Function at 0x430920
Capabilities:
Clear windows event logs
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x430c52
sub esp, 0x58
mov dword [esp + 0x24], 0
mov eax, dword [sym.imp.kernel32.dll_DuplicateHandle]
lea ecx, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.00431020
mov eax, dword [esp + 0x20]
test eax, eax
je 0x430bf6
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x50], eax
test byte [eax], al
lea ecx, [eax + 0x1b4]
mov dword [esp + 0x54], ecx
nop
mov dword [esp], ecx
call fcn.00409140
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1b8], eax
mov eax, dword [ecx + 0x1c4]
test eax, eax
jne 0x430a23
movzx eax, byte [0x65718a]
test al, al
je 0x430a23
mov eax, dword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0x100003
call fcn.00430f30
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1c4], eax
test eax, eax
je 0x430b9b
nop
nop
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.00409340
lea edi, [esp + 0x34]
xor eax, eax
call fcn.0045f5e9
mov eax, dword [sym.imp.kernel32.dll_VirtualQuery]
lea ecx, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x1c
call fcn.00430ee0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x430b40
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x4000]
mov dword [esp + 0x28], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov ebx, dword [edx + 4]
mov dword [esp + 0x30], ebx
cmp ebx, ecx
jb 0x430ab6
sub ebx, eax
add ebx, 0xffffc000
cmp ebx, 0x4000000
ja 0x430ab6
mov dword [edx], ecx
add eax, 0x4ba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
call fcn.0045f250
add esp, 0x58
ret
call fcn.004351d0
lea eax, [0x54baf7]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e0e]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00435c80
lea eax, [0x547e6b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
lea eax, [0x549b08]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00433a00
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.004351d0
lea eax, [0x5509cc]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x550159]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00433a00
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.004351d0
lea eax, [0x552277]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x55280d]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00433a00
call fcn.00460060
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.004351d0
lea eax, [0x55224a]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00435aa0
call fcn.004353f0
call fcn.00435240
lea eax, [0x550e3a]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00430920