Function at 0x445910
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x445c0f
sub esp, 0x30
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x4c], eax
jne 0x445bf8
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445e30
movzx eax, byte [esp + 4]
test al, al
jne 0x445aa2
call fcn.00436920
mov eax, dword [esp]
mov dword [esp + 0x24], eax
nop
mov ecx, dword [esp + 0x34]
mov edx, ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x20], 0
shr ecx, 3
mov ebx, eax
mov eax, 0x828cbfbf
mov ebp, edx
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x3c]
test eax, 1
je 0x445a16
mov edx, dword [0x67e1c0]
test edx, edx
seta dl
mov esi, dword [0x67e1c4]
test esi, esi
xchg esi, ebx
sete bl
xchg esi, ebx
xchg edi, ebx
seta bl
xchg edi, ebx
and esi, edx
or edi, esi
xchg edi, eax
test al, al
xchg edi, eax
je 0x445a16
call fcn.0045f300
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x24]
mov dword [edx + 0x18], 0xffffffff
mov dword [edx + 0x1c], 0xffffffff
mov ebx, edx
mov ebp, dword [esp + 0x34]
mov edx, ecx
mov esi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
jmp 0x445a1a
xor edx, edx
xor esi, esi
test eax, 2
je 0x445a84
mov eax, dword [0x67e1ec]
test eax, eax
sete al
xchg edi, ebx
seta bl
xchg edi, ebx
mov ebp, dword [0x67e1e8]
test ebp, ebp
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ebp, eax
or edi, ebp
xchg edi, eax
test al, al
xchg edi, eax
je 0x445a80
test edx, edx
sete al
test esi, esi
xchg ebp, ebx
sete bl
xchg ebp, ebx
and eax, ebp
test al, al
je 0x445a74
call fcn.0045f300
mov esi, dword [esp]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], edx
mov ebp, dword [esp + 0x34]
jmp 0x445a84
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edx
shl ecx, 6
mov dword [esp + 0x18], ecx
lea eax, [0x65a240]
lea edi, [eax + ecx]
mov dword [esp + 0x20], edi
jmp 0x445ab0
add esp, 0x30
ret
lea eax, [0x65a240]
mov ecx, dword [esp + 0x18]
lea edx, [eax + ecx]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.00409110
mov eax, dword [esp + 0x18]
lea ecx, [0x65a240]
lea edx, [ecx + eax + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00401d30
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445e30
movzx eax, byte [esp + 4]
test al, al
jne 0x445b7a
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
movzx ebx, byte [esp + 0x38]
mov byte [esp + 0xc], bl
call fcn.00445e90
lea eax, [0x571318]
mov dword [esp], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov word [esp + 8], 0x1912
mov ecx, dword [esp + 0x40]
lea edx, [ecx + 4]
mov dword [esp + 0xc], edx
call fcn.00436750
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x445b59
mov ecx, 1
jmp 0x445b70
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.00445e30
movzx eax, byte [esp + 4]
mov ecx, eax
mov eax, dword [esp + 0x24]
test cl, cl
je 0x445aa6
jmp 0x445ba0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.00401d30
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00409310
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x18]
test ecx, ecx
seta dl
mov ebx, dword [eax + 0x1c]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
xchg esi, ebx
setg bl
xchg esi, ebx
and ebp, edx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
je 0x445bec
mov eax, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x14]
sbb ebx, eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
mov eax, dword [esp + 0x40]
add eax, 3
mov dword [esp + 8], eax
call fcn.0042b5b0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00436c20
add esp, 0x30
ret
lea eax, [0x56368d]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00433a80
nop
call fcn.0045e080
jmp fcn.00445910