Function at 0x43aad0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xc]
cmp eax, dword [ecx + 8]
jbe 0x43b6af
sub esp, 0x8c
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x80], eax
jmp 0x43ab0d
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov edx, dword [0x631c70]
test edx, edx
je 0x43ab2b
call fcn.0043a890
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
mov dword [esp + 0x88], ecx
test byte [ecx], al
mov edx, dword [ecx + 0x1178]
test edx, edx
je 0x43ab4a
call fcn.00439280
mov ecx, dword [esp + 0x88]
mov dword [esp], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.0043c860
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
movzx ecx, byte [0x657188]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x34], ebx
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x44], ebp
mov esi, dword [esp + 0x18]
mov dword [esp + 0x3c], esi
test cl, cl
je 0x43abd2
movzx ecx, byte [0x657189]
test cl, cl
je 0x43abd2
call fcn.00413880
mov eax, dword [esp]
test eax, eax
je 0x43abbe
mov dword [esp + 4], 0
mov byte [esp + 8], 1
call fcn.00437ac0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
mov ecx, dword [0x62c2e4]
mov ecx, dword [ecx]
test ecx, ecx
je 0x43abee
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0045f090
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.004425b0
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 8]
test eax, eax
jne 0x43b641
mov eax, dword [0x631c38]
test eax, eax
je 0x43ac62
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00441ca0
mov eax, dword [esp + 8]
mov dword [esp + 0x74], eax
nop
nop
lea ecx, [0x631bf8]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x43b62b
lea eax, [0x657248]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
jne 0x43ac7c
xor ecx, ecx
jmp 0x43acb8
lea eax, [0x65724c]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
ja 0x43ac96
xor ecx, ecx
jmp 0x43acb8
lea eax, [0x631be8]
mov dword [esp], eax
call fcn.00401e50
mov eax, dword [esp + 4]
test eax, eax
setne al
mov ecx, dword [esp + 8]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x43ace0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0042e0c0
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
test eax, eax
jne 0x43b5ad
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov edx, dword [0x657224]
movzx ecx, byte [ecx + 0x84]
test cl, cl
je 0x43ad02
mov ecx, 1
jmp 0x43ad46
mov dword [esp + 0x64], edx
lea eax, [0x631c2c]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
mov dword [esp + 0x60], eax
lea ecx, [0x631c28]
mov dword [esp], ecx
call fcn.00401c10
mov eax, dword [esp + 0x60]
shl eax, 1
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 4]
cmp ecx, eax
seta al
mov ecx, eax
mov eax, dword [esp + 0x80]
test cl, cl
jne 0x43ad5f
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
jmp 0x43ae37
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x84]
test dl, dl
jne 0x43ad8a
mov byte [ecx + 0x84], 1
lea eax, [0x631c2c]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0043b7c0
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0x20]
movzx edx, byte [esp + 0xc]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x40], esi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
test eax, eax
jne 0x43b598
test cl, cl
je 0x43addc
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
mov dword [esp + 0x44], edi
test ebp, ebp
setne al
test ebx, ebx
setne cl
or ecx, eax
test cl, cl
je 0x43ae25
mov eax, dword [esp + 0x34]
test eax, eax
sete cl
mov edx, dword [esp + 0x38]
test edx, edx
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, ecx
xchg edi, eax
test al, al
xchg edi, eax
jne 0x43ae2f
cmp ebp, eax
setb cl
cmp ebx, edx
sete dl
setl bl
and edx, ecx
or ebx, edx
test bl, bl
jne 0x43ae2f
jmp 0x43ae29
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
mov ebp, eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
mov edx, dword [0x657218]
test edx, edx
jne 0x43ae55
xor edx, edx
jmp 0x43ae7b
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.00417240
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x3c]
mov edx, eax
mov eax, dword [esp + 0x44]
test dl, dl
je 0x43ae99
lea eax, [0x6572c8]
mov dword [esp], eax
call fcn.00409030
mov eax, dword [esp + 4]
test eax, eax
jne 0x43b526
mov eax, dword [0x630fd0]
mov dword [esp + 0x78], eax
mov ecx, dword [0x630fd4]
mov dword [esp + 0x58], ecx
mov edx, dword [0x630fd8]
mov dword [esp + 0x5c], edx
mov ebx, dword [0x631000]
mov dword [esp + 0x6c], ebx
mov ebp, dword [0x631004]
mov dword [esp + 0x50], ebp
mov esi, dword [0x631008]
mov dword [esp + 0x54], esi
mov edi, dword [0x631020]
mov dword [esp + 0x68], edi
mov edi, dword [0x631024]
mov dword [esp + 0x2c], edi
mov edi, dword [0x631028]
mov dword [esp + 0x30], edi
nop
lea edi, [0x631bf8]
mov dword [esp], edi
call fcn.00409140
mov eax, dword [0x631c70]
test eax, eax
jne 0x43af1d
mov eax, dword [esp + 0x88]
mov ecx, dword [eax + 0x1178]
test ecx, ecx
je 0x43af39
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
mov ecx, dword [0x631c38]
test ecx, ecx
jne 0x43b4e4
call fcn.004400e0
mov eax, dword [esp + 0x88]
cmp dword [esp], eax
jne 0x43b698
mov dword [esp], eax
call fcn.00441f40
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409340
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
movzx edx, byte [ecx + 0x84]
mov byte [esp + 0x2b], dl
test dl, dl
jne 0x43af9a
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x34]
jmp 0x43b09a
mov byte [ecx + 0x84], 0
lea eax, [0x631c2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d60
mov eax, dword [esp + 8]
test eax, eax
jl 0x43b682
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x5c]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x14], ebx
call fcn.0043bcc0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43b03a
mov dword [esp], eax
call fcn.0043ff60
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x84], 1
lea ecx, [0x631c2c]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
call fcn.0043bec0
mov eax, dword [esp]
mov ecx, dword [esp + 4]
test eax, eax
jne 0x43b441
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
call fcn.0043bda0
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], esi
lea eax, [0x657248]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
jne 0x43b0c4
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
xor ecx, ecx
jmp 0x43b130
lea eax, [0x65724c]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
ja 0x43b0f2
mov eax, dword [esp + 0x34]
test eax, eax
setne cl
mov edx, dword [esp + 0x3c]
test edx, edx
setne bl
or ebx, ecx
test bl, bl
je 0x43b12e
lea eax, [0x631be8]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401de0
mov eax, dword [esp + 0x10]
test eax, eax
setne al
mov ecx, dword [esp + 0xc]
test ecx, ecx
setne cl
or ecx, eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
jmp 0x43b130
xor ecx, ecx
test cl, cl
jne 0x43b1c6
test eax, eax
setne cl
test edx, edx
setne bl
or ebx, ecx
test bl, bl
jne 0x43b14c
xor ecx, ecx
jmp 0x43b16d
lea eax, [0x657248]
mov dword [esp], eax
call fcn.00401c10
mov eax, dword [esp + 4]
test eax, eax
setne al
mov edx, dword [esp + 0x3c]
mov ecx, eax
mov eax, dword [esp + 0x34]
test cl, cl
je 0x43b430
lea eax, [0x631bf0]
mov dword [esp], eax
call fcn.00401e50
mov eax, dword [esp + 8]
test eax, eax
sete cl
mov edx, dword [esp + 4]
test edx, edx
sete bl
and ebx, ecx
test bl, bl
jne 0x43b1bc
mov ecx, dword [esp + 0x34]
cmp ecx, edx
setb cl
mov edx, dword [esp + 0x3c]
cmp edx, eax
setl al
sete dl
and edx, ecx
or edx, eax
test dl, dl
je 0x43b430
call fcn.0042dfc0
jmp 0x43b430
lea ecx, [0x631bf0]
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.00401e70
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
test edx, edx
jne 0x43b66c
movzx ecx, byte [ecx + 0x84]
test cl, cl
jne 0x43b656
mov ecx, dword [esp + 0x3c]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x34]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
je 0x43b26c
mov edx, dword [esp + 0x40]
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov esi, dword [esp + 0x44]
test esi, esi
xchg edi, ebx
sete bl
xchg edi, ebx
and edi, ebp
xchg edi, eax
test al, al
xchg edi, eax
je 0x43b25e
nop
call fcn.00460210
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x34]
mov esi, eax
mov edx, ecx
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x3c]
sub ebx, edx
sbb ecx, esi
test ecx, ecx
jge 0x43b276
xor ecx, ecx
xor ebx, ebx
jmp 0x43b276
mov ecx, 0xffffffff
mov ebx, 0xffffffff
mov edx, dword [0x6572c0]
test edx, edx
setne dl
mov ebp, dword [0x6572c4]
test ebp, ebp
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x43b29c
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.0042e0c0
mov eax, dword [esp + 8]
mov dword [esp + 0x48], eax
lea eax, [0x631bf0]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.00401e70
call fcn.00460210
mov eax, dword [esp + 4]
mov ecx, dword [esp]
lea edx, [0x631be8]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00401e70
mov eax, dword [0x6572c0]
test eax, eax
setne al
mov ecx, dword [0x6572c4]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x43b325
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x43b325
call fcn.00439f20
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
nop
nop
lea eax, [0x631bf8]
mov dword [esp], eax
call fcn.00409140
call fcn.00442030
mov eax, dword [esp]
mov dword [esp + 0x7c], eax
nop
nop
lea ecx, [0x631bf8]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x43b424
mov dword [esp], eax
call fcn.0043ff60
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x43b3a6
movzx eax, byte [esp + 0x2b]
test al, al
je 0x43ab06
mov eax, dword [esp + 0x80]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x84], 1
lea ecx, [0x631c2c]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00401d60
jmp 0x43ab06
nop
nop
mov dword [esp + 0x88], eax
test eax, eax
je 0x43b3ba
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x48], ecx
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.0043c170
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437f40
movzx eax, byte [0x63b848]
test al, al
je 0x43b407
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00454540
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
lea eax, [esp + 0x48]
mov dword [esp], eax
call fcn.0043c170
call fcn.00439f20
mov eax, dword [esp + 0x80]
jmp 0x43ab0d
mov dword [esp + 0x7c], eax
mov dword [esp + 0x84], ecx
call fcn.0043ff60
mov eax, dword [esp + 0x80]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x84], 1
lea eax, [0x631c2c]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x7c]
mov dword [eax + 0x948], 3
mov eax, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437f40
movzx eax, byte [0x63b848]
test al, al
je 0x43b4c7
mov eax, dword [esp + 0x84]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00454540
mov eax, dword [esp + 0x84]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00441ca0
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
nop
nop
lea ecx, [0x631bf8]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x70]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov ecx, dword [esp + 0x88]
mov dword [ecx + 0x948], 3
mov eax, dword [eax + 0xc]
mov dword [esp + 0x88], eax
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437f40
movzx eax, byte [0x63b848]
test al, al
je 0x43b57b
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00454540
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], dl
add esp, 0x8c
ret
nop
nop
mov dword [esp + 0x88], eax
test eax, eax
je 0x43b5c1
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x4c], ecx
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.0043c170
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 1
call fcn.00437f40
movzx eax, byte [0x63b848]
test al, al
je 0x43b60e
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00454540
mov eax, dword [esp + 0x88]
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], 0
add esp, 0x8c
ret
mov dword [esp + 0x90], eax
mov byte [esp + 0x94], cl
add esp, 0x8c
ret
lea eax, [0x550518]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00433a00
lea eax, [0x54e84e]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
lea eax, [0x54fd14]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
lea eax, [0x54c471]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.0043aad0