Function at 0x422580
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422863
sub esp, 0x38
call fcn.00435250
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x18], edx
call fcn.00435250
lea eax, [0x5653ac]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e80
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435e40
lea eax, [0x55da82]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x55d9f3]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e80
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435b20
lea eax, [0x566ccc]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00435e80
call fcn.004352c0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x30], 1
mov dword [esp + 0x34], 0
xor ecx, ecx
jmp 0x422685
inc dword [esp + 0x34]
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x1c], ecx
jbe 0x42284c
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 0x40]
imul edx, ecx
add edx, dword [eax + 0xc]
mov dword [esp + 0x14], edx
call fcn.00435250
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435d00
call fcn.004352c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + 0x18], eax
jbe 0x4226d1
mov edx, 1
jmp 0x4226e2
mov edx, dword [esp + 0x2c]
movzx ebx, byte [esp + 0x30]
movzx edx, byte [edx]
test dl, bl
setne dl
mov byte [esp + 0xf], dl
test dl, dl
je 0x42270c
call fcn.00435250
lea eax, [0x55c9d4]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
call fcn.004352c0
jmp 0x42272c
call fcn.00435250
lea eax, [0x55c9f2]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e80
call fcn.004352c0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
movzx eax, byte [eax]
test cl, al
je 0x42275e
call fcn.00435250
lea eax, [0x55d318]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
call fcn.004352c0
jmp 0x42277e
call fcn.00435250
lea eax, [0x55d360]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e80
call fcn.004352c0
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
movzx eax, byte [eax]
test cl, al
je 0x422798
movzx eax, byte [esp + 0xf]
xor eax, 1
jmp 0x42279a
xor eax, eax
mov byte [esp + 0xe], al
test al, al
je 0x4227c2
call fcn.00435250
lea eax, [0x55cca5]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
call fcn.004352c0
call fcn.00435250
call fcn.00435470
call fcn.004352c0
movzx eax, byte [esp + 0xe]
test al, al
je 0x422808
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x40]
cmp ecx, 0x400
jbe 0x4227ee
mov ecx, 0x400
mov eax, dword [esp + 0x14]
mov dword [esp], eax
add eax, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00435fd0
nop
movzx eax, byte [esp + 0x24]
cmp al, 0x80
jne 0x42281e
inc dword [esp + 0x20]
mov byte [esp + 0x24], 1
jmp 0x422824
shl eax, 1
mov byte [esp + 0x24], al
inc dword [esp + 0x28]
nop
movzx eax, byte [esp + 0x30]
cmp al, 0x80
jne 0x422841
inc dword [esp + 0x2c]
mov byte [esp + 0x30], 1
jmp 0x422676
shl eax, 1
mov byte [esp + 0x30], al
jmp 0x422676
lea eax, [0x562fd6]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00422580