esp + 0x50]
lea edx, [ebp + 0x14]
mov ecx, dword [esp + 0x78]
mov ebx, eax
mov eax, dword [esp + 0x44]
lea edi, [esp + 0x60]
mov esi, edx
call fcn.0045fb5e
mov ecx, dword [esp + 0x70]
mov ebp, dword [esp + 0x6c]
mov esi, edx
mov edx, dword [esp + 0x68]
mov eax, dword [ecx]
cmp dword [ecx + 4], ebp
jne 0x44ebb1
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call fcn.00402340
movzx eax, byte [esp + 0xc]
test al, al
je 0x44ebb1
mov eax, dword [esp + 0x40]
inc eax
mov ecx, dword [esp + 0x44]
cmp ecx, eax
jg 0x44eb50
jmp 0x44eb4c
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0xe0]
mov dword [esp + 0x58], ecx
mov eax, dword [eax + 0xe4]
mov dword [esp + 0x44], eax
mov edx, dword [esp + 0x60]
mov dword [esp + 0x54], edx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x40], ebx
call fcn.00435250
lea eax, [0x5638c0]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e80
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55c7bf]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.00435e80
mov eax, dword [esp + 0x54]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call fcn.00435e80
call fcn.00435470
call fcn.004352c0
lea eax, [0x55e0bb]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a80
mov eax, dword [ecx + 0x54]
mov dword [esp + 0x34], eax
call fcn.00435250
lea eax, [0x55cf06]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55ca16]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55cf80]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55ca10]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435470
call fcn.004352c0
lea eax, [0x56107b]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
mov eax, ebp
mov ecx, edx
call fcn.0045f4d0
xor eax, eax
call fcn.0045f4d0
mov dword [esp + 0x44], ebp
mov dword [esp + 0x58], ebx
lea eax, [edx + esi*8]
mov eax, dword [eax]
mov dword [esp + 0x48], eax
call fcn.00435250
lea eax, [0x55c365]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435d00
call fcn.00435430
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e80
call fcn.00435470
call fcn.004352c0
mov eax, dword [esp + 0x1c]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x78]
cmp edx, eax
jg 0x44ee11
mov ebx, dword [ecx + 0x38]
mov ebp, dword [ecx + 0x34]
mov esi, dword [ecx + 0x44]
mov edi, dword [ecx + 0x40]
cmp edx, esi
jae 0x44ee08
lea esi, [edi + edx*8 + 4]
mov esi, dword [esi]
cmp ebx, esi
jbe 0x44edff
mov dword [esp + 0x1c], edx
lea eax, [ebp + esi]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0044fba0
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x40]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov esi, dword [esp + 0x1c]
cmp esi, ecx
jb 0x44ed36
mov eax, esi
call fcn.0045f4d0
mov eax, esi
mov ecx, ebx
call fcn.0045f4e0
mov eax, edx
mov ecx, esi
call fcn.0045f4d0
lea eax, [0x56307e]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a80
mov eax, ebp
call fcn.0045f4d0
mov eax, esi
call fcn.0045f4d0
mov eax, ebx
call fcn.0045f4e0
mov eax, edx
call fcn.0045f4e0
mov eax, edi
call fcn.0045f4d0
call fcn.0045f4d0
movzx eax, byte [ebx + 4]
mov dword [esp + 0x3c], eax
movzx ecx, byte [ebx + 5]
mov dword [esp + 0x30], ecx
movzx ebp, byte [ebx + 6]
mov dword [esp + 0x2c], ebp
movzx esi, byte [ebx + 7]
mov dword [esp + 0x28], esi
mov ebx, dword [ebx + 0x10]
mov dword [esp + 0x38], ebx
mov edi, dword [edx + 0x58]
mov dword [esp + 0x34], edi
mov edi, dword [edx + 0xcc]
mov dword [esp + 0x58], edi
mov edx, dword [edx + 0xd0]
mov dword [esp + 0x44], edx
call fcn.00435250
lea eax, [0x5627aa]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55cc89]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55cc90]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55cf90]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55d66a]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x5606f6]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55cc9e]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00435d00
lea eax, [0x55e34f]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00435e80
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.00435e80
call fcn.00435470
call fcn.004352c0
lea eax, [0x5633f2]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0044e870