Function at 0x409ae0
Capabilities:
Clear windows event logs
Delete volume shadow copies

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409f21
sub esp, 0x28
cmp word [0x619bc4], 0x10
jne 0x409f0a
xor eax, eax
jmp 0x409b22
lea edx, [eax + eax*4]
lea ebx, [0x619bc0]
movzx ebp, word [ebx + eax*2]
lea esi, [0x659c2c]
mov dword [esi + edx*4], ebp
inc eax
cmp eax, 0x44
jge 0x409b2e
jb 0x409b0b
jmp 0x409f00
mov eax, dword [0x65726c]
test eax, eax
je 0x409eea
cmp eax, 0x80000
ja 0x409e5e
cmp eax, 0x1000
jb 0x409dd2
lea edx, [eax - 1]
test edx, eax
jne 0x409d70
mov eax, dword [0x657268]
lea edx, [eax - 1]
test edx, eax
jne 0x409d0e
cmp eax, 0x400000
jbe 0x409b7f
mov dword [0x657268], 0
mov eax, dword [0x657268]
test eax, eax
jne 0x409ced
lea eax, [0x637200]
mov dword [esp], eax
call fcn.00423b10
call fcn.00411e50
mov eax, dword [esp]
mov dword [0x657234], eax
mov dword [esp], 0
mov dword [esp + 4], 0x10232000
call fcn.00413580
mov eax, dword [esp + 8]
test eax, eax
je 0x409bf7
nop
lea ecx, [eax + 0x10232000]
cmp eax, ecx
jbe 0x409bd7
mov ecx, 0x10231fff
jmp 0x409bdc
mov ecx, 0x10232000
mov dword [0x6372e0], eax
mov dword [0x6372e4], eax
add eax, ecx
mov dword [0x6372e8], eax
mov byte [0x6372ec], 1
mov eax, dword [0x61b2c0]
cmp dword [0x6372e0], eax
ja 0x409c11
mov ecx, dword [0x6372e8]
cmp ecx, eax
jbe 0x409c11
mov eax, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0x20000000
mov dword [esp + 0x20], 0x10000000
mov dword [esp + 0x24], 0x8000000
add eax, 0x43ffff
and eax, 0xffc00000
mov dword [esp + 0x14], eax
xor ecx, ecx
jmp 0x409c5e
mov edx, dword [esp + 0x18]
lea ecx, [edx + 1]
mov eax, dword [esp + 0x14]
cmp ecx, 3
jge 0x409cb5
mov dword [esp + 0x18], ecx
mov edx, dword [esp + ecx*4 + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0x400000
call fcn.0040a4c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x409c53
nop
lea edx, [ecx + eax]
cmp eax, edx
jbe 0x409c94
dec ecx
mov dword [0x6372f4], eax
mov dword [0x6372f8], eax
add ecx, eax
mov dword [0x6372fc], ecx
mov byte [0x637300], 0
mov eax, dword [0x6372fc]
mov dword [esp + 0x14], eax
lea ecx, [0x63b800]
mov dword [esp], ecx
call fcn.00414500
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [0x6372f0]
mov dword [eax + 8], ecx
mov dword [0x6372f0], eax
add esp, 0x28
ret
lea eax, [ecx + 1]
mov dword [0x657264], eax
mov ecx, dword [0x657264]
cmp ecx, 0x20
sbb eax, eax
mov edx, 1
shl edx, cl
and edx, eax
cmp dword [0x657268], edx
jne 0x409ce4
jmp 0x409b8d
call fcn.004351d0
lea eax, [0x54d2ce]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e00
mov eax, dword [0x657268]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54cc3f]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e00
call fcn.00435240
lea eax, [0x54da62]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00433a00
call fcn.004351d0
lea eax, [0x54b4c1]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e00
mov eax, dword [0x65726c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x54cc3f]
mov dword [esp], eax
mov dword [esp + 4], 0x17
call fcn.00435e00
call fcn.00435240
lea eax, [0x54be58]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a00
call fcn.004351d0
lea eax, [0x54b4c1]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e00
mov eax, dword [0x65726c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x550ba0]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00435e00
mov dword [esp + 4], 0
mov dword [esp], 0x1000
call fcn.00435c00
lea eax, [0x547e6b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
lea eax, [0x54be58]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a00
call fcn.004351d0
lea eax, [0x54b4c1]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.00435e00
mov eax, dword [0x65726c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00435aa0
lea eax, [0x5507d4]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00435e00
mov dword [esp + 4], 0
mov dword [esp], 0x80000
call fcn.00435c00
lea eax, [0x547e6b]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.00435e00
call fcn.00435240
lea eax, [0x54be58]
mov dword [esp], eax
mov dword [esp + 4], 0x14
call fcn.00433a00
lea eax, [0x54f1b0]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a00
mov ecx, 0x44
call fcn.0045f450
lea eax, [0x54ae05]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00409ae0