Function at 0x4971f0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49754b
sub esp, 0x4c
mov edx, dword [esp + 0x5c]
test edx, edx
jl 0x497532
cmp edx, 9
jg 0x49751a
mov ebx, dword [esp + 0x54]
test ebx, ebx
jne 0x49723c
mov eax, dword [esp + 0x50]
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
add esp, 0x4c
ret
cmp ebx, 0x10000
jb 0x497250
mov ebp, ebx
shr ebx, 0x10
mov eax, 0x10
jmp 0x497254
mov ebp, ebx
xor eax, eax
cmp ebx, 0x100
jb 0x497262
shr ebx, 8
add eax, 8
cmp ebx, 0x100
jae 0x49750e
lea esi, [0x568a99]
movzx ebx, byte [esi + ebx]
lea esi, [ebx + eax]
cmp esi, 0x19
jge 0x497299
lea ecx, [ebx + eax - 0x19]
neg ecx
cmp ecx, 0x20
sbb eax, eax
shl ebp, cl
and ebp, eax
mov eax, dword [esp + 0x58]
lea eax, [esi + eax - 0x19]
jmp 0x49729d
mov eax, dword [esp + 0x58]
imul ecx, eax, 0x13441
add ecx, 0x1ce618
sar ecx, 0x12
sub edx, ecx
mov dword [esp + 0x48], edx
lea ecx, [edx - 1]
cmp ecx, 0x1b
jg 0x4972c5
test ecx, ecx
xchg esi, ebx
setge bl
xchg esi, ebx
jmp 0x4972c7
xor esi, esi
mov dword [esp + 0x1c], ecx
xchg esi, eax
mov byte [esp + 0x1a], al
xchg esi, eax
mov dword [esp + 0x20], ebp
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00499390
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + 0x14]
test ecx, ecx
jge 0x4974f6
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x48]
lea ebp, [ebx + 9]
cmp ebp, 0xa
jae 0x497345
mov ebp, dword [esp + 0x20]
test ebp, ebp
xchg esi, ebx
sete bl
xchg esi, ebx
and esi, 1
xchg esi, eax
test al, al
xchg esi, eax
jne 0x4973fb
mov byte [esp + 0x1b], dl
mov esi, dword [esp + 0x1c]
xchg esi, ebx
neg ebx
xchg esi, ebx
mov dword [esp + 0x28], esi
xor edi, edi
xor edi, edi
mov dword [esp + 0x24], edi
xor edi, edi
jmp 0x49742e
movzx ebp, byte [esp + 0x1a]
neg ecx
cmp ecx, 0x20
sbb esi, esi
mov edi, 1
shl edi, cl
and edi, esi
dec edi
shr eax, cl
and eax, esi
mov esi, dword [esp + 0x30]
and edi, esi
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4973a1
dec ecx
cmp ecx, 0x20
sbb ebp, ebp
mov esi, 1
shl esi, cl
and esi, ebp
cmp esi, edi
jb 0x497396
jne 0x49739d
test dl, dl
je 0x497396
cmp esi, edi
jne 0x49739d
test dl, dl
je 0x49739d
test eax, 1
setne cl
jmp 0x4973b5
mov ecx, 1
jmp 0x4973b5
xor ecx, ecx
jmp 0x4973b5
dec ecx
cmp ecx, 0x20
sbb ebp, ebp
mov esi, edi
shr edi, cl
and edi, ebp
cmp edi, 1
sete cl
mov edi, esi
test edi, edi
je 0x4973bb
xor edx, edx
mov ebx, dword [esp + 0x50]
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
xor edx, 1
mov byte [esp + 0xc], dl
mov byte [esp + 0xd], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
call fcn.00497b80
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x48]
sub ecx, edx
inc ecx
mov dword [eax + 0x10], ecx
add esp, 0x4c
ret
mov ebp, 1
mov edx, 1
jmp 0x49734a
mov eax, dword [esp + 0x2c]
lea edi, [eax + 1]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
movzx edx, byte [esp + 0x1b]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x34]
cmp edi, esi
jge 0x4973fb
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebp
mov eax, 0xcccccccd
mov ebx, dword [esp + 0x24]
mul ebx
shr edx, 2
mov dword [esp + 0x44], edx
lea esi, [edx + edx*4]
sub ebx, esi
mov eax, ebx
mov esi, 0x33333333
mul esi
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], eax
mov eax, 0xcccccccd
mul ebp
shr edx, 2
mov eax, edx
add edx, 0
mov dword [esp + 0x38], edx
mov esi, dword [esp + 0x3c]
add edx, esi
lea edi, [eax + eax*4]
sub ebp, edi
add ebx, ebp
mov ebp, eax
mov eax, 0xcccccccd
mov edi, edx
mul ebx
shr edx, 2
mov dword [esp + 0x3c], edx
add edx, edi
mov dword [esp + 0x34], edx
mov eax, edx
mov ebx, 5
mul ebx
add ebp, 0
mov ebp, dword [esp + 0x44]
adc ebp, 0
mov ebx, dword [esp + 0x38]
add ebx, esi
mov ebx, dword [esp + 0x40]
adc ebp, ebx
mov ebx, dword [esp + 0x3c]
add ebx, edi
adc ebp, 0
mov ebx, dword [esp + 0x20]
cmp eax, ebx
setne bl
lea esi, [ebp + ebp*4]
add edx, esi
mov esi, dword [esp + 0x24]
cmp esi, edx
setne dl
or edx, ebx
test dl, dl
je 0x49740a
mov eax, dword [esp + 0x30]
movzx edx, byte [esp + 0x1b]
mov ebx, dword [esp + 0x48]
jmp 0x497345
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a6cc]
mov dword [esp + 4], eax
call fcn.00433350
mov eax, ebx
mov ecx, 0x100
call fcn.0045f4e0
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a6c4]
mov dword [esp + 4], eax
call fcn.00433350
lea eax, [0x5474c0]
mov dword [esp], eax
lea eax, [0x59a6bc]
mov dword [esp + 4], eax
call fcn.00433350
nop
call fcn.0045e080
jmp fcn.004971f0