Function at 0x516180
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5163d9
sub esp, 0x3c
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x516219
cmp ecx, 1
jne 0x5161b3
mov edx, dword [esp + 0x40]
xor eax, eax
xor ebx, ebx
jmp 0x516253
mov edx, dword [esp + 0x40]
movzx ebx, byte [edx]
test bl, bl
jne 0x5161c9
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5161d7
cmp bl, 0xff
jne 0x516213
movzx ebx, byte [edx + 1]
test bl, 0x80
je 0x516213
lea eax, [0x54ec2f]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x1d
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, eax
lea eax, [0x57dc18]
jmp 0x516253
xor eax, eax
xor ebx, ebx
jmp 0x516253
lea eax, [0x549f3d]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0xd
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408c10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, eax
lea eax, [0x57dc18]
test eax, eax
jne 0x5162b7
cmp ecx, 8
jg 0x51626b
mov dword [esp + 0x20], ebx
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x5162f3
lea eax, [0x54ae9e]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x11
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00408c10
mov eax, dword [esp + 8]
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
lea ecx, [0x57dc18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], eax
add esp, 0x3c
ret
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ebx
add esp, 0x3c
ret
lea edi, [ebp + 1]
mov ebx, dword [esp + 0x1c]
shl ebx, 8
movzx ebp, byte [edx + ebp]
or ebp, ebx
mov ebx, dword [esp + 0x20]
mov ebx, ebp
mov ebp, edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x1c], esi
cmp ecx, ebp
jle 0x51630c
shl edi, 8
shr esi, 0x18
or esi, edi
cmp ecx, ebp
ja 0x5162d3
jmp 0x5163d1
mov dword [esp + 0x10], eax
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
cmp dl, 0x20
sbb ebp, ebp
lea ebx, [ecx - 0x20]
mov byte [esp + 0xf], bl
mov ecx, ebx
neg ebx
mov byte [esp + 0xe], bl
cmp bl, 0x20
sbb eax, eax
mov dword [esp + 0x18], eax
cmp cl, 0x20
sbb eax, eax
mov dword [esp + 0x14], eax
cmp dl, 0x20
sbb ebx, ebx
mov ecx, edx
shl edi, cl
movzx ecx, byte [esp + 0xf]
shr esi, cl
and esi, eax
and edi, ebp
or edi, esi
movzx ecx, byte [esp + 0xe]
mov eax, dword [esp + 0x1c]
shl eax, cl
mov esi, dword [esp + 0x18]
and esi, eax
or edi, esi
not ebx
or ebx, edx
mov eax, ecx
mov ecx, ebx
mov esi, edi
sar edi, cl
mov dword [esp + 0x50], edi
cmp al, 0x20
sbb ebx, ebx
mov ecx, edx
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov edi, dword [esp + 0x1c]
shl edi, cl
and edi, ebp
not ebx
or ebx, eax
mov eax, ecx
mov ecx, ebx
mov ebx, esi
sar esi, cl
xor edx, 0xffffffff
and edx, esi
movzx ecx, byte [esp + 0xf]
shl ebx, cl
mov ecx, eax
shr edi, cl
mov eax, dword [esp + 0x14]
and ebx, eax
and edi, ebp
or edi, ebx
or edx, edi
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x58], eax
add esp, 0x3c
ret
mov eax, ebp
call fcn.0045f450
nop
call fcn.0045e000
jmp fcn.00516180