Function at 0x526620
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52692c
sub esp, 0x38
mov eax, dword [0x63069c]
mov dword [esp], eax
lea eax, [0x547e50]
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
lea eax, [0x54f3cc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x1e
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov ecx, dword [0x63069c]
mov dword [esp], ecx
lea ecx, [0x548252]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
lea ecx, [0x5480ba]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 3
lea edx, [0x5532cd]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0x37
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov ecx, dword [0x63069c]
mov dword [esp], ecx
lea ecx, [0x548658]
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
lea ecx, [0x5480ba]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 3
lea edx, [0x55341b]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0x38
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov ecx, dword [0x63069c]
mov dword [esp], ecx
lea ecx, [0x54865e]
mov dword [esp + 4], ecx
mov dword [esp + 8], 6
lea ecx, [0x5480ba]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 3
lea edx, [0x550653]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0x23
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov ecx, dword [0x63069c]
mov dword [esp], ecx
lea ecx, [0x54824a]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
lea ecx, [0x547edf]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 2
lea ecx, [0x5530ac]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0x36
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [0x63069c]
mov dword [esp], ecx
lea ecx, [0x547ed9]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
lea ecx, [0x5480ba]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 3
lea ecx, [0x551546]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0x28
call fcn.004b8d10
nop
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x630f94]
mov edx, dword [0x630f90]
mov ebx, dword [0x630f98]
cmp ecx, 1
jb 0x526921
mov dword [esp + 0x20], eax
mov eax, dword [0x63069c]
mov dword [esp], eax
lea eax, [ebx - 1]
mov ebx, eax
neg eax
sar eax, 0x1f
and eax, 8
add eax, edx
mov dword [esp + 4], eax
lea eax, [ecx - 1]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.004b9d60
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
cmp dword [eax + 4], 3
jne 0x526865
cmp word [ecx], 0x6579
jne 0x526865
cmp byte [ecx + 2], 0x73
je 0x52686c
mov byte [0x616180], 0
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
cmp dword [ecx + 4], 2
jne 0x52687f
cmp word [edx], 0x6f6e
je 0x526886
mov byte [0x657182], 1
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
test edx, edx
je 0x5268bd
mov dword [0x62c6fc], edx
mov ecx, dword [0x6573b0]
test ecx, ecx
jne 0x5268ab
mov dword [0x62c6f8], eax
jmp 0x5268b6
lea edi, [0x62c6f8]
call fcn.0045f3d0
mov byte [0x616181], 0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
cmp dword [eax + 4], 3
jne 0x5268d6
cmp word [ecx], 0x6579
jne 0x5268d6
cmp byte [ecx + 2], 0x73
je 0x5268dd
mov byte [0x616182], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
cmp dword [eax + 4], 3
jne 0x5268f6
cmp word [ecx], 0x6579
jne 0x5268f6
cmp byte [ecx + 2], 0x73
je 0x5268fd
mov byte [0x616183], 0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
cmp dword [eax + 4], 3
jne 0x526916
cmp word [ecx], 0x6579
jne 0x526916
cmp byte [ecx + 2], 0x73
je 0x52691d
mov byte [0x616184], 0
add esp, 0x38
ret
mov eax, 1
call fcn.0045f4b0
nop
call fcn.0045e000
jmp fcn.00526620