Function at 0x4389a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp qword [rax + 0x18], 0
jne 0x438cc7
cmp byte [rax + 0x34], 0
nop dword [rax]
jne 0x438cb6
cmp qword [rax + 8], 0
jne 0x438ca5
cmp qword [rax + 0x10], 0
jne 0x438c8f
cmp qword [rax + 0x40], 0
jne 0x438c7e
cmp qword [rax + 0x50], 0
jne 0x438c6d
cmp qword [r14 + 0x88], 0
nop word [rax + rax]
jne 0x438c5c
mov qword [rsp + 0x70], rax
mov r8, qword [r14 + 0x30]
nop
inc dword [r8 + 0xd8]
mov r8, qword [r14 + 0x30]
mov qword [rsp + 0x40], r8
mov r9, qword [r8 + 0xa0]
mov qword [rsp + 0x58], r9
mov r10, r14
test byte [r10], al
mov r10, qword [r9 + 0x9c0]
nop dword [rax]
cmp qword [r9 + 0x9b8], r10
jne 0x438a52
xor ecx, ecx
xor edx, edx
jmp 0x438b12
mov rcx, qword [r9 + 0x9b8]
lea rsi, [rcx + 1]
mov rbx, qword [r9 + 0x9b0]
mov rdi, qword [r9 + 0x9c0]
cmp rdi, rsi
jae 0x438ab9
lea rax, [0x00574260]
call fcn.004490a0
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x9c0], rcx
cmp dword [0x007592a0], 0
jne 0x438a9a
mov qword [rdx + 0x9b0], rax
jmp 0x438aa6
lea rdi, [rdx + 0x9b0]
call fcn.00461de0
mov r8, qword [rsp + 0x40]
mov r9, rdx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x70]
lea rdx, [rcx + 1]
mov qword [r9 + 0x9b8], rdx
lea rdi, [rbx + rcx*8]
cmp dword [0x007592a0], 0
jne 0x438ad7
mov qword [rbx + rcx*8], rax
jmp 0x438adc
call fcn.00461de0
nop
mov eax, dword [r8 + 0xd8]
lea ecx, [rax - 1]
mov dword [r8 + 0xd8], ecx
cmp eax, 1
jne 0x438b05
cmp byte [r14 + 0xb1], 0
je 0x438b05
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rcx, r11
mov rbx, qword [r9 + 0x9b0]
mov rsi, qword [r9 + 0x9c0]
mov r10, qword [r9 + 0x9b8]
shr rsi, 1
cmp r10, rsi
jle 0x438bc5
lea rsi, [r10 - 1]
nop word [rax + rax]
cmp r10, rsi
jbe 0x438c51
mov r11, qword [rbx + r10*8 - 8]
lea rdi, [rbx + r10*8]
lea rdi, [rdi - 8]
cmp dword [0x007592a0], 0
jne 0x438b6a
mov qword [rbx + r10*8 - 8], 0
jmp 0x438b71
xor ebx, ebx
call fcn.00461f20
mov rbx, qword [r9 + 0x9c0]
nop dword [rax + rax]
cmp rbx, rsi
jb 0x438c46
mov qword [r9 + 0x9b8], rsi
test rdx, rdx
je 0x438bbc
test byte [rcx], al
cmp dword [0x007592a0], 0
nop
jne 0x438bab
mov qword [rcx + 8], r11
jmp 0x438b0f
lea rdi, [rcx + 8]
mov rbx, r11
call fcn.00461f20
jmp 0x438b0f
mov rdx, r11
nop
jmp 0x438b0f
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
nop
nop
lea rax, [0x00705c18]
call fcn.0040b700
mov rcx, qword [rsp + 0x48]
test byte [rcx], al
mov rdx, qword [0x00705c20]
cmp dword [0x007592a0], 0
jne 0x438c06
mov qword [rcx + 8], rdx
mov rcx, qword [rsp + 0x50]
mov qword [0x00705c20], rcx
jmp 0x438c25
lea rdi, [rcx + 8]
call fcn.00461f00
lea rdi, [0x00705c20]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.00461ee0
nop
lea rax, [0x00705c18]
call fcn.0040b920
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
jmp 0x438a52
mov rcx, rsi
mov rdx, rbx
call fcn.00462300
mov rax, rsi
mov rcx, r10
call fcn.00462280
lea rax, [0x005b699f]
mov ebx, 0x2b
call fcn.00435b40
lea rax, [0x005b2c49]
mov ebx, 0x1d
call fcn.00435b40
lea rax, [0x005b4e66]
mov ebx, 0x24
call fcn.00435b40
lea rax, [0x005b3b39]
mov ebx, 0x20
nop dword [rax + rax]
call fcn.00435b40
lea rax, [0x005b3b19]
mov ebx, 0x20
call fcn.00435b40
lea rax, [0x005b5766]
mov ebx, 0x26
call fcn.00435b40
lea rax, [0x005b3af9]
mov ebx, 0x20
call fcn.00435b40
nop
int3