Function at 0x423960
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x4244ed
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xd8], 0
jne 0x4239a9
cmp dword [rdx + 0xc0], 0
jne 0x4239a9
mov rsi, r14
nop
cmp qword [rdx], rsi
jne 0x4244db
mov rdx, qword [rax]
test bl, bl
jne 0x4239b7
mov qword [rax], 0
mov esi, dword [0x0072b3f0]
mov dword [rsp + 0x20], esi
mov dil, byte [rdx + 0x63]
mov byte [rsp + 0x1b], dil
cmp dil, 1
jne 0x424455
lea r8d, [rsi - 1]
nop dword [rax + rax]
cmp dword [rdx + 0x58], r8d
jne 0x424455
mov byte [rsp + 0xd8], bl
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x24], r8d
cmp byte [0x0070b1f0], 0
je 0x423a27
mov rax, qword [rdx + 0x20]
shl rax, 0xd
call fcn.00454660
mov rdx, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0xd8]
mov esi, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov rdi, qword [rdx + 0x20]
lea r9, [0x0072b418]
lock xadd qword [r9], rdi
movzx edi, byte [rdx + 0x62]
mov byte [rsp + 0x18], dil
mov r9, qword [rdx + 0x68]
mov qword [rsp + 0x38], r9
mov r10, qword [rdx + 0x80]
mov qword [rsp + 0x28], r10
lea r11, [rdx + 0x80]
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r10
jmp 0x423a7a
mov rdx, r15
mov esi, dword [rsp + 0x20]
movzx edi, byte [rsp + 0x18]
mov r11, qword [rsp + 0x88]
test r11, r11
je 0x423b72
movzx eax, word [r11 + 8]
test r9, r9
je 0x424450
mov rcx, rdx
xor edx, edx
div r9
mov rdx, rax
imul rax, r9
mov r12, qword [rcx + 0x18]
add r12, rax
nop
nop
mov r13, rdx
shr rdx, 3
and r13d, 7
mov r15, rcx
mov rcx, r13
mov edi, 1
shl edi, cl
nop
add rdx, qword [r15 + 0x50]
movzx esi, byte [rdx]
test sil, dil
je 0x423b46
cmp byte [r11 + 0xa], 3
je 0x423af6
nop
mov qword [rsp + 0x80], r11
mov rdx, qword [r11]
mov qword [rsp + 0x88], rdx
jmp 0x423a6e
nop
mov rdx, qword [r11]
mov qword [rsp + 0x88], rdx
mov rsi, qword [rsp + 0x80]
mov qword [rsi], rdx
mov byte [r11 + 0x11], 1
mov rax, r11
mov rbx, r12
mov rcx, r9
nop dword [rax + rax]
call fcn.004280a0
movzx ebx, byte [rsp + 0xd8]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
jmp 0x423a6e
lea rdi, [rax + r9]
jmp 0x424395
nop
bts esi, ecx
mov byte [rdx], sil
mov eax, 1
jmp 0x423b64
xor eax, eax
nop
jmp 0x423b64
xor eax, eax
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x19], al
jmp 0x4243b8
test r10, r10
je 0x423c08
cmp qword [rdx + 0x80], 0
jne 0x423c08
nop
nop
mov rax, qword [rdx + 0x18]
movabs r10, 0x800000000000
add r10, rax
mov r11, r10
shr r10, 0x2a
cmp r10, 0x40
jae 0x424385
lea r12, [0x0072b450]
mov r10, qword [r12 + r10*8]
test byte [r10], al
shr r11, 0x16
and r11d, 0xfffff
mov r10, qword [r10 + r11*8]
test byte [r10], al
shr rax, 0xd
mov rcx, rax
and eax, 0x1ff
shr rax, 3
nop dword [rax]
cmp rax, 0x40
jae 0x42437b
lea r10, [r10 + rax]
lea r10, [r10 + 0x21080]
and ecx, 7
mov r11d, 1
shl r11d, cl
not r11d
lock and byte [r10], r11b
cmp dword [0x00759524], 0
jne 0x423c1a
cmp dword [0x007594e4], 0
je 0x423c65
mov r10, qword [rdx + 0x50]
mov qword [rsp + 0x90], r10
mov byte [rsp + 0x98], 1
mov qword [rsp + 0xa0], 0
mov r10, qword [rdx + 0x48]
mov qword [rsp + 0xa8], r10
mov byte [rsp + 0xb0], 1
mov qword [rsp + 0xb8], 0
xor eax, eax
nop dword [rax]
jmp 0x424244
mov rcx, qword [rdx + 0x30]
cmp qword [rdx + 0x38], rcx
jbe 0x423ce5
mov r10, qword [rdx + 0x50]
mov r11, rcx
shr rcx, 3
movzx r10d, byte [rcx + r10]
mov r12, qword [rdx + 0x48]
movzx r12d, byte [rcx + r12]
not r12d
and r12d, r10d
and r11d, 7
mov rax, rcx
mov rcx, r11
shr r12b, cl
nop dword [rax + rax]
test r12b, r12b
je 0x423cd7
mov qword [rsp + 0x78], rax
mov rax, rdx
call fcn.00424520
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0xd8]
mov esi, dword [rsp + 0x20]
movzx edi, byte [rsp + 0x18]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
lea rcx, [rax + 1]
nop dword [rax + rax]
jmp 0x4241d0
nop
mov rcx, qword [rdx + 0x38]
add rcx, 7
shr rcx, 3
mov qword [rsp + 0x78], rcx
xor eax, eax
xor r10d, r10d
jmp 0x423d05
add rax, 8
add r10, r11
mov qword [rsp + 0x68], r10
cmp rax, rcx
jae 0x423d75
mov r11, qword [rdx + 0x50]
mov r11, qword [r11 + rax]
movzx r12, byte [0x00758ffb]
nop
test r12d, r12d
je 0x423d2c
popcnt r11, r11
jmp 0x423cfe
mov qword [rsp + 0x48], rax
mov rax, r11
call fcn.00401ee0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0xd8]
mov esi, dword [rsp + 0x20]
movzx edi, byte [rsp + 0x18]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x68]
movzx r12, byte [0x00758ffb]
mov r11, rax
mov rax, qword [rsp + 0x48]
jmp 0x423cfe
movzx ecx, word [rdx + 0x60]
mov r11d, ecx
sub ecx, r10d
mov word [rsp + 0x1c], cx
cmp r10w, r11w
ja 0x42411b
mov word [rdx + 0x60], r10w
mov qword [rdx + 0x30], 0
cmp byte [0x0070b1f0], 0
je 0x423dc5
mov r11, qword [r14 + 0x30]
mov r11, qword [r11 + 0xa0]
test byte [r11], al
movzx r12d, cx
mov r13, qword [rdx + 0x68]
imul r13, r12
add qword [r11 + 0x11e8], r13
mov rcx, qword [rdx + 0x50]
mov qword [rdx + 0x48], rcx
mov rax, qword [rdx + 0x38]
call fcn.004281e0
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x50], rax
mov rax, rcx
xor ebx, ebx
call fcn.00413560
mov rbx, qword [rsp + 0x40]
mov cl, byte [rbx + 0x63]
mov byte [rsp + 0x1b], cl
cmp cl, 1
jne 0x42409b
mov edx, dword [rbx + 0x58]
mov esi, dword [rsp + 0x24]
cmp edx, esi
jne 0x42409b
mov esi, dword [rsp + 0x20]
lea edi, [rsi + 1]
cmp edx, edi
je 0x42408a
lea edi, [rsi + 3]
nop
cmp edx, edi
je 0x42408a
mov edx, esi
xchg dword [rbx + 0x58], esi
movzx eax, byte [rsp + 0x18]
mov esi, eax
shr al, 1
test al, al
je 0x423f7c
movzx edi, word [rsp + 0x1c]
test di, di
ja 0x423e55
movzx edi, byte [rsp + 0xd8]
test dil, dil
jmp 0x423ebd
mov byte [rsp + 0x1a], al
mov byte [rbx + 0x64], 1
lea rax, [0x0075c4a8]
call fcn.0042e7c0
test byte [rax], al
movzx ecx, byte [rsp + 0x1a]
movsx rcx, cl
cmp rcx, 0x44
jae 0x42407d
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x278]
movzx edx, word [rsp + 0x1c]
movzx edx, dx
lock xadd qword [rcx], rdx
lea rax, [0x0075c4a8]
nop dword [rax]
call fcn.0042e8a0
movzx ecx, byte [rsp + 0xd8]
test cl, cl
mov edx, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0x18]
nop dword [rax]
jne 0x424045
mov rdi, qword [rsp + 0x68]
test di, di
je 0x423f5b
movzx edi, di
cmp qword [rbx + 0x38], rdi
jne 0x423f20
nop dword [rax]
cmp rsi, 0x88
jae 0x424071
lea rcx, [rsi + rsi*2]
shl rcx, 6
lea rsi, [0x0072b6f8]
lea rcx, [rcx + rsi]
lea rcx, [rcx + 0x58]
shr edx, 1
and edx, 1
lea rdx, [rdx + rdx*4]
lea rax, [rcx + rdx*8]
call fcn.0042e160
jmp 0x424045
cmp rsi, 0x88
jae 0x424065
lea rcx, [rsi + rsi*2]
shl rcx, 6
lea rsi, [0x0072b6f8]
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
shr edx, 1
and edx, 1
lea rdx, [rdx + rdx*4]
lea rax, [rcx + rdx*8]
call fcn.0042e160
jmp 0x424045
lea rax, [0x0071b2c0]
call fcn.00427120
mov eax, 1
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
movzx edi, byte [rsp + 0xd8]
test dil, dil
jne 0x424045
movzx edi, word [rsp + 0x1c]
test di, di
je 0x42400f
cmp dword [0x007594e8], 0
nop
jle 0x423fba
mov qword [rbx + 0x70], 0
mov rax, qword [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
call fcn.004179e0
jmp 0x423fc6
lea rax, [0x0071b2c0]
call fcn.00427120
lea rax, [0x0075c4a8]
call fcn.0042e7c0
mov ecx, 1
lock xadd qword [rax + 0x270], rcx
mov rcx, qword [rsp + 0x38]
lock xadd qword [rax + 0x268], rcx
lea rax, [0x0075c4a8]
call fcn.0042e8a0
mov eax, 1
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
cmp rsi, 0x88
jae 0x424057
lea rcx, [rsi + rsi*2]
shl rcx, 6
lea rsi, [0x0072b6f8]
lea rcx, [rcx + rsi]
lea rcx, [rcx + 0x58]
shr edx, 1
and edx, 1
lea rdx, [rdx + rdx*4]
lea rax, [rcx + rdx*8]
nop dword [rax]
call fcn.0042e160
xor eax, eax
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov eax, esi
mov ecx, 0x88
nop
call fcn.00462280
mov eax, esi
mov ecx, 0x88
call fcn.00462280
mov eax, esi
mov ecx, 0x88
call fcn.00462280
mov rax, rcx
mov ecx, 0x44
call fcn.00462280
lea rax, [0x005ae42f]
mov ebx, 0x11
call fcn.00435b40
mov eax, dword [rbx + 0x58]
mov qword [rsp + 0x70], rax
call fcn.004372e0
lea rax, [0x005aedbf]
mov ebx, 0x13
call fcn.00437be0
movzx eax, byte [rsp + 0x1b]
movzx eax, al
call fcn.004378e0
lea rax, [0x005ac3fe]
mov ebx, 0xa
call fcn.00437be0
mov rax, qword [rsp + 0x70]
nop dword [rax]
call fcn.004378e0
lea rax, [0x005adb7f]
mov ebx, 0x10
call fcn.00437be0
mov eax, dword [rsp + 0x20]
call fcn.004378e0
nop
call fcn.00437540
call fcn.00437360
lea rax, [0x005b5982]
mov ebx, 0x27
call fcn.00435b40
mov word [rsp + 0x1e], r11w
mov rax, qword [rdx + 0x38]
mov qword [rsp + 0x78], rax
call fcn.004372e0
lea rax, [0x005adf7f]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.004378e0
lea rax, [0x005abcc5]
mov ebx, 8
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x68]
movzx eax, ax
call fcn.004378e0
lea rax, [0x005af688]
mov ebx, 0x15
nop
call fcn.00437be0
movzx eax, word [rsp + 0x1e]
call fcn.004378e0
lea rax, [0x005abcd5]
mov ebx, 8
nop dword [rax + rax]
call fcn.00437be0
movzx eax, word [rsp + 0x1c]
movzx eax, ax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b3bf9]
mov ebx, 0x20
call fcn.00435b40
inc rcx
mov r10, qword [rdx + 0x38]
add r10, 7
shr r10, 3
nop dword [rax]
cmp rcx, r10
jae 0x423ce5
mov r10, qword [rdx + 0x50]
movzx r10d, byte [rcx + r10]
mov r11, qword [rdx + 0x48]
movzx r11d, byte [rcx + r11]
not r11d
nop
test r10b, r11b
je 0x4241cd
mov qword [rsp + 0x50], rcx
mov rax, rdx
call fcn.00424520
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0xd8]
mov esi, dword [rsp + 0x20]
movzx edi, byte [rsp + 0x18]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
jmp 0x4241cd
inc qword [rsp + 0xb8]
inc rax
cmp qword [rdx + 0x38], rax
jbe 0x423c65
mov r10, qword [rsp + 0x90]
movzx r11d, byte [rsp + 0x98]
movzx r10d, byte [r10]
test r10b, r11b
jne 0x4242f5
mov r10, qword [rsp + 0xb8]
cmp qword [rdx + 0x30], r10
ja 0x424294
mov r10, qword [rsp + 0xa8]
movzx r11d, byte [rsp + 0xb0]
movzx r10d, byte [r10]
test r10b, r11b
je 0x4242f5
mov r10, qword [rdx + 0x68]
imul r10, rax
add r10, qword [rdx + 0x18]
cmp dword [0x00759524], 0
je 0x4242e8
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r10
mov rax, r10
mov rbx, r9
call fcn.0042d120
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
movzx ebx, byte [rsp + 0xd8]
mov esi, dword [rsp + 0x20]
movzx edi, byte [rsp + 0x18]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
cmp dword [0x007594e4], 0
je 0x4242f5
xor ecx, ecx
jmp 0x424371
nop
movzx r10d, byte [rsp + 0x98]
nop
cmp r10b, 0x80
jne 0x424318
inc qword [rsp + 0x90]
mov byte [rsp + 0x98], 1
jmp 0x424323
shl r10d, 1
mov byte [rsp + 0x98], r10b
inc qword [rsp + 0xa0]
nop
movzx r10d, byte [rsp + 0xb0]
cmp r10b, 0x80
jne 0x424350
inc qword [rsp + 0xa8]
mov byte [rsp + 0xb0], 1
jmp 0x424239
shl r10d, 1
mov byte [rsp + 0xb0], r10b
nop dword [rax + rax]
jmp 0x424239
mov dword [r10 + rcx], 0xdeadbeef
add rcx, 4
cmp rcx, r9
jb 0x424365
jmp 0x4242f5
mov ecx, 0x40
call fcn.004622a0
mov rax, r10
mov ecx, 0x40
call fcn.004622a0
mov r11, qword [r11]
test r11, r11
je 0x423b62
movzx r12d, word [r11 + 8]
cmp r12, rdi
jae 0x423b5d
cmp byte [r11 + 0xa], 1
jne 0x424392
jmp 0x423b4f
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x423a6e
movzx esi, word [rdx + 8]
cmp rsi, rdi
jae 0x423a6e
mov r11, qword [r15 + 0x18]
add rsi, r11
cmp byte [rdx + 0xa], 1
je 0x4243fd
test al, al
je 0x4243fd
nop
mov qword [rsp + 0x80], rdx
mov rdx, qword [rdx]
mov qword [rsp + 0x88], rdx
jmp 0x4243b8
nop
mov rdi, qword [rdx]
mov qword [rsp + 0x88], rdi
mov r8, qword [rsp + 0x80]
mov qword [r8], rdi
mov rax, rdx
mov rbx, rsi
mov rcx, r9
nop dword [rax]
call fcn.004280a0
movzx eax, byte [rsp + 0x19]
movzx ebx, byte [rsp + 0xd8]
mov rdi, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
jmp 0x4243b8
call fcn.004340c0
mov eax, dword [rdx + 0x58]
mov qword [rsp + 0x70], rax
nop dword [rax]
call fcn.004372e0
lea rax, [0x005aedbf]
mov ebx, 0x13
call fcn.00437be0
movzx eax, byte [rsp + 0x1b]
movzx eax, al
nop
call fcn.004378e0
lea rax, [0x005ac3fe]
mov ebx, 0xa
call fcn.00437be0
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005adb7f]
mov ebx, 0x10
call fcn.00437be0
mov eax, dword [rsp + 0x20]
call fcn.004378e0
nop
call fcn.00437540
call fcn.00437360
lea rax, [0x005b1ec0]
mov ebx, 0x1b
call fcn.00435b40
lea rax, [0x005b24fd]
mov ebx, 0x1c
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.0045fba0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00423960