Function at 0x43a090
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43a30b
sub esp, 0x24
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
nop
inc dword [ecx + 0x78]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x18], eax
nop
lea ecx, [0x631bf8]
mov dword [esp], ecx
call fcn.00409140
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x43a0eb
call fcn.00442030
mov eax, dword [esp]
test eax, eax
je 0x43a248
nop
mov ecx, dword [0x631bfc]
test ecx, ecx
je 0x43a10a
mov edx, dword [ecx + 0xb8]
mov dword [0x631bfc], edx
dec dword [0x631c00]
test ecx, ecx
mov dword [esp + 0x1c], eax
jne 0x43a19e
call fcn.00437850
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
mov ecx, dword [esp]
mov dword [esp + 0x10], ecx
nop
nop
lea edx, [0x631bf8]
mov dword [esp], edx
call fcn.00409340
movzx eax, byte [esp + 0x2c]
test al, al
je 0x43a149
lea eax, [0x556208]
jmp 0x43a14b
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
call fcn.00439aa0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a19a
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a19a
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
mov dword [esp + 0x20], ecx
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x84]
test cl, cl
jne 0x43a2f4
mov ecx, dword [eax + 0x58]
test ecx, ecx
jne 0x43a2de
movzx ecx, byte [esp + 0x2c]
test cl, cl
je 0x43a1fb
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00442120
movzx eax, byte [esp + 4]
test al, al
je 0x43a2c8
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x2c]
mov byte [eax + 0x84], cl
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x58], ecx
add eax, 0xb0
mov dword [esp], eax
call fcn.00409430
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a244
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a244
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
movzx eax, byte [esp + 0x2c]
test al, al
je 0x43a27f
lea eax, [0x631c2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
mov eax, dword [esp + 8]
test eax, eax
jl 0x43a2b2
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x78]
lea ebx, [edx - 1]
mov dword [ecx + 0x78], ebx
cmp edx, 1
jne 0x43a2ae
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43a2ae
mov dword [eax + 8], 0xfffffade
add esp, 0x24
ret
lea eax, [0x54e5b4]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a00
lea eax, [0x54dc88]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a00
lea eax, [0x54a7ac]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.00433a00
lea eax, [0x54c600]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0043a090