Function at 0x40cde0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d6ea
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
cmp dword [0x00759034], 2
nop
je 0x40d6d8
test rax, rax
je 0x40d64b
cmp byte [0x00759520], 0
je 0x40cea3
cmp dword [0x0075952c], 0
je 0x40ce83
test rbx, rbx
je 0x40ce65
test rax, 7
jne 0x40ce40
mov edx, 8
jmp 0x40ce6a
test rax, 3
jne 0x40ce4f
mov edx, 4
jmp 0x40ce6a
test rax, 1
mov edx, 1
mov esi, 2
cmove rdx, rsi
jmp 0x40ce6a
mov edx, 0x10
mov rbx, rdx
lea rcx, [0x0075ae00]
call fcn.0040db40
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
cmp byte [0x00759320], 0
je 0x40cea3
mov rdx, qword [0x00759328]
cmp qword [r14 + 0x98], rdx
jne 0x40cea3
inc qword [0x00759330]
mov byte [rsp + 0x88], cl
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
cmp dword [0x0075902c], 0
nop
je 0x40cf1b
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
test rdx, rdx
jne 0x40cedc
mov qword [rsp + 0x58], r14
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rdx + 0x180]
sub rsi, rax
mov qword [rdx + 0x180], rsi
test rsi, rsi
jge 0x40cf1d
mov qword [rsp + 0x60], rdx
mov rax, rdx
call fcn.0041cec0
mov rax, qword [rsp + 0x78]
movzx ecx, byte [rsp + 0x88]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
jmp 0x40cf1d
xor edx, edx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0xd8]
mov rsi, qword [r14 + 0x30]
mov r8, r14
test byte [r8], al
cmp dword [rsi + 0xc0], 0
jne 0x40d6c7
mov r8, r14
cmp qword [rsi + 0x50], r8
je 0x40d6b6
mov dword [rsi + 0xc0], 1
mov r8, qword [rsi + 0xa0]
nop dword [rax]
test r8, r8
je 0x40cf6b
mov r8, qword [r8 + 0x40]
jmp 0x40cf72
mov r8, qword [0x00759138]
test r8, r8
je 0x40d6a5
nop dword [rax + rax]
test rbx, rbx
je 0x40cf90
cmp qword [rbx + 8], 0
sete r9b
jmp 0x40cf96
mov r9d, 1
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], r8
mov byte [rsp + 0x26], r9b
mov qword [rsp + 0x58], rdx
cmp rax, 0x8000
ja 0x40d373
test r9b, r9b
je 0x40d167
nop
cmp rax, 0x10
jae 0x40d167
mov r10, qword [r8 + 0x18]
test rax, 7
jne 0x40cfe2
add r10, 7
and r10, 0xfffffffffffffff8
nop
jmp 0x40d002
test rax, 3
jne 0x40cff4
add r10, 3
and r10, 0xfffffffffffffffc
jmp 0x40d002
bt eax, 0
jb 0x40d002
nop
inc r10
and r10, 0xfffffffffffffffe
lea r11, [rax + r10]
cmp r11, 0x10
ja 0x40d061
mov r12, qword [r8 + 0x10]
test r12, r12
je 0x40d061
lea rax, [r12 + r10]
mov qword [r8 + 0x18], r11
inc qword [r8 + 0x20]
mov dword [rsi + 0xc0], 0
nop
mov ecx, dword [rsi + 0xd8]
lea edx, [rcx - 1]
mov dword [rsi + 0xd8], edx
nop dword [rax + rax]
cmp ecx, 1
jne 0x40d057
cmp byte [r14 + 0xb1], 0
je 0x40d057
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov r10, qword [r8 + 0x50]
mov r11, qword [r10 + 0x40]
bsf r12, r11
mov r13d, 0x40
cmove r12, r13
cmp r12, 0x40
jge 0x40d0ef
mov r13, qword [r10 + 0x30]
lea r15, [r13 + r12]
mov rcx, rdx
mov rdx, qword [r10 + 0x38]
cmp rdx, r15
jbe 0x40d0f2
lea r13, [r13 + r12]
lea r13, [r13 + 1]
nop dword [rax + rax]
test r13, 0x3f
jne 0x40d0b5
cmp rdx, r13
je 0x40d0b5
mov rdi, rcx
xor edx, edx
jmp 0x40d0f7
lea rdx, [r12 + 1]
cmp rdx, 0x40
sbb r12, r12
mov rdi, rcx
mov rcx, rdx
shr r11, cl
and r11, r12
mov qword [r10 + 0x40], r11
mov qword [r10 + 0x30], r13
movzx edx, word [r10 + 0x60]
inc edx
mov word [r10 + 0x60], dx
mov rdx, qword [r10 + 0x68]
imul rdx, r15
add rdx, qword [r10 + 0x18]
jmp 0x40d0f7
mov rcx, rdx
mov rdi, rcx
xor edx, edx
test rdx, rdx
je 0x40d102
xor ecx, ecx
nop
jmp 0x40d137
mov rax, r8
mov ebx, 5
call fcn.0040cbc0
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
movzx r9d, byte [rsp + 0x26]
mov rdx, rax
mov r10, rbx
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
movups xmmword [rdx], xmm15
nop dword [rax + rax]
cmp qword [r8 + 0x18], rax
ja 0x40d14d
cmp qword [r8 + 0x10], 0
jne 0x40d15a
mov r11, rdx
mov qword [r8 + 0x10], rdx
mov qword [r8 + 0x18], rax
jmp 0x40d15d
mov r11, rdx
mov edx, 0x10
jmp 0x40d36b
cmp rax, 0x3f8
ja 0x40d19b
lea r10, [rax + 7]
shr r10, 3
nop word [rax + rax]
cmp r10, 0x81
jae 0x40d694
lea r11, [0x006e4c80]
movzx r10d, byte [r10 + r11]
jmp 0x40d1c0
lea r10, [rax - 0x381]
shr r10, 7
cmp r10, 0xf9
jae 0x40d687
lea r11, [0x006e5f60]
movzx r10d, byte [r10 + r11]
nop
cmp r10, 0x44
jae 0x40d67a
lea r11, [0x006e4dc0]
movzx r11d, word [r11 + r10*2]
nop
shl r10d, 1
movzx r12d, r9b
or r10d, r12d
movzx r12d, r10b
cmp r12, 0x88
jae 0x40d66d
mov r12, qword [r8 + r12*8 + 0x28]
mov r13, qword [r12 + 0x40]
bsf r15, r13
mov rdi, rdx
mov edx, 0x40
cmove r15, rdx
cmp r15, 0x40
jge 0x40d2a5
mov rdx, qword [r12 + 0x30]
lea rsi, [rdx + r15]
mov r8, qword [r12 + 0x38]
cmp r8, rsi
jbe 0x40d29b
lea rdx, [rdx + r15]
lea rdx, [rdx + 1]
test rdx, 0x3f
jne 0x40d24d
cmp r8, rdx
je 0x40d24d
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
xor edx, edx
jmp 0x40d2a7
lea r8, [r15 + 1]
cmp r8, 0x40
sbb r15, r15
mov rcx, r8
shr r13, cl
and r13, r15
mov qword [r12 + 0x40], r13
mov qword [r12 + 0x30], rdx
movzx edx, word [r12 + 0x60]
inc edx
mov word [r12 + 0x60], dx
mov rdx, qword [r12 + 0x68]
imul rdx, rsi
add rdx, qword [r12 + 0x18]
movzx ecx, byte [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
jmp 0x40d2a7
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x40], r11
test rdx, rdx
je 0x40d2b6
xor r10d, r10d
jmp 0x40d300
mov rax, r8
mov ebx, r10d
nop dword [rax]
call fcn.0040cbc0
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
movzx r9d, byte [rsp + 0x26]
mov r11, qword [rsp + 0x40]
mov rdx, rax
mov r12, rbx
mov r10d, ecx
mov rax, qword [rsp + 0x78]
movzx ecx, byte [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
nop dword [rax]
test cl, cl
je 0x40d35d
cmp byte [r12 + 0x64], 0
je 0x40d35d
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x25], r10b
mov qword [rsp + 0x28], r12
mov rax, rdx
mov rbx, r11
call fcn.00462920
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
movzx r9d, byte [rsp + 0x26]
movzx r10d, byte [rsp + 0x25]
mov r11, qword [rsp + 0x40]
mov r12, qword [rsp + 0x28]
mov ecx, r10d
mov r11, rdx
mov r10, r12
mov rdx, qword [rsp + 0x40]
xor r12d, r12d
jmp 0x40d41e
mov rbx, rax
mov ecx, r9d
mov rax, r8
nop dword [rax]
call fcn.00416580
mov qword [rax + 0x30], 1
mov word [rax + 0x60], 1
mov rbx, qword [rax + 0x68]
mov rdx, qword [rax + 0x18]
movzx esi, byte [rsp + 0x88]
test sil, sil
je 0x40d3e7
cmp byte [rax + 0x64], 0
je 0x40d3e7
movzx esi, byte [rsp + 0x26]
test sil, sil
jne 0x40d3e3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdx
mov rax, rdx
call fcn.00462920
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0x26]
mov ecx, esi
jmp 0x40d3ee
movzx ecx, byte [rsp + 0x26]
xor esi, esi
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9d, ecx
mov r10, rax
mov r12d, esi
mov ecx, 1
mov r11, rdx
mov rax, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x48]
mov rdx, rbx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x25], cl
mov byte [rsp + 0x27], r12b
mov qword [rsp + 0x28], r10
test r9b, r9b
je 0x40d442
xor r13d, r13d
nop
jmp 0x40d497
mov rcx, rax
mov rdi, rbx
mov rax, r11
mov rbx, rdx
call fcn.00414860
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx]
mov r8, qword [rsp + 0x78]
cmp r8, rsi
jbe 0x40d484
mov rax, qword [rdx + 8]
mov rcx, r8
sub r8, rsi
lea rbx, [r8 + rax]
test rax, rax
mov eax, 0
cmovne rax, rbx
jmp 0x40d48b
mov rax, qword [rdx + 8]
mov rcx, r8
mov rbx, qword [rsp + 0x38]
add qword [rbx + 8], rax
mov r13, rax
mov qword [rsp + 0x30], r13
nop dword [rax]
call fcn.004619a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [0x00759034], 0
je 0x40d4db
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
call fcn.0041f760
mov rdx, qword [0x00759080]
test rdx, rdx
jle 0x40d522
cmp rdx, 1
je 0x40d507
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx]
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
jae 0x40d50c
sub rsi, rcx
mov qword [rdx], rsi
jmp 0x40d527
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
call fcn.0040d900
mov rcx, qword [rsp + 0x40]
jmp 0x40d527
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov dword [rdx + 0xc0], 0
nop
mov esi, dword [rdx + 0xd8]
lea edi, [rsi - 1]
mov dword [rdx + 0xd8], edi
cmp esi, 1
jne 0x40d55d
cmp byte [r14 + 0xb1], 0
je 0x40d55d
mov qword [r14 + 0x10], 0xfffffffffffffade
movzx edx, byte [rsp + 0x27]
test dl, dl
je 0x40d58a
movzx edx, byte [rsp + 0x26]
test dl, dl
je 0x40d65c
mov rax, rcx
mov rbx, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.0040d720
mov rcx, qword [rsp + 0x40]
cmp byte [0x00759520], 0
je 0x40d5d6
cmp dword [0x00759524], 0
je 0x40d5b6
mov rax, qword [rsp + 0x50]
mov rbx, rcx
mov rcx, qword [rsp + 0x80]
call fcn.0042ce80
mov rcx, qword [rsp + 0x40]
cmp byte [0x00759320], 0
je 0x40d5d6
mov rdx, qword [0x00759328]
cmp qword [r14 + 0x98], rdx
jne 0x40d5d6
add qword [0x00759338], rcx
mov rdx, qword [rsp + 0x58]
nop dword [rax + rax]
test rdx, rdx
je 0x40d5f4
mov rsi, qword [rsp + 0x78]
sub rcx, rsi
sub qword [rdx + 0x180], rcx
movzx edx, byte [rsp + 0x25]
test dl, dl
je 0x40d63c
cmp byte [0x0075be28], 0
je 0x40d62b
cmp dword [0x00759050], 0
jne 0x40d62b
cmp dword [0x00759034], 0
jne 0x40d62b
mov rdx, qword [0x00759a38]
cmp qword [0x007599d8], rdx
setbe dl
jmp 0x40d62d
xor edx, edx
test dl, dl
je 0x40d63c
xor eax, eax
xor ebx, ebx
xor ecx, ecx
call fcn.00419220
mov rax, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x00759200]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x005b79bf]
mov ebx, 0x31
call fcn.00435b40
mov rax, r12
mov ecx, 0x88
call fcn.00462280
mov eax, r10d
mov ecx, 0x44
call fcn.00462280
mov rax, r10
mov ecx, 0xf9
call fcn.004622a0
mov rax, r10
mov ecx, 0x81
nop dword [rax]
call fcn.004622a0
lea rax, [0x005b7fff]
mov ebx, 0x34
call fcn.00435b40
lea rax, [0x005af456]
mov ebx, 0x14
call fcn.00435b40
lea rax, [0x005ad9f7]
mov ebx, 0xf
call fcn.00435b40
lea rax, [0x005b7d67]
mov ebx, 0x32
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0040cde0