Function at 0x430040
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0xd8]
cmp r12, qword [r14 + 0x10]
jbe 0x430731
sub rsp, 0x158
mov qword [rsp + 0x150], rbp
lea rbp, [rsp + 0x150]
movabs rax, 0x32336c656e72656b
mov qword [rsp + 0x64], rax
movabs rax, 0x6c6c642e32336c
mov qword [rsp + 0x69], rax
mov rax, qword [0x006e10c8]
lea rcx, [rsp + 0x64]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
test rax, rax
je 0x43071f
mov qword [rsp + 0x30], rax
movabs rdx, 0x69446c6c44646441
mov qword [rsp + 0xad], rdx
movabs rdx, 0x79726f74636572
mov qword [rsp + 0xb5], rdx
lea rbx, [rsp + 0xad]
mov ecx, 0x10
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430119
mov qword [0x00703f28], rax
jmp 0x430125
lea rdi, [0x00703f28]
call fcn.00461de0
movabs rdx, 0x6f74636556646441
mov qword [rsp + 0x135], rdx
movabs rdx, 0x69746e6f43646572
mov qword [rsp + 0x13d], rdx
movabs rdx, 0x65756e69746e6f43
mov qword [rsp + 0x140], rdx
movabs rdx, 0x72656c646e6148
mov qword [rsp + 0x148], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x135]
mov ecx, 0x1b
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430199
mov qword [0x00703f30], rax
jmp 0x4301a5
lea rdi, [0x00703f30]
call fcn.00461de0
movabs rdx, 0x7262694c64616f4c
mov qword [rsp + 0x8e], rdx
movabs rsi, 0x41784579726172
mov qword [rsp + 0x95], rsi
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x8e]
mov ecx, 0xf
mov rdi, rcx
nop
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x4301f7
mov qword [0x00703f40], rax
jmp 0x430205
lea rdi, [0x00703f40]
nop
call fcn.00461de0
movabs rdx, 0x7262694c64616f4c
mov qword [rsp + 0x7f], rdx
movabs rdx, 0x57784579726172
mov qword [rsp + 0x86], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x7f]
mov ecx, 0xf
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x43024f
mov qword [0x00703f48], rax
jmp 0x430260
lea rdi, [0x00703f48]
call fcn.00461de0
nop dword [rax + rax]
test rax, rax
je 0x43027c
cmp qword [0x00703f40], 0
je 0x43027c
cmp qword [0x00703f28], 0
setne dl
jmp 0x43027e
xor edx, edx
mov byte [0x00758ff8], dl
movabs rdx, 0x3233697061766461
mov qword [rsp + 0x57], rdx
movabs rdx, 0x6c6c642e323369
mov qword [rsp + 0x5c], rdx
lea rax, [rsp + 0x57]
mov ebx, 0xd
mov rcx, rbx
call fcn.0042fe20
test rax, rax
je 0x43070e
movabs rdx, 0x75466d6574737953
mov qword [rsp + 0xdf], rdx
movabs rdx, 0x636e75466d657473
mov qword [rsp + 0xe1], rdx
movabs rdx, 0x3633306e6f6974
mov qword [rsp + 0xe9], rdx
lea rbx, [rsp + 0xdf]
mov ecx, 0x12
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x43031a
mov qword [0x00703f68], rax
jmp 0x430326
lea rdi, [0x00703f68]
call fcn.00461de0
movabs rdx, 0x6c642e6c6c64746e
mov qword [rsp + 0x42], rdx
mov word [rsp + 0x4a], 0x6c
lea rax, [rsp + 0x42]
mov ebx, 0xa
mov rcx, rbx
call fcn.0042fe20
test rax, rax
je 0x4306fd
mov qword [rsp + 0x20], rax
movabs rdx, 0x6f4674696157744e
mov qword [rsp + 0xf1], rdx
movabs rdx, 0x6c676e6953726f46
mov qword [rsp + 0xf7], rdx
movabs rdx, 0x7463656a624f65
mov qword [rsp + 0xff], rdx
lea rbx, [rsp + 0xf1]
mov ecx, 0x16
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x4303b9
mov qword [0x00703f50], rax
jmp 0x4303c5
lea rdi, [0x00703f50]
call fcn.00461de0
movabs rdx, 0x75437465476c7452
mov qword [rsp + 0xce], rdx
movabs rdx, 0x7275437465476c74
mov qword [rsp + 0xcf], rdx
movabs rdx, 0x626550746e6572
mov qword [rsp + 0xd7], rdx
mov rax, qword [rsp + 0x20]
lea rbx, [rsp + 0xce]
mov ecx, 0x11
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430427
mov qword [0x00703f70], rax
jmp 0x430433
lea rdi, [0x00703f70]
call fcn.00461de0
movabs rdx, 0x744e7465476c7452
mov qword [rsp + 0x11e], rdx
movabs rdx, 0x6e6f697372655674
mov qword [rsp + 0x125], rdx
movabs rdx, 0x737265626d754e
mov qword [rsp + 0x12d], rdx
mov rax, qword [rsp + 0x20]
lea rbx, [rsp + 0x11e]
mov ecx, 0x17
mov rdi, rcx
nop
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430497
mov qword [0x00703f78], rax
jmp 0x4304a5
lea rdi, [0x00703f78]
nop
call fcn.00461de0
movabs rdx, 0x6c642e6d6d6e6977
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x40], 0x6c
lea rax, [rsp + 0x38]
mov ebx, 0xa
mov rcx, rbx
call fcn.0042fe20
test rax, rax
je 0x4306ec
mov qword [rsp + 0x28], rax
movabs rdx, 0x69676542656d6974
mov qword [rsp + 0x9d], rdx
movabs rdx, 0x646f697265506e
mov qword [rsp + 0xa5], rdx
lea rbx, [rsp + 0x9d]
mov ecx, 0x10
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430526
mov qword [0x00703f88], rax
jmp 0x430532
lea rdi, [0x00703f88]
call fcn.00461de0
movabs rdx, 0x50646e45656d6974
mov qword [rsp + 0x71], rdx
movabs rdx, 0x646f6972655064
mov qword [rsp + 0x77], rdx
mov rax, qword [rsp + 0x28]
lea rbx, [rsp + 0x71]
mov ecx, 0xe
mov rdi, rcx
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430579
mov qword [0x00703f90], rax
jmp 0x430585
lea rdi, [0x00703f90]
call fcn.00461de0
cmp qword [0x00703f88], 0
je 0x4306db
test rax, rax
je 0x4306db
movabs rdx, 0x642e32335f327377
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x6c6c642e32335f
mov qword [rsp + 0x4f], rdx
lea rax, [rsp + 0x4c]
mov ebx, 0xb
mov rcx, rbx
call fcn.0042fe20
test rax, rax
je 0x4306ca
movabs rdx, 0x764f746547415357
mov qword [rsp + 0x107], rdx
movabs rdx, 0x657070616c726576
mov qword [rsp + 0x10e], rdx
movabs rdx, 0x746c7573655264
mov qword [rsp + 0x116], rdx
lea rbx, [rsp + 0x107]
mov ecx, 0x17
mov rdi, rcx
nop dword [rax + rax]
call fcn.0042fd60
cmp dword [0x007592a0], 0
jne 0x430637
mov qword [0x00703f80], rax
jmp 0x430645
lea rdi, [0x00703f80]
nop
call fcn.00461de0
test rax, rax
je 0x4306b9
movabs rdx, 0x7465675f656e6977
mov qword [rsp + 0xbd], rdx
movabs rdx, 0x5f7465675f656e69
mov qword [rsp + 0xbe], rdx
movabs rdx, 0x6e6f6973726576
mov qword [rsp + 0xc6], rdx
mov rax, qword [rsp + 0x20]
lea rbx, [rsp + 0xbd]
mov ecx, 0x11
mov rdi, rcx
call fcn.0042fd60
test rax, rax
je 0x4306a9
mov rax, qword [rsp + 0x30]
call fcn.004311e0
mov rbp, qword [rsp + 0x150]
add rsp, 0x158
ret
lea rax, [0x005b37f9]
mov ebx, 0x20
call fcn.00435b40
lea rax, [0x005af64a]
mov ebx, 0x14
call fcn.00435b40
lea rax, [0x005b2cda]
mov ebx, 0x1d
call fcn.00435b40
lea rax, [0x005af00c]
mov ebx, 0x13
call fcn.00435b40
lea rax, [0x005aede5]
mov ebx, 0x13
call fcn.00435b40
lea rax, [0x005afec2]
mov ebx, 0x16
call fcn.00435b40
lea rax, [0x005b0064]
mov ebx, 0x16
call fcn.00435b40
nop
call fcn.0045fba0
jmp fcn.00430040