Function at 0x436c20
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x436f56
movzx ebx, byte [eax + 0x24]
test bl, bl
jne 0x436f40
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x436f2a
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x436f14
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x436efe
mov ebx, dword [eax + 0x34]
test ebx, ebx
jne 0x436ee8
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x44]
test ebp, ebp
jne 0x436ed2
mov ebp, dword [ebx + 0x18]
nop
inc dword [ebp + 0x78]
mov ebp, dword [ebx + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [ebp + 0x54]
mov dword [esp + 0x38], esi
test byte [ebx], al
mov ebx, dword [esi + 0x504]
cmp dword [esi + 0x500], ebx
jne 0x436cb0
xor ecx, ecx
xor edx, edx
jmp 0x436d85
mov ecx, dword [esi + 0x500]
lea edx, [ecx + 1]
mov ebx, dword [esi + 0x4fc]
mov edi, ebp
mov ebp, dword [esi + 0x504]
cmp ebp, edx
jae 0x436d28
lea eax, [0x541fe0]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
call fcn.00447650
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov dword [ebx + 0x504], edx
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x436d11
mov dword [ebx + 0x4fc], eax
jmp 0x436d1c
lea edi, [ebx + 0x4fc]
call fcn.0045f450
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x40]
lea edx, [ecx + 1]
mov dword [esi + 0x500], edx
mov edx, dword [0x67e2d0]
lea ebp, [ebx + ecx*4]
test edx, edx
jne 0x436d43
mov dword [ebx + ecx*4], eax
jmp 0x436d4e
mov ecx, edi
mov edi, ebp
call fcn.0045f450
mov edi, ecx
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [edi + 0x78]
lea edx, [ecx - 1]
mov dword [edi + 0x78], edx
cmp ecx, 1
jne 0x436d79
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x436d79
mov dword [eax + 8], 0xfffffade
add esp, 0x3c
ret
mov ebp, edi
mov esi, ebx
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esi + 0x4fc]
mov edi, ebp
mov ebp, dword [esi + 0x504]
mov esi, dword [esi + 0x500]
shr ebp, 1
cmp esi, ebp
jle 0x436e4b
lea ebp, [esi - 1]
cmp esi, ebp
jbe 0x436ec9
mov dword [esp + 0x20], ebp
mov ebp, dword [ebx + esi*4 - 4]
mov dword [esp + 0x2c], ebp
lea ebp, [ebx + esi*4 - 4]
mov dword [esp + 0x34], ebp
mov ebp, dword [0x67e2d0]
test ebp, ebp
jne 0x436dd6
mov dword [ebx + esi*4 - 4], 0
jmp 0x436de9
mov ebx, edi
mov edi, dword [esp + 0x34]
mov ebp, eax
xor eax, eax
call fcn.0045f450
mov eax, ebp
mov edi, ebx
mov ebx, dword [esp + 0x38]
mov ebp, dword [ebx + 0x504]
mov esi, dword [esp + 0x20]
cmp ebp, esi
jb 0x436ec0
mov dword [ebx + 0x500], esi
test edx, edx
je 0x436e40
test byte [ecx], al
mov ebp, dword [0x67e2d0]
test ebp, ebp
jne 0x436e21
mov ebp, dword [esp + 0x2c]
mov dword [ecx + 4], ebp
jmp 0x436d7d
lea ebp, [ecx + 4]
mov ecx, edi
mov edi, ebp
mov esi, eax
mov eax, dword [esp + 0x2c]
call fcn.0045f450
mov eax, esi
mov ebp, dword [esp + 0x2c]
mov edi, ecx
jmp 0x436d7d
mov ebp, dword [esp + 0x2c]
mov edx, ebp
jmp 0x436d7d
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ecx
nop
lea eax, [0x658b5c]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [esp + 0x28]
test byte [eax], al
mov ecx, dword [0x67e2d0]
mov edx, dword [0x658b60]
test ecx, ecx
jne 0x436e87
mov dword [eax + 4], edx
mov eax, dword [esp + 0x30]
mov dword [0x658b60], eax
jmp 0x436ea0
lea edi, [eax + 4]
mov eax, edx
call fcn.0045f450
lea edi, [0x658b60]
mov eax, dword [esp + 0x30]
call fcn.0045f450
nop
lea eax, [0x658b5c]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
jmp 0x436cb0
mov ecx, esi
mov edx, ebp
call fcn.0045f510
mov eax, ebp
mov ecx, esi
call fcn.0045f4d0
lea eax, [0x56684c]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a80
lea eax, [0x563653]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
lea eax, [0x5653f4]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a80
lea eax, [0x56434d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
lea eax, [0x56432d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
lea eax, [0x565b11]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00433a80
lea eax, [0x56430d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a80
nop
int3