Function at 0x440340
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x440663
sub esp, 0x2c
movzx eax, byte [0x67e08f]
test al, al
jne 0x44036f
movzx eax, byte [0x67e08d]
test al, al
je 0x440373
add esp, 0x2c
ret
mov eax, dword [0x67e160]
test eax, eax
ja 0x4404a3
movzx eax, byte [0x67e08e]
test al, al
jne 0x440397
movzx eax, byte [0x67e086]
test al, al
jne 0x44039b
xor eax, eax
jmp 0x4403d5
mov byte [esp], 1
call fcn.00439a70
mov eax, dword [esp + 4]
mov ecx, dword [0x67e0f8]
mov dword [esp + 0x1c], ecx
nop
mov dword [esp + 0x20], eax
lea edx, [0x67e100]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00401c90
mov eax, dword [esp + 0x1c]
test eax, eax
seta al
movzx eax, al
mov ecx, dword [0x658b08]
mov edx, dword [0x658b18]
sub ecx, edx
mov edx, dword [0x658b00]
mov ebx, ecx
sub ecx, edx
mov ebp, dword [0x658b04]
sub ecx, ebp
mov esi, dword [0x658b14]
sub ecx, esi
cmp eax, ecx
jge 0x440405
add esp, 0x2c
ret
test ecx, ecx
jl 0x440581
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea eax, [0x440670]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.00437270
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44055c
mov eax, dword [0x67e1c8]
test eax, eax
setne al
mov ecx, dword [0x67e1cc]
test ecx, ecx
setne cl
or ecx, eax
test cl, cl
je 0x440493
call fcn.00452870
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp]
test eax, eax
je 0x440493
mov dword [0x67e1cc], ecx
mov dword [0x67e1c8], edx
lea ecx, [0x658b24]
jmp 0x440500
mov eax, dword [0x657ee0]
mov ecx, dword [0x657ee4]
xor edx, edx
jmp 0x4404a8
add esp, 0x2c
ret
inc edx
cmp edx, ecx
jge 0x4404bf
mov ebx, dword [eax + edx*4]
test byte [ebx], al
mov ebx, dword [ebx + 0x1188]
test ebx, ebx
je 0x4404a7
add esp, 0x2c
ret
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x6c], 0xffffffff
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
lea eax, [0x56555f]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00433a80
test byte [edx], al
lea ecx, [edx + 8]
mov edx, dword [ecx]
test edx, edx
je 0x44050f
cmp edx, eax
jne 0x4404fb
mov edx, dword [eax + 8]
mov dword [ecx], edx
nop
mov ecx, dword [0x658afc]
test ecx, ecx
je 0x44052e
mov edx, dword [ecx + 0xb8]
mov dword [0x658afc], edx
dec dword [0x658b00]
test ecx, ecx
je 0x440546
nop
mov dword [ecx + 0x58], eax
lea eax, [ecx + 0xb0]
mov dword [esp], eax
call fcn.00409400
add esp, 0x2c
ret
lea eax, [0x56210f]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a80
nop
lea eax, [0x658af8]
mov dword [esp], eax
call fcn.00409310
lea eax, [0x567bae]
mov dword [esp], eax
mov dword [esp + 4], 0x36
call fcn.00433a80
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], ebx
call fcn.00435250
lea eax, [0x562c10]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00435e80
mov eax, dword [esp + 0x18]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
lea eax, [0x55e642]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.00435e80
mov eax, dword [esp + 0x14]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
lea eax, [0x55cf88]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00435e80
mov eax, dword [esp + 0x1c]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
lea eax, [0x55cc82]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e80
mov eax, dword [esp + 0x10]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00435c80
call fcn.00435470
call fcn.004352c0
lea eax, [0x5638fc]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00440340