Function at 0x4010f0
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4015db
sub esp, 0x44
mov ebx, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
jmp 0x401117
mov ebp, ecx
mov ebx, esi
test ebp, ebp
je 0x40132f
xor eax, eax
jmp 0x4013ea
mov eax, 0xffffffff
test eax, eax
jge 0x401137
xor ecx, ecx
xor esi, esi
mov eax, ebp
jmp 0x40115e
cmp eax, ebp
ja 0x4015ca
lea esi, [eax + 1]
cmp ebp, esi
jb 0x4015c1
sub ebp, eax
lea edi, [ebp - 1]
mov ecx, edi
xchg edi, ebx
neg ebx
xchg edi, ebx
sar edi, 0x1f
and esi, edi
add esi, ebx
cmp eax, 4
jl 0x401113
cmp dword [ebx], 0x2e757063
jne 0x401113
xor edx, edx
jmp 0x401406
mov edx, 0xffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x40], esi
test edx, edx
jl 0x4012d0
cmp edx, eax
ja 0x4015af
cmp edx, 4
jb 0x4015a3
lea ebp, [edx - 4]
mov dword [esp + 0x18], ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, 4
lea esi, [ebx + ebp]
lea edi, [edx + 1]
cmp eax, edi
jb 0x40159a
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], esi
sub eax, edx
lea ebp, [eax - 1]
mov dword [esp + 0x14], ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and edi, ebp
lea ebp, [ebx + edi]
mov dword [esp + 0x30], ebp
cmp eax, 3
jne 0x4011ee
cmp word [ebp], 0x6e6f
jne 0x40124f
cmp eax, 3
jmp 0x401207
cmp eax, 4
jne 0x40124f
cmp word [ebp], 0x666f
jne 0x40124f
lea edi, [ebx + edi + 2]
cmp byte [edi], 0x66
jne 0x40124f
cmp eax, 3
xchg ebp, ebx
sete bl
xchg ebp, ebx
cmp edx, 7
jne 0x401234
cmp word [esi], 0x6c61
jne 0x401234
mov edi, dword [esp + 0x28]
lea ebx, [ebx + edi + 2]
cmp byte [ebx], 0x6c
jne 0x401234
mov ebx, dword [0x657df4]
xor eax, eax
jmp 0x40154f
xchg ebp, eax
mov byte [esp + 0x13], al
xchg ebp, eax
mov edx, dword [0x657df4]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x18]
xor eax, eax
jmp 0x40142e
call fcn.00435250
lea eax, [0x55eeab]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00435e80
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x56408d]
mov dword [esp], eax
mov dword [esp + 4], 0x20
call fcn.00435e80
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55c35b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401113
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], ebx
call fcn.00435250
lea eax, [0x564510]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00435e80
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55c35b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401113
mov eax, dword [0x657df4]
mov ecx, dword [0x657df0]
test eax, eax
je 0x401347
mov dword [esp + 0x2c], eax
xor edx, edx
jmp 0x40134e
add esp, 0x44
ret
add ecx, 0x10
movzx ebx, byte [ecx + 0xd]
movzx ebp, byte [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx]
mov dword [esp + 0x40], edi
mov edi, dword [ecx + 4]
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4013db
test bl, bl
je 0x4013d9
movzx ebp, byte [esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4013d9
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x3c], ecx
call fcn.00435250
lea eax, [0x561f1b]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00435e80
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x5615de]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e80
call fcn.004352c0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
jmp 0x4013db
mov byte [esi], bl
inc edx
cmp eax, edx
jg 0x40134b
jmp 0x401347
inc eax
cmp eax, ebp
jge 0x401126
jae 0x4015d3
lea esi, [ebx + eax]
cmp byte [esi], 0x2c
jne 0x4013e9
jmp 0x40112b
inc edx
cmp edx, eax
jge 0x401172
jae 0x4015b8
lea ebp, [ebx + edx]
cmp byte [ebp], 0x3d
jne 0x401405
jmp 0x401177
lea eax, [ebp + 1]
movzx ebp, byte [esp + 0x13]
mov esi, dword [esp + 0x34]
cmp eax, edx
jge 0x4014da
mov edi, dword [0x657df0]
mov ebp, dword [0x657df4]
cmp eax, ebp
jae 0x40153b
mov ebp, eax
shl eax, 4
mov esi, dword [edi + eax + 4]
mov edi, dword [edi + eax]
cmp esi, ebx
jne 0x401422
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], eax
mov dword [esp], edi
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], esi
call fcn.00402340
movzx eax, byte [esp + 0xc]
test al, al
jne 0x401491
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
jmp 0x401422
mov ecx, dword [0x657df4]
mov ebx, dword [0x657df0]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x401536
mov ebp, dword [esp + 0x20]
mov byte [ebx + ebp + 0xc], 1
mov ecx, dword [0x657df4]
mov ebx, dword [0x657df0]
cmp eax, ecx
jae 0x401531
movzx edi, byte [esp + 0x13]
xchg edi, eax
mov byte [ebx + ebp + 0xd], al
xchg edi, eax
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401113
call fcn.00435250
lea eax, [0x563848]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00435e80
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00435e80
lea eax, [0x55c35b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e80
call fcn.004352c0
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x40]
jmp 0x401113
call fcn.0045f4d0
call fcn.0045f4d0
mov ecx, ebp
call fcn.0045f4d0
xchg ebp, ecx
mov byte [ebx + eax + 0xd], cl
xchg ebp, ecx
lea eax, [esi + 1]
mov ebx, edx
cmp eax, ebx
jge 0x401581
mov esi, dword [0x657df4]
mov edi, dword [0x657df0]
cmp eax, esi
jae 0x401593
mov esi, eax
shl eax, 4
mov byte [edi + eax + 0xc], 1
mov edi, dword [0x657df4]
mov edx, ebx
mov ebx, dword [0x657df0]
cmp esi, edi
jb 0x401542
jmp 0x40158a
mov esi, dword [esp + 0x40]
jmp 0x401113
mov eax, esi
mov ecx, edi
call fcn.0045f4d0
mov ecx, esi
call fcn.0045f4d0
mov ecx, eax
mov eax, edi
call fcn.0045f530
mov eax, 4
mov ecx, edx
call fcn.0045f530
mov ecx, edx
mov edx, eax
call fcn.0045f4f0
mov ecx, eax
mov eax, edx
call fcn.0045f4d0
mov eax, esi
mov ecx, ebp
call fcn.0045f530
mov ecx, eax
mov edx, ebp
call fcn.0045f4f0
mov ecx, ebp
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.004010f0