Function at 0x44a4e0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x44a786
sub esp, 0x3c
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
cmp dword [ebx], edx
jne 0x44a76f
mov edx, dword [esp + 0x40]
lea ebp, [edx - 1]
test edx, ebp
jne 0x44a759
mov ebp, dword [0x657528]
test ebp, ebp
jne 0x44a546
cmp edx, 0x8000
jae 0x44a53b
mov eax, edx
xor ecx, ecx
jmp 0x44a671
mov eax, edx
shr edx, 0xd
mov ecx, edx
xor ebx, ebx
jmp 0x44a59d
mov eax, dword [0x65726c]
lea ecx, [edx + eax - 1]
neg eax
and ecx, eax
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
lea eax, [0x658bb8]
mov dword [esp + 4], eax
call fcn.004130a0
mov eax, dword [esp + 8]
test eax, eax
je 0x44a584
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x48], eax
add esp, 0x3c
ret
lea eax, [0x54e079]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00433a00
shr edx, 1
inc ebx
cmp edx, 1
ja 0x44a59a
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], ebx
nop
lea eax, [0x657780]
mov dword [esp], eax
call fcn.00409140
mov eax, dword [esp + 0x20]
cmp eax, 0x13
jae 0x44a664
lea ecx, [0x657784]
lea edx, [ecx + eax*8]
mov edx, dword [edx]
test edx, edx
jne 0x44a5d9
xor eax, eax
jmp 0x44a5f0
mov dword [esp + 0x2c], edx
lea eax, [ecx + eax*8]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004256d0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
nop
nop
lea ecx, [0x657780]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44a612
mov ecx, dword [esp + 0x40]
jmp 0x44a63c
lea eax, [0x637200]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov byte [esp + 8], 1
call fcn.004243b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44a64e
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x40], ecx
mov eax, dword [eax + 0xc]
nop
mov dword [esp + 0x44], eax
add eax, ecx
mov dword [esp + 0x48], eax
add esp, 0x3c
ret
lea eax, [0x549fcc]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a00
mov ecx, 0x13
call fcn.0045f450
inc ecx
shr edx, 1
cmp edx, 0x1000
ja 0x44a66e
mov edx, dword [ebx + 0x54]
test edx, edx
je 0x44a687
mov ebx, dword [ebx + 0x74]
test ebx, ebx
je 0x44a6db
movzx edx, cl
cmp edx, 3
jae 0x44a74d
mov byte [esp + 0x13], cl
shl edx, 6
lea eax, [0x657820]
add eax, edx
mov dword [esp + 0x34], eax
nop
mov dword [esp], eax
call fcn.00409140
movzx eax, byte [esp + 0x13]
mov byte [esp], al
call fcn.00449f80
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
nop
mov ecx, dword [esp + 0x34]
mov dword [esp], ecx
call fcn.00409340
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
jmp 0x44a736
mov edx, dword [edx + 0x30]
test byte [edx], al
movzx ebx, cl
cmp ebx, 3
jae 0x44a741
lea ebp, [edx + ebx*8 + 0x234]
mov esi, dword [ebp]
mov edi, esi
test esi, esi
jne 0x44a726
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebp
mov dword [esp], edx
mov byte [esp + 4], cl
call fcn.0044a240
mov eax, dword [esp + 0x38]
mov esi, dword [eax]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, eax
mov edi, esi
mov eax, dword [esp + 0x40]
mov ecx, edi
mov esi, dword [edi]
mov dword [ebp], esi
lea edx, [edx + ebx*8 + 0x238]
sub dword [edx], eax
mov edx, ecx
mov ecx, eax
mov eax, edx
jmp 0x44a640
mov eax, ebx
mov ecx, 3
call fcn.0045f450
mov eax, edx
mov ecx, 3
call fcn.0045f450
lea eax, [0x54e599]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a00
lea eax, [0x54ffc9]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a00
nop
call fcn.0045cba0
jmp fcn.0044a4e0