Function at 0x439ea0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x50], ebx
bt ebx, 0xc
nop
jb 0x439ecc
bt ecx, 0xc
jb 0x439ecc
cmp ebx, ecx
jne 0x439f15
movups xmmword [rsp + 0x28], xmm15
lea rax, [0x0043a240]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ecx
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x50]
xor edx, edx
xor esi, esi
jmp 0x439f31
mov rdi, qword [rsp + 0x20]
lea rdx, [rdi + 1]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x50]
mov rdi, rax
mov eax, ebx
lock cmpxchg dword [rdi + 0x90], ecx
sete r8b
test r8b, r8b
jne 0x43a012
cmp ebx, 4
jne 0x439f5d
cmp dword [rdi + 0x90], 1
je 0x43a210
mov qword [rsp + 0x20], rdx
test rdx, rdx
jne 0x439f8b
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
lea rsi, [rax + 0x1388]
mov qword [rsp + 0x18], rsi
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
cmp qword [rsp], rax
jge 0x439fc5
mov edx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
xor ecx, ecx
nop
jmp 0x43a1f2
lea rax, [0x005c5e60]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
lea rsi, [rax + 0x9c4]
jmp 0x439f1b
cmp ebx, 2
jne 0x43a03b
movzx edx, byte [rdi + 0xbd]
nop
test dl, 7
jne 0x43a02c
mov byte [rdi + 0xbc], 1
movzx edx, byte [rdi + 0xbd]
inc edx
mov byte [rdi + 0xbd], dl
cmp byte [rdi + 0xbc], 0
je 0x43a199
cmp ebx, 1
jne 0x43a092
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x48]
sub rax, qword [rcx + 0xc0]
add qword [rcx + 0xc8], rax
mov qword [rcx + 0xc0], 0
mov ecx, dword [rsp + 0x54]
mov rdi, qword [rsp + 0x48]
cmp ecx, 1
je 0x43a16f
nop dword [rax + rax]
cmp ecx, 2
jne 0x43a199
mov byte [rdi + 0xbc], 0
mov rdx, qword [rdi + 0xc8]
test rdx, rdx
jge 0x43a0d2
mov eax, 1
lea rcx, [0x00707318]
lock xadd qword [rcx], rax
jmp 0x43a162
cmp rdx, 0x10
jl 0x43a137
bsr rbx, rdx
mov rsi, 0xffffffffffffffff
cmove rbx, rsi
lea rsi, [rbx - 3]
mov r8, rsi
shl rsi, 4
cmp rsi, 0x2d0
jb 0x43a108
mov r8d, 0x2c
mov ebx, 0xf
jmp 0x43a13d
lea rcx, [rbx - 4]
cmp rcx, 0x40
sbb rbx, rbx
not rbx
or rcx, rbx
sar rdx, cl
mov rbx, rdx
sar rdx, 0x3f
shr rdx, 0x3c
add rdx, rbx
sar rdx, 4
shl rdx, 4
sub rbx, rdx
jmp 0x43a13d
xor r8d, r8d
mov rbx, rdx
shl r8, 4
lea rax, [r8 + rbx]
cmp rax, 0x2d0
jae 0x43a1a3
lea rcx, [0x00705c98]
lea rax, [rcx + rax*8]
mov ecx, 1
lock xadd qword [rax], rcx
mov qword [rdi + 0xc8], 0
jmp 0x43a199
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 0xc0], rax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov ecx, 0x2d0
call fcn.004622a0
mov qword [rsp + 0x10], rcx
mov dword [rsp], 1
call fcn.00461980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
lea rcx, [rax + 1]
mov eax, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x18]
mov edx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
cmp rcx, 0xa
jge 0x43a208
nop dword [rax + rax]
cmp dword [rsi + 0x90], edx
jne 0x43a1ad
mov rsi, rax
jmp 0x439f1b
lea rax, [0x005b798e]
mov ebx, 0x31
nop dword [rax]
call fcn.00435b40
nop
int3