Function at 0x44a560
Capabilities:
Delete volume shadow copies
Delete windows backup catalog

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x44a806
sub esp, 0x3c
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov ebx, dword [edx + 0x18]
cmp dword [ebx], edx
jne 0x44a7ef
mov edx, dword [esp + 0x40]
lea ebp, [edx - 1]
test edx, ebp
jne 0x44a7d9
mov ebp, dword [0x67e448]
test ebp, ebp
jne 0x44a5c6
cmp edx, 0x8000
jae 0x44a5bb
mov eax, edx
xor ecx, ecx
jmp 0x44a6f1
mov eax, edx
shr edx, 0xd
mov ecx, edx
xor ebx, ebx
jmp 0x44a61d
mov eax, dword [0x67e174]
lea ecx, [edx + eax - 1]
neg eax
and ecx, eax
mov dword [esp + 0x14], ecx
mov dword [esp], ecx
lea eax, [0x67fad8]
mov dword [esp + 4], eax
call fcn.00413070
mov eax, dword [esp + 8]
test eax, eax
je 0x44a604
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x48], eax
add esp, 0x3c
ret
lea eax, [0x562742]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.00433a80
shr edx, 1
inc ebx
cmp edx, 1
ja 0x44a61a
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], ebx
nop
lea eax, [0x67e6a0]
mov dword [esp], eax
call fcn.00409110
mov eax, dword [esp + 0x20]
cmp eax, 0x13
jae 0x44a6e4
lea ecx, [0x67e6a4]
lea edx, [ecx + eax*8]
mov edx, dword [edx]
test edx, edx
jne 0x44a659
xor eax, eax
jmp 0x44a670
mov dword [esp + 0x2c], edx
lea eax, [ecx + eax*8]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004256a0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
nop
nop
lea ecx, [0x67e6a0]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44a692
mov ecx, dword [esp + 0x40]
jmp 0x44a6bc
lea eax, [0x65e100]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov byte [esp + 8], 1
call fcn.00424380
mov eax, dword [esp + 0xc]
test eax, eax
je 0x44a6ce
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x40], ecx
mov eax, dword [eax + 0xc]
nop
mov dword [esp + 0x44], eax
add eax, ecx
mov dword [esp + 0x48], eax
add esp, 0x3c
ret
lea eax, [0x55e571]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00433a80
mov ecx, 0x13
call fcn.0045f4d0
inc ecx
shr edx, 1
cmp edx, 0x1000
ja 0x44a6ee
mov edx, dword [ebx + 0x54]
test edx, edx
je 0x44a707
mov ebx, dword [ebx + 0x74]
test ebx, ebx
je 0x44a75b
movzx edx, cl
cmp edx, 3
jae 0x44a7cd
mov byte [esp + 0x13], cl
shl edx, 6
lea eax, [0x67e740]
add eax, edx
mov dword [esp + 0x34], eax
nop
mov dword [esp], eax
call fcn.00409110
movzx eax, byte [esp + 0x13]
mov byte [esp], al
call fcn.0044a000
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
nop
mov ecx, dword [esp + 0x34]
mov dword [esp], ecx
call fcn.00409310
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
jmp 0x44a7b6
mov edx, dword [edx + 0x30]
test byte [edx], al
movzx ebx, cl
cmp ebx, 3
jae 0x44a7c1
lea ebp, [edx + ebx*8 + 0x234]
mov esi, dword [ebp]
mov edi, esi
test esi, esi
jne 0x44a7a6
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebp
mov dword [esp], edx
mov byte [esp + 4], cl
call fcn.0044a2c0
mov eax, dword [esp + 0x38]
mov esi, dword [eax]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, eax
mov edi, esi
mov eax, dword [esp + 0x40]
mov ecx, edi
mov esi, dword [edi]
mov dword [ebp], esi
lea edx, [edx + ebx*8 + 0x238]
sub dword [edx], eax
mov edx, ecx
mov ecx, eax
mov eax, edx
jmp 0x44a6c0
mov eax, ebx
mov ecx, 3
call fcn.0045f4d0
mov eax, edx
mov ecx, 3
call fcn.0045f4d0
lea eax, [0x562ccd]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
call fcn.00433a80
lea eax, [0x56486a]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00433a80
nop
call fcn.0045cc20
jmp fcn.0044a560