Function at 0x45dd80
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x78]
cmp r12, qword [r14 + 0x10]
jbe 0x45e1fa
sub rsp, 0xf8
mov qword [rsp + 0xf0], rbp
lea rbp, [rsp + 0xf0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbx
test rax, rax
je 0x45e1e6
movzx esi, byte [rax + 0x17]
and esi, 0x1f
cmp sil, 0x13
jne 0x45e1e6
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movzx esi, byte [rax + 0x14]
test sil, 1
je 0x45ddff
mov ecx, 0x48
jmp 0x45de04
mov ecx, 0x38
movzx esi, word [rax + 0x30]
lea rdi, [rcx + rax]
cmp rsi, 0x100000
ja 0x45e1d9
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rsi
xor ecx, ecx
jmp 0x45de61
mov qword [rsp + 0x28], rcx
mov rbx, qword [rdi + rcx*8]
lea rax, [rsp + 0x60]
nop
call fcn.00450840
mov rcx, qword [rsp + 0x28]
inc rcx
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp rcx, rsi
jl 0x45de31
mov rdx, qword [rsp + 0x80]
add rdx, 7
and rdx, 0xfffffffffffffff8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x98], rdx
movzx esi, byte [rax + 0x14]
movzx edi, word [rax + 0x32]
and edi, 0x7fff
movzx r8d, word [rax + 0x30]
add edi, r8d
movzx ecx, di
nop
cmp r8, rcx
ja 0x45e1d1
lea rdi, [r8 - 0x100000]
mov r9d, r8d
shl r8, 3
sar rdi, 0x3f
and rdi, r8
sub rcx, r9
cmp rcx, 1
jne 0x45e1be
test sil, 1
je 0x45ded8
mov ecx, 0x48
jmp 0x45dedd
mov ecx, 0x38
add rcx, rax
mov rcx, qword [rcx + rdi]
nop
cmp qword [rcx], 8
jne 0x45e1ab
test sil, 1
je 0x45defc
mov ecx, 0x48
jmp 0x45df01
mov ecx, 0x38
add rcx, rax
mov rcx, qword [rcx + rdi]
movzx ecx, byte [rcx + 0x17]
and ecx, 0x1f
nop
cmp cl, 0xd
je 0x45e198
nop dword [rax]
cmp cl, 0xe
je 0x45e198
cmp qword [0x006e1308], 0
jne 0x45df3f
lea rcx, [rdx + 8]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x80]
add rcx, 7
and rcx, 0xfffffffffffffff8
add rcx, qword [rsp + 0x88]
nop word [rax + rax]
cmp rcx, 0x200
ja 0x45e185
nop
nop
lea rax, [0x00731ec0]
call fcn.0040b700
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x58], 0
mov rbx, qword [0x00758fc8]
lea rax, [0x005845c0]
lea rcx, [rsp + 0x50]
nop dword [rax]
call fcn.0040e9e0
mov rcx, qword [rax]
test bl, bl
jne 0x45e12a
cmp qword [0x00758fc8], 0
jne 0x45dfdd
call fcn.0040e320
cmp dword [0x007592a0], 0
jne 0x45dfd1
mov qword [0x00758fc8], rax
jmp 0x45dfdd
lea rdi, [0x00758fc8]
call fcn.00461de0
mov rax, qword [0x00758fd0]
cmp rax, 0x7d0
jge 0x45e165
lea rdi, [rsp + 0xa0]
lea rdi, [rdi - 0x30]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00462550
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0xa0], rdx
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0xd0], xmm0
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0xe0], xmm0
nop word [rax + rax]
jae 0x45e157
mov qword [rsp + 0x18], rax
lea r8, [rax + rax*4]
shl r8, 4
lea r9, [0x00731ec8]
lea rdi, [r9 + r8]
cmp dword [0x007592a0], 0
jne 0x45e0b5
lea rsi, [rsp + 0xa0]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004628ba
mov rbp, qword [rbp]
jmp 0x45e0d1
lea rax, [0x00594da0]
mov rbx, rdi
lea rcx, [rsp + 0xa0]
call fcn.00413220
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 0
mov rbx, qword [0x00758fc8]
lea rax, [0x005845c0]
lea rcx, [rsp + 0x50]
call fcn.0040ee20
mov rdx, qword [rsp + 0x18]
mov qword [rax], rdx
inc qword [0x00758fd0]
nop
nop
lea rax, [0x00731ec0]
call fcn.0040b920
mov rax, qword [rsp + 0x18]
call fcn.00450f00
mov rbp, qword [rsp + 0xf0]
add rsp, 0xf8
ret
mov qword [rsp + 0x20], rcx
nop
nop
lea rax, [0x00731ec0]
call fcn.0040b920
mov rax, qword [rsp + 0x20]
call fcn.00450f00
mov rbp, qword [rsp + 0xf0]
add rsp, 0xf8
ret
mov ecx, 0x7d0
nop dword [rax]
call fcn.00462280
nop
nop
lea rax, [0x00731ec0]
call fcn.0040b920
lea rax, [0x005b2112]
mov ebx, 0x1b
nop
call fcn.00435b40
lea rax, [0x00579660]
lea rbx, [0x005f6ac0]
call fcn.004353c0
lea rax, [0x00579660]
lea rbx, [0x005f6ab0]
call fcn.004353c0
lea rax, [0x00579660]
lea rbx, [0x005f6aa0]
call fcn.004353c0
lea rax, [0x00579660]
lea rbx, [0x005f6aa0]
call fcn.004353c0
mov eax, r8d
call fcn.00462340
mov rcx, rsi
mov edx, 0x100000
call fcn.004622c0
lea rax, [0x00579660]
lea rbx, [0x005f6aa0]
call fcn.004353c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
nop dword [rax]
jmp fcn.0045dd80