Function at 0x496590
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4968eb
sub esp, 0x4c
mov edx, dword [esp + 0x5c]
test edx, edx
jl 0x4968d2
cmp edx, 9
jg 0x4968ba
mov ebx, dword [esp + 0x54]
test ebx, ebx
jne 0x4965dc
mov eax, dword [esp + 0x50]
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
add esp, 0x4c
ret
cmp ebx, 0x10000
jb 0x4965f0
mov ebp, ebx
shr ebx, 0x10
mov eax, 0x10
jmp 0x4965f4
mov ebp, ebx
xor eax, eax
cmp ebx, 0x100
jb 0x496602
shr ebx, 8
add eax, 8
cmp ebx, 0x100
jae 0x4968ae
lea esi, [0x553ddf]
movzx ebx, byte [esi + ebx]
lea esi, [ebx + eax]
cmp esi, 0x19
jge 0x496639
lea ecx, [ebx + eax - 0x19]
neg ecx
cmp ecx, 0x20
sbb eax, eax
shl ebp, cl
and ebp, eax
mov eax, dword [esp + 0x58]
lea eax, [esi + eax - 0x19]
jmp 0x49663d
mov eax, dword [esp + 0x58]
imul ecx, eax, 0x13441
add ecx, 0x1ce618
sar ecx, 0x12
sub edx, ecx
mov dword [esp + 0x48], edx
lea ecx, [edx - 1]
cmp ecx, 0x1b
jg 0x496665
test ecx, ecx
xchg esi, ebx
setge bl
xchg esi, ebx
jmp 0x496667
xor esi, esi
mov dword [esp + 0x1c], ecx
xchg esi, eax
mov byte [esp + 0x1a], al
xchg esi, eax
mov dword [esp + 0x20], ebp
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00498730
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + 0x14]
test ecx, ecx
jge 0x496896
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x48]
lea ebp, [ebx + 9]
cmp ebp, 0xa
jae 0x4966e5
mov ebp, dword [esp + 0x20]
test ebp, ebp
xchg esi, ebx
sete bl
xchg esi, ebx
and esi, 1
xchg esi, eax
test al, al
xchg esi, eax
jne 0x49679b
mov byte [esp + 0x1b], dl
mov esi, dword [esp + 0x1c]
xchg esi, ebx
neg ebx
xchg esi, ebx
mov dword [esp + 0x28], esi
xor edi, edi
xor edi, edi
mov dword [esp + 0x24], edi
xor edi, edi
jmp 0x4967ce
movzx ebp, byte [esp + 0x1a]
neg ecx
cmp ecx, 0x20
sbb esi, esi
mov edi, 1
shl edi, cl
and edi, esi
dec edi
shr eax, cl
and eax, esi
mov esi, dword [esp + 0x30]
and edi, esi
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x496741
dec ecx
cmp ecx, 0x20
sbb ebp, ebp
mov esi, 1
shl esi, cl
and esi, ebp
cmp esi, edi
jb 0x496736
jne 0x49673d
test dl, dl
je 0x496736
cmp esi, edi
jne 0x49673d
test dl, dl
je 0x49673d
test eax, 1
setne cl
jmp 0x496755
mov ecx, 1
jmp 0x496755
xor ecx, ecx
jmp 0x496755
dec ecx
cmp ecx, 0x20
sbb ebp, ebp
mov esi, edi
shr edi, cl
and edi, ebp
cmp edi, 1
sete cl
mov edi, esi
test edi, edi
je 0x49675b
xor edx, edx
mov ebx, dword [esp + 0x50]
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
xor edx, 1
mov byte [esp + 0xc], dl
mov byte [esp + 0xd], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
call fcn.00496f20
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x48]
sub ecx, edx
inc ecx
mov dword [eax + 0x10], ecx
add esp, 0x4c
ret
mov ebp, 1
mov edx, 1
jmp 0x4966ea
mov eax, dword [esp + 0x2c]
lea edi, [eax + 1]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
movzx edx, byte [esp + 0x1b]
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x34]
cmp edi, esi
jge 0x49679b
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebp
mov eax, 0xcccccccd
mov ebx, dword [esp + 0x24]
mul ebx
shr edx, 2
mov dword [esp + 0x44], edx
lea esi, [edx + edx*4]
sub ebx, esi
mov eax, ebx
mov esi, 0x33333333
mul esi
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], eax
mov eax, 0xcccccccd
mul ebp
shr edx, 2
mov eax, edx
add edx, 0
mov dword [esp + 0x38], edx
mov esi, dword [esp + 0x3c]
add edx, esi
lea edi, [eax + eax*4]
sub ebp, edi
add ebx, ebp
mov ebp, eax
mov eax, 0xcccccccd
mov edi, edx
mul ebx
shr edx, 2
mov dword [esp + 0x3c], edx
add edx, edi
mov dword [esp + 0x34], edx
mov eax, edx
mov ebx, 5
mul ebx
add ebp, 0
mov ebp, dword [esp + 0x44]
adc ebp, 0
mov ebx, dword [esp + 0x38]
add ebx, esi
mov ebx, dword [esp + 0x40]
adc ebp, ebx
mov ebx, dword [esp + 0x3c]
add ebx, edi
adc ebp, 0
mov ebx, dword [esp + 0x20]
cmp eax, ebx
setne bl
lea esi, [ebp + ebp*4]
add edx, esi
mov esi, dword [esp + 0x24]
cmp esi, edx
setne dl
or edx, ebx
test dl, dl
je 0x4967aa
mov eax, dword [esp + 0x30]
movzx edx, byte [esp + 0x1b]
mov ebx, dword [esp + 0x48]
jmp 0x4966e5
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d9c4]
mov dword [esp + 4], eax
call fcn.004332d0
mov eax, ebx
mov ecx, 0x100
call fcn.0045f460
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d9bc]
mov dword [esp + 4], eax
call fcn.004332d0
lea eax, [0x535040]
mov dword [esp], eax
lea eax, [0x57d9b4]
mov dword [esp + 4], eax
call fcn.004332d0
nop
call fcn.0045e000
jmp fcn.00496590