Function at 0x4225b0
Capabilities:
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422893
sub esp, 0x38
call fcn.004351d0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x18], edx
call fcn.004351d0
lea eax, [0x550a5c]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e00
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00435dc0
lea eax, [0x549496]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x549407]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00435e00
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x55232b]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.00435e00
call fcn.00435240
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x20], ecx
mov byte [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x30], 1
mov dword [esp + 0x34], 0
xor ecx, ecx
jmp 0x4226b5
inc dword [esp + 0x34]
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x1c], ecx
jbe 0x42287c
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 0x40]
imul edx, ecx
add edx, dword [eax + 0xc]
mov dword [esp + 0x14], edx
call fcn.004351d0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00435c80
call fcn.00435240
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + 0x18], eax
jbe 0x422701
mov edx, 1
jmp 0x422712
mov edx, dword [esp + 0x2c]
movzx ebx, byte [esp + 0x30]
movzx edx, byte [edx]
test dl, bl
setne dl
mov byte [esp + 0xf], dl
test dl, dl
je 0x42273c
call fcn.004351d0
lea eax, [0x548460]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
call fcn.00435240
jmp 0x42275c
call fcn.004351d0
lea eax, [0x54847e]
mov dword [esp], eax
mov dword [esp + 4], 6
call fcn.00435e00
call fcn.00435240
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
movzx eax, byte [eax]
test cl, al
je 0x42278e
call fcn.004351d0
lea eax, [0x548d50]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
call fcn.00435240
jmp 0x4227ae
call fcn.004351d0
lea eax, [0x548d98]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00435e00
call fcn.00435240
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
movzx eax, byte [eax]
test cl, al
je 0x4227c8
movzx eax, byte [esp + 0xf]
xor eax, 1
jmp 0x4227ca
xor eax, eax
mov byte [esp + 0xe], al
test al, al
je 0x4227f2
call fcn.004351d0
lea eax, [0x54870d]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.00435e00
call fcn.00435240
call fcn.004351d0
call fcn.004353f0
call fcn.00435240
movzx eax, byte [esp + 0xe]
test al, al
je 0x422838
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x40]
cmp ecx, 0x400
jbe 0x42281e
mov ecx, 0x400
mov eax, dword [esp + 0x14]
mov dword [esp], eax
add eax, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call fcn.00435f50
nop
movzx eax, byte [esp + 0x24]
cmp al, 0x80
jne 0x42284e
inc dword [esp + 0x20]
mov byte [esp + 0x24], 1
jmp 0x422854
shl eax, 1
mov byte [esp + 0x24], al
inc dword [esp + 0x28]
nop
movzx eax, byte [esp + 0x30]
cmp al, 0x80
jne 0x422871
inc dword [esp + 0x2c]
mov byte [esp + 0x30], 1
jmp 0x4226a6
shl eax, 1
mov byte [esp + 0x30], al
jmp 0x4226a6
lea eax, [0x54e86a]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.004225b0