Function at 0x4641e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4454a8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x1c], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
movsd qword [rsp + 0x28], xmm0
mov dword [rsp + 0x18], 0
xor eax, eax
mov ecx, 0x1e
movabs rdx, 0xb3a4b57ce31
jmp 0x445120
dec rcx
nop dword [rax]
test rcx, rcx
jl 0x445140
mov esi, 0x3b9aca00
shl rsi, cl
cmp rdx, rsi
jl 0x445119
sub rdx, rsi
bts eax, ecx
jmp 0x445119
cmp rdx, 0x3b9aca00
jl 0x445158
mov dword [rsp + 0x24], 0
mov eax, 0x7fffffff
jmp 0x445160
mov dword [rsp + 0x24], edx
nop dword [rax]
cmp eax, 0x3039
jne 0x445496
cmp dword [rsp + 0x24], 0xd431
jne 0x445496
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x14], 1
mov eax, 1
lea rcx, [rsp + 0x14]
mov edx, 2
lock cmpxchg dword [rcx], edx
sete dl
nop
test dl, dl
je 0x445485
cmp dword [rsp + 0x14], 2
jne 0x44546f
mov dword [rsp + 0x14], 4
mov eax, 5
mov edx, 6
lock cmpxchg dword [rcx], edx
sete dl
test dl, dl
jne 0x44545e
cmp dword [rsp + 0x14], 4
jne 0x44544d
mov dword [rsp + 0x14], 0xffffffff
mov eax, 0xffffffff
mov edx, 0xfffffffe
lock cmpxchg dword [rcx], edx
sete cl
nop dword [rax + rax]
test cl, cl
je 0x44543c
cmp dword [rsp + 0x14], 0xfffffffe
jne 0x44542b
mov dword [rsp + 0x18], 0
mov dword [rsp + 0x18], 0x1010101
mov ecx, 0xfffffff0
lea rdx, [rsp + 0x19]
lock or byte [rdx], cl
cmp byte [rsp + 0x18], 1
jne 0x44541a
cmp byte [rsp + 0x19], 0xf1
jne 0x44541a
cmp byte [rsp + 0x1a], 1
jne 0x44541a
cmp byte [rsp + 0x1b], 1
jne 0x44541a
mov dword [rsp + 0x18], 0
mov dword [rsp + 0x18], 0xffffffff
mov ecx, 1
lock and byte [rdx], cl
cmp byte [rsp + 0x18], 0xff
jne 0x445409
cmp byte [rsp + 0x19], 1
jne 0x445409
cmp byte [rsp + 0x1a], 0xff
jne 0x445409
cmp byte [rsp + 0x1b], 0xff
nop word [rax + rax]
jne 0x445409
mov qword [rsp + 0x30], 0xffffffffffffffff
movsd xmm0, qword [rsp + 0x30]
ucomisd xmm0, xmm0
jne 0x4452c6
nop dword [rax + rax]
jnp 0x4453f8
jne 0x4452ce
jnp 0x4453e7
mov qword [rsp + 0x28], 0xfffffffffffffffe
movsd xmm0, qword [rsp + 0x28]
movsd xmm1, qword [rsp + 0x30]
ucomisd xmm1, xmm0
jne 0x4452ef
jnp 0x4453d6
jne 0x4452f7
jnp 0x4453c5
mov dword [rsp + 0x20], 0xffffffff
movss xmm0, dword [rsp + 0x20]
ucomiss xmm0, xmm0
jne 0x445310
jnp 0x4453af
mov dword [rsp + 0x1c], 0xfffffffe
movss xmm0, dword [rsp + 0x1c]
movss xmm1, dword [rsp + 0x20]
ucomiss xmm1, xmm0
jne 0x44532b
jnp 0x44539e
call fcn.00444ec0
xor eax, eax
jmp 0x445337
inc rax
cmp rax, 0x20
sbb edx, edx
mov rcx, rax
mov esi, 1
shl esi, cl
and esi, edx
cmp esi, 0x2000
jl 0x445334
jne 0x44538d
call fcn.00461d60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp byte [rsp], 0
je 0x44537c
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x005afeee]
mov ebx, 0x16
call fcn.00435b40
lea rax, [0x005b22e9]
mov ebx, 0x1c
call fcn.00435b40
lea rax, [0x005aca8d]
mov ebx, 0xb
call fcn.00435b40
lea rax, [0x005ac62e]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00435b40
lea rax, [0x005acaae]
mov ebx, 0xb
call fcn.00435b40
lea rax, [0x005acaa3]
mov ebx, 0xb
call fcn.00435b40
lea rax, [0x005aca98]
mov ebx, 0xb
call fcn.00435b40
lea rax, [0x005ac638]
mov ebx, 0xa
call fcn.00435b40
lea rax, [0x005ac5de]
mov ebx, 0xa
call fcn.00435b40
lea rax, [0x005ac230]
mov ebx, 9
call fcn.00435b40
lea rax, [0x005ab3f9]
mov ebx, 4
call fcn.00435b40
lea rax, [0x005ab3f5]
mov ebx, 4
call fcn.00435b40
lea rax, [0x005ab3f1]
mov ebx, 4
call fcn.00435b40
lea rax, [0x005ab3ed]
mov ebx, 4
call fcn.00435b40
lea rax, [0x005ab3e9]
mov ebx, 4
nop dword [rax + rax]
call fcn.00435b40
lea rax, [0x005ab3e5]
mov ebx, 4
call fcn.00435b40
lea rax, [0x005ac9e8]
mov ebx, 0xb
call fcn.00435b40
nop
call fcn.0045fba0
jmp 0x4450c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x4450c0