Function at 0x40c3c0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x40ca30
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
test byte [rax], al
nop
lea rdx, [rax + 0x103b8]
add rbx, 0x3fffff
and rbx, 0xffffffffffc00000
mov qword [rsp + 0x20], rbx
mov ecx, 0x400000
lea rdi, [0x0075ad90]
mov rax, rdx
call fcn.0040df20
nop
test rax, rax
jne 0x40c437
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x20]
jmp 0x40c71c
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x60], rcx
mov rdx, rax
movabs rsi, 0x800000000000
add rsi, rax
shr rsi, 0x16
mov r8, qword [rsp + 0xa0]
jmp 0x40c48e
mov r9, qword [rsp + 0x58]
mov qword [rdx + r8*8], r9
mov r10, qword [rsp + 0x78]
xchg qword [r10], rax
inc r9
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
mov r8, rsi
mov rsi, r9
mov rax, rdx
add rdx, rcx
movabs r9, 0x7fffffffffff
add rdx, r9
shr rdx, 0x16
cmp rsi, rdx
ja 0x40c676
mov rdx, rsi
shr rsi, 0x14
cmp rsi, 0x40
jae 0x40c6da
mov qword [rsp + 0x58], rdx
mov r10, qword [r8 + rsi*8 + 0x10190]
lea rsi, [r8 + rsi*8]
lea rsi, [rsi + 0x10190]
test r10, r10
jne 0x40c530
mov qword [rsp + 0x80], rsi
mov eax, 0x800000
mov ebx, 8
xor ecx, ecx
call fcn.0040db40
test rax, rax
je 0x40c6c9
mov rdx, qword [rsp + 0x80]
mov r10, rax
xchg qword [rdx], rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0xa0]
movabs r9, 0x7fffffffffff
test byte [r10], al
and edx, 0xfffff
mov r11, qword [r10 + rdx*8]
lea rdx, [r10 + rdx*8]
test r11, r11
jne 0x40c6b8
mov qword [rsp + 0x78], rdx
lea rax, [r8 + 0x10390]
mov ebx, 0x210d0
mov ecx, 8
lea rdi, [0x0075adf8]
call fcn.0040df20
test rax, rax
jne 0x40c590
mov eax, 0x210d0
mov ebx, 8
lea rcx, [0x0075adf8]
call fcn.0040db40
test rax, rax
je 0x40c6a7
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsi + 0x103e8]
nop
cmp qword [rsi + 0x103e0], r8
jne 0x40c646
mov qword [rsp + 0x30], rax
shl r8, 4
test r8, r8
jne 0x40c5c2
mov r8, qword [0x00759180]
mov qword [rsp + 0x28], r8
mov rax, r8
mov ebx, 8
lea rcx, [0x0075adf8]
call fcn.0040db40
nop dword [rax + rax]
test rax, rax
je 0x40c696
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsi + 0x103d8]
mov r8, qword [rsi + 0x103e0]
mov qword [rsi + 0x103d8], rax
mov r9, qword [rsp + 0x28]
shr r9, 3
mov qword [rsi + 0x103e8], r9
mov rcx, qword [rsi + 0x103e0]
cmp rcx, r8
cmovg rcx, r8
mov rax, qword [rsi + 0x103d8]
cmp rax, rbx
je 0x40c641
shl rcx, 3
call fcn.00462be0
mov rsi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x30]
mov r8, qword [rsi + 0x103e0]
mov rdx, qword [rsi + 0x103e8]
lea rcx, [r8 + 1]
cmp rdx, rcx
jb 0x40c691
mov qword [rsi + 0x103e0], rcx
mov rdx, qword [rsi + 0x103d8]
cmp r8, rcx
jb 0x40c467
jmp 0x40c689
mov rbx, rcx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rax, r8
call fcn.00462280
call fcn.00462300
lea rax, [0x005b4465]
mov ebx, 0x22
call fcn.00435b40
lea rax, [0x005b6bd6]
mov ebx, 0x2c
call fcn.00435b40
lea rax, [0x005b11a9]
mov ebx, 0x19
call fcn.00435b40
lea rax, [0x005b59a9]
mov ebx, 0x27
call fcn.00435b40
mov rax, rsi
mov ecx, 0x40
call fcn.004622a0
mov r8, qword [rsi + 0x10]
mov qword [rdx + 0x103b0], r8
nop
mov r8, qword [rdx + 0x16bd8]
sub r8, qword [rdx + 0x16ba8]
mov qword [rdx + 0x16bd8], r8
mov r8, qword [rdx + 0x16bc0]
mov qword [rsi], r8
mov qword [rdx + 0x16bc0], rsi
mov rax, r11
mov rsi, qword [rdx + 0x103b0]
test rsi, rsi
je 0x40c819
mov qword [rsp + 0x50], rsi
mov rax, qword [rsi]
movzx r8d, byte [rsi + 8]
mov r9, rax
sub rax, rbx
test r8, r8
cmovne r9, rax
lea r8, [rbx + r9]
cmp r9, r8
jbe 0x40c75d
movabs r10, 0x7fffffffffff
xor eax, eax
jmp 0x40c7b4
movabs r10, 0x7fffffffffff
lea r11, [r10 + r8]
shr r11, 0x16
cmp r11, 0x4000000
jb 0x40c77c
xor eax, eax
jmp 0x40c7b4
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x60], r8
mov rax, r9
call fcn.00417a20
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x40]
movabs r10, 0x7fffffffffff
mov r11, rax
cmp rax, r9
je 0x40c805
nop dword [rax]
test r11, r11
je 0x40c6e7
mov qword [rsp + 0x88], r11
mov rax, r11
xor ecx, ecx
call fcn.004178e0
mov rdx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
movabs r10, 0x7fffffffffff
mov r11, qword [rsp + 0x88]
nop
jmp 0x40c6e7
movzx r12d, byte [rsi + 8]
test r12, r12
cmovne r8, r9
mov qword [rsi], r8
mov rax, rbx
jmp 0x40c82b
movabs r10, 0x7fffffffffff
mov r11, rax
mov rax, rbx
xor ebx, ebx
test rbx, rbx
jne 0x40c8dd
mov rbx, rax
mov ecx, 0x400000
xor eax, eax
nop
call fcn.0040ca60
test rax, rax
je 0x40c979
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [rsp + 0xa0]
lea rax, [rcx + 0x16ba8]
mov qword [rsp + 0x70], rax
call fcn.00418b60
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
mov byte [rax + 8], 1
mov rcx, qword [0x0072b670]
mov qword [rax + 0x10], rcx
mov qword [0x0072b670], rax
mov rax, qword [rsp + 0x70]
call fcn.00418b60
mov r11, qword [rsp + 0x88]
mov rcx, r11
mov rbx, qword [rsp + 0x60]
lea rdx, [rbx + r11]
mov qword [rax], rdx
mov rdx, qword [0x0072b670]
mov qword [rax + 0x10], rdx
mov qword [0x0072b670], rax
mov rdx, qword [rsp + 0xa0]
movabs r10, 0x7fffffffffff
mov r11, rcx
mov rsi, r11
lea r8, [rbx + r11]
cmp r11, r8
jbe 0x40c902
movabs r9, 0x800000000000
mov r12d, 0x1c
lea r13, [0x005b2615]
jmp 0x40c960
movabs r9, 0x800000000000
lea r12, [r9 + r11]
shr r12, 0x16
cmp r12, 0x4000000
jb 0x40c92c
mov r12d, 0x21
lea r13, [0x005b3da2]
jmp 0x40c960
lea r12, [r10 + r8]
shr r12, 0x16
cmp r12, 0x4000000
mov r12d, 0
mov r13d, 0x20
cmovae r12, r13
mov r13d, 0
lea r15, [0x005b38d9]
cmovae r13, r15
nop dword [rax]
test r12, r12
jne 0x40c99e
test r11, 0x3fffff
jne 0x40c98d
mov rax, rsi
mov rcx, rbx
jmp 0x40c43c
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x005b3f4f]
mov ebx, 0x21
call fcn.00435b40
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x48], r12
call fcn.004372e0
lea rax, [0x005b40ba]
mov ebx, 0x21
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437a40
lea rax, [0x005ab075]
mov ebx, 2
nop
call fcn.00437be0
mov rax, qword [rsp + 0x60]
call fcn.00437a40
lea rax, [0x005b3201]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x48]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b711a]
mov ebx, 0x2e
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040c3c0