Function at 0x436ba0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x436ed6
movzx ebx, byte [eax + 0x24]
test bl, bl
jne 0x436ec0
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x436eaa
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x436e94
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x436e7e
mov ebx, dword [eax + 0x34]
test ebx, ebx
jne 0x436e68
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x44]
test ebp, ebp
jne 0x436e52
mov ebp, dword [ebx + 0x18]
nop
inc dword [ebp + 0x78]
mov ebp, dword [ebx + 0x18]
mov dword [esp + 0x24], ebp
mov esi, dword [ebp + 0x54]
mov dword [esp + 0x38], esi
test byte [ebx], al
mov ebx, dword [esi + 0x504]
cmp dword [esi + 0x500], ebx
jne 0x436c30
xor ecx, ecx
xor edx, edx
jmp 0x436d05
mov ecx, dword [esi + 0x500]
lea edx, [ecx + 1]
mov ebx, dword [esi + 0x4fc]
mov edi, ebp
mov ebp, dword [esi + 0x504]
cmp ebp, edx
jae 0x436ca8
lea eax, [0x530100]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
call fcn.004475d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov dword [ebx + 0x504], edx
mov edx, dword [0x6573b0]
test edx, edx
jne 0x436c91
mov dword [ebx + 0x4fc], eax
jmp 0x436c9c
lea edi, [ebx + 0x4fc]
call fcn.0045f3d0
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ebx, eax
mov eax, dword [esp + 0x40]
lea edx, [ecx + 1]
mov dword [esi + 0x500], edx
mov edx, dword [0x6573b0]
lea ebp, [ebx + ecx*4]
test edx, edx
jne 0x436cc3
mov dword [ebx + ecx*4], eax
jmp 0x436cce
mov ecx, edi
mov edi, ebp
call fcn.0045f3d0
mov edi, ecx
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [edi + 0x78]
lea edx, [ecx - 1]
mov dword [edi + 0x78], edx
cmp ecx, 1
jne 0x436cf9
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x436cf9
mov dword [eax + 8], 0xfffffade
add esp, 0x3c
ret
mov ebp, edi
mov esi, ebx
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esi + 0x4fc]
mov edi, ebp
mov ebp, dword [esi + 0x504]
mov esi, dword [esi + 0x500]
shr ebp, 1
cmp esi, ebp
jle 0x436dcb
lea ebp, [esi - 1]
cmp esi, ebp
jbe 0x436e49
mov dword [esp + 0x20], ebp
mov ebp, dword [ebx + esi*4 - 4]
mov dword [esp + 0x2c], ebp
lea ebp, [ebx + esi*4 - 4]
mov dword [esp + 0x34], ebp
mov ebp, dword [0x6573b0]
test ebp, ebp
jne 0x436d56
mov dword [ebx + esi*4 - 4], 0
jmp 0x436d69
mov ebx, edi
mov edi, dword [esp + 0x34]
mov ebp, eax
xor eax, eax
call fcn.0045f3d0
mov eax, ebp
mov edi, ebx
mov ebx, dword [esp + 0x38]
mov ebp, dword [ebx + 0x504]
mov esi, dword [esp + 0x20]
cmp ebp, esi
jb 0x436e40
mov dword [ebx + 0x500], esi
test edx, edx
je 0x436dc0
test byte [ecx], al
mov ebp, dword [0x6573b0]
test ebp, ebp
jne 0x436da1
mov ebp, dword [esp + 0x2c]
mov dword [ecx + 4], ebp
jmp 0x436cfd
lea ebp, [ecx + 4]
mov ecx, edi
mov edi, ebp
mov esi, eax
mov eax, dword [esp + 0x2c]
call fcn.0045f3d0
mov eax, esi
mov ebp, dword [esp + 0x2c]
mov edi, ecx
jmp 0x436cfd
mov ebp, dword [esp + 0x2c]
mov edx, ebp
jmp 0x436cfd
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], ecx
nop
lea eax, [0x631c5c]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [esp + 0x28]
test byte [eax], al
mov ecx, dword [0x6573b0]
mov edx, dword [0x631c60]
test ecx, ecx
jne 0x436e07
mov dword [eax + 4], edx
mov eax, dword [esp + 0x30]
mov dword [0x631c60], eax
jmp 0x436e20
lea edi, [eax + 4]
mov eax, edx
call fcn.0045f3d0
lea edi, [0x631c60]
mov eax, dword [esp + 0x30]
call fcn.0045f3d0
nop
lea eax, [0x631c5c]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x38]
jmp 0x436c30
mov ecx, esi
mov edx, ebp
call fcn.0045f490
mov eax, ebp
mov ecx, esi
call fcn.0045f450
lea eax, [0x551ed8]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00433a00
lea eax, [0x54eead]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a00
lea eax, [0x550aa4]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00433a00
lea eax, [0x54facc]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
lea eax, [0x54faac]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
lea eax, [0x55119c]
mov dword [esp], eax
mov dword [esp + 4], 0x26
call fcn.00433a00
lea eax, [0x54fa8c]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00433a00
nop
int3