Function at 0x44acc0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x130]
cmp r12, qword [r14 + 0x10]
jbe 0x44b06f
sub rsp, 0x1b0
mov qword [rsp + 0x1a8], rbp
lea rbp, [rsp + 0x1a8]
cmp qword [rax + 0x70], 0
jne 0x44b05d
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
nop dword [rax + rax]
test rdx, rdx
je 0x44b04c
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], rdx
mov rsi, qword [r14 + 0x30]
mov rdi, qword [rax + 0x38]
mov r8, rcx
sub rcx, rdi
mov qword [rsp + 0x50], rcx
mov rsi, qword [rsi + 0xa0]
mov rdi, r8
sub r8, rdx
mov qword [rsp + 0x70], r8
mov r9, rbx
sub rbx, r8
test rsi, rsi
je 0x44ad8d
mov r10, qword [rsi + 0x22a8]
lea r11, [r10 + rbx]
mov qword [rsi + 0x22a8], r11
lea rbx, [r10 + rbx]
lea rbx, [rbx + 0x1fff]
cmp rbx, 0x3fff
jb 0x44ad99
lea rbx, [0x00759a58]
lock xadd qword [rbx], r11
mov qword [rsi + 0x22a8], 0
jmp 0x44ad99
lea rsi, [0x00759a58]
lock xadd qword [rsi], rbx
mov qword [rsp + 0x68], r9
mov rax, r9
call fcn.00449ee0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
lea rdi, [rsp + 0x88]
lea rdi, [rdi - 0x20]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00462506
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x88], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x90], rdx
mov rsi, rbx
sub rbx, rdx
mov qword [rsp + 0x98], rbx
mov rbx, qword [rsp + 0x1b8]
cmp byte [rbx + 0xb8], 0
je 0x44ae1e
mov rdi, qword [rbx + 0x148]
xor r8d, r8d
jmp 0x44afec
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
cmp rdi, r8
jae 0x44ae3d
mov dil, byte [rbx + 0xb9]
test dil, dil
jne 0x44afd7
nop
mov rdi, qword [rbx + 0x148]
jmp 0x44ae4b
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x44ae7b
nop
mov r8, qword [rdi + 0x18]
cmp qword [rsp + 0x88], r8
ja 0x44ae47
nop
cmp qword [rsp + 0x90], r8
jbe 0x44ae47
mov r9, qword [rsp + 0x98]
add r8, r9
mov qword [rdi + 0x18], r8
jmp 0x44ae47
mov rdi, qword [rsp + 0x50]
mov rax, rsi
sub rax, rdi
mov rbx, rdx
sub rbx, rdi
mov rcx, rdi
call fcn.00462be0
nop
nop
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax + 0x50]
cmp qword [rsp + 0x88], rdx
ja 0x44aec5
cmp qword [rsp + 0x90], rdx
jbe 0x44aec5
mov rcx, qword [rsp + 0x98]
add rcx, rdx
mov qword [rax + 0x50], rcx
nop
mov rcx, qword [rax + 0x68]
cmp qword [rsp + 0x88], rcx
ja 0x44aeed
cmp qword [rsp + 0x90], rcx
jbe 0x44aeed
mov rdx, qword [rsp + 0x98]
add rcx, rdx
mov qword [rax + 0x68], rcx
lea rbx, [rsp + 0x88]
call fcn.0044aa40
nop
nop
mov rdi, qword [rsp + 0x1b8]
mov rcx, qword [rdi + 0x20]
cmp qword [rsp + 0x88], rcx
ja 0x44af2b
cmp qword [rsp + 0x90], rcx
jbe 0x44af2b
mov rdx, qword [rsp + 0x98]
add rdx, rcx
mov qword [rdi + 0x20], rdx
mov rdx, qword [rsp + 0x1a0]
test rdx, rdx
je 0x44af4b
mov r12, qword [rsp + 0x98]
add rdx, r12
mov qword [rsp + 0x1a0], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rdi], rdx
mov r12, qword [rsp + 0x58]
mov qword [rdi + 8], r12
add rdx, 0x13a0
mov qword [rdi + 0x10], rdx
mov rdx, qword [rsp + 0x50]
sub r12, rdx
mov qword [rdi + 0x38], r12
mov rdx, qword [rsp + 0x98]
add qword [rdi + 0x80], rdx
mov qword [rsp], 0
mov rax, 0xffffffffffffffff
mov rbx, rax
xor ecx, ecx
xor esi, esi
xor r8d, r8d
mov r9d, 0x7fffffff
lea r10, [0x005c5b80]
lea r11, [rsp + 0x88]
call fcn.00454f40
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
call fcn.0044a1c0
mov rbp, qword [rsp + 0x1a8]
add rsp, 0x1b0
ret
lea rax, [0x005b7513]
mov ebx, 0x2f
call fcn.00435b40
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x44b015
mov r9, qword [rdi + 0x50]
mov r10, qword [rdi + 0x18]
movzx r9d, word [r9 + 0x18]
add r9, r10
cmp rcx, r9
ja 0x44afe8
cmp rdx, r9
jbe 0x44afe8
cmp r8, r9
jae 0x44afe8
mov r8, r9
jmp 0x44afe8
mov qword [rsp + 0x1a0], r8
mov rax, rbx
mov rbx, qword [rsp + 0x50]
lea rcx, [rsp + 0x88]
call fcn.0044ab40
mov rdi, qword [rsp + 0x50]
sub rdi, rax
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x58]
jmp 0x44ae80
lea rax, [0x005ad332]
mov ebx, 0xd
call fcn.00435b40
lea rax, [0x005b5a1e]
mov ebx, 0x27
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0044acc0