Function at 0x4095c0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
sub esp, 0x20
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x24]
test byte [edx], al
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x409663
mov eax, dword [esp + 0x2c]
test eax, eax
jge 0x40963d
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 1
mov ecx, dword [0x652ea4]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x40984c
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.00430150
jmp 0x40981d
call fcn.004602a0
mov eax, dword [esp]
mov ecx, dword [esp + 0x28]
add eax, ecx
mov dword [esp + 0x14], eax
mov edx, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
adc edx, ebx
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x2c]
jmp 0x40968f
mov eax, dword [esp + 0x24]
cmp dword [eax], 1
jne 0x409675
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
lea eax, [0x563a0a]
mov dword [esp], eax
mov dword [esp + 4], 0x1e
call fcn.00433a80
mov eax, edx
mov edx, ebp
mov ebp, dword [esp + 0x1c]
mov esi, dword [ebp + 0x18]
mov byte [esi + 0x85], 1
mov esi, dword [0x652ea4]
mov esi, dword [esi]
test esi, esi
je 0x4096d9
cmp ecx, 0x989680
xchg esi, ebx
seta bl
xchg esi, ebx
test ebx, ebx
xchg edi, ebx
setg bl
xchg edi, ebx
sete dl
and esi, edx
or esi, edi
xchg esi, eax
test al, al
xchg esi, eax
je 0x4096d5
xor ebx, ebx
mov ecx, 0x989680
jmp 0x4096d9
mov edx, dword [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], ecx
call fcn.00430150
mov eax, dword [esp + 8]
test eax, eax
jge 0x409758
mov eax, dword [0x652ea4]
mov eax, dword [eax]
test eax, eax
je 0x409709
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f110
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x85], 0
call fcn.004602a0
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov edx, ecx
sub ecx, eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x10]
mov ebp, ebx
sbb ebx, eax
test ebx, ebx
sete al
xchg esi, ebx
setl bl
xchg esi, ebx
test ecx, ecx
xchg edi, ebx
setbe bl
xchg edi, ebx
and edi, eax
or esi, edi
xchg esi, eax
test al, al
xchg esi, eax
je 0x40968b
jmp 0x40976f
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00401c50
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x18]
mov ebx, edx
cmp edx, eax
jne 0x4097b2
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 8], 0
call fcn.00401c30
movzx eax, byte [esp + 0xc]
test al, al
je 0x40976f
mov byte [esp + 0x3c], 0
add esp, 0x20
ret
cmp eax, 1
jne 0x409807
mov byte [ebx + 0x85], 1
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0xffffffff
call fcn.00430150
mov eax, dword [esp + 8]
test eax, eax
jl 0x4097f1
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
lea eax, [0x567762]
mov dword [esp], eax
mov dword [esp + 4], 0x32
call fcn.00433a80
lea eax, [0x5675d6]
mov dword [esp], eax
mov dword [esp + 4], 0x31
call fcn.00433a80
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x85], 0
mov byte [esp + 0x3c], 1
add esp, 0x20
ret
mov eax, dword [0x652ea4]
mov eax, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0045f110
mov dword [esp + 4], 0
mov dword [esp], 0x989680
call fcn.00430150
mov eax, dword [esp + 8]
test eax, eax
jl 0x409834
jmp 0x40981d