Function at 0x401060
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x401599
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
jmp 0x401096
mov rax, rsi
mov rbx, r8
test rbx, rbx
je 0x4012cd
xor ecx, ecx
jmp 0x4013a0
mov rcx, 0xffffffffffffffff
test rcx, rcx
jge 0x4010c0
xor r8d, r8d
xor esi, esi
mov rcx, rbx
jmp 0x4010ed
cmp rcx, rbx
ja 0x401590
lea rsi, [rcx + 1]
cmp rbx, rsi
jb 0x401585
sub rbx, rcx
lea rdi, [rbx - 1]
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rsi, rax
cmp rcx, 4
jl 0x401090
cmp dword [rax], 0x2e757063
jne 0x401090
xor edx, edx
nop dword [rax]
jmp 0x4013c0
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x78], rsi
test rdx, rdx
jl 0x401279
nop
cmp rdx, rcx
ja 0x401572
cmp rdx, 4
jb 0x401565
lea rdi, [rdx - 4]
mov r9, rdi
neg rdi
sar rdi, 0x3f
and edi, 4
lea rbx, [rax + rdi]
lea r10, [rdx + 1]
cmp rcx, r10
jb 0x40155c
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x60], rbx
sub rcx, rdx
lea r11, [rcx - 1]
mov qword [rsp + 0x20], r11
mov r12, r11
neg r11
sar r11, 0x3f
and r10, r11
lea r11, [rax + r10]
mov qword [rsp + 0x58], r11
cmp rcx, 3
jne 0x4011a0
movzx r10d, word [rax + r10]
cmp r10w, 0x6e6f
jne 0x40120c
cmp rcx, 3
jmp 0x4011c3
cmp rcx, 4
jne 0x40120c
movzx r13d, word [rax + r10]
cmp r13w, 0x666f
jne 0x40120c
movzx r10d, byte [rax + r10 + 2]
cmp r10b, 0x66
jne 0x40120c
cmp rcx, 3
sete r10b
cmp rdx, 7
jne 0x4011f4
movzx r11d, word [rax + rdi]
cmp r11w, 0x6c61
jne 0x4011f4
movzx edi, byte [rax + rdi + 2]
nop
cmp dil, 0x6c
jne 0x4011f4
mov rdi, qword [0x00704d78]
xor eax, eax
jmp 0x401513
mov byte [rsp + 0x1f], r10b
mov rdx, qword [0x00704d78]
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4013e0
call fcn.004372e0
lea rax, [0x005adc6f]
mov ebx, 0x10
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x20]
call fcn.00437be0
lea rax, [0x005b3819]
mov ebx, 0x20
call fcn.00437be0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.00437be0
lea rax, [0x005ab0cf]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
mov rsi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
jmp 0x401090
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x68], rax
call fcn.004372e0
lea rax, [0x005b3d60]
mov ebx, 0x21
call fcn.00437be0
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x28]
call fcn.00437be0
lea rax, [0x005ab0cf]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
mov rsi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
jmp 0x401090
mov rax, qword [0x00704d78]
mov rcx, qword [0x00704d70]
nop dword [rax + rax]
test rax, rax
je 0x4012ee
mov qword [rsp + 0x50], rax
xor edx, edx
jmp 0x401302
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
add rcx, 0x20
movzx ebx, byte [rcx + 0x19]
mov rsi, qword [rcx + 0x10]
mov rdi, qword [rcx]
mov r8, qword [rcx + 8]
cmp byte [rcx + 0x18], 0
je 0x401384
test bl, bl
je 0x401382
cmp byte [rsi], 0
nop
jne 0x401382
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x70], rcx
call fcn.004372e0
lea rax, [0x005b1000]
mov ebx, 0x19
call fcn.00437be0
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x48]
call fcn.00437be0
lea rax, [0x005b064b]
mov ebx, 0x17
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x40]
jmp 0x401384
mov byte [rsi], bl
inc rdx
cmp rax, rdx
jg 0x4012fe
jmp 0x4012ee
inc rcx
nop dword [rax + rax]
cmp rcx, rbx
jge 0x4010a6
movzx esi, byte [rax + rcx]
cmp sil, 0x2c
jne 0x401395
jmp 0x4010ad
inc rdx
nop dword [rax + rax]
cmp rdx, rcx
jge 0x401105
movzx edi, byte [rax + rdx]
cmp dil, 0x3d
jne 0x4013b8
jmp 0x40110c
lea rax, [r11 + 1]
nop dword [rax]
cmp rax, rdx
jge 0x4014b0
mov rdi, qword [0x00704d70]
mov rcx, qword [0x00704d78]
nop word [rax + rax]
cmp rax, rcx
jae 0x401505
mov r11, rax
shl rax, 5
mov rcx, qword [rdi + rax + 8]
mov rdi, qword [rdi + rax]
cmp rcx, r9
jne 0x4013d8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r11
mov rax, rdi
call fcn.00402ec0
test al, al
jne 0x40145d
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
movzx r10d, byte [rsp + 0x1f]
mov r11, qword [rsp + 0x30]
jmp 0x4013d8
mov rcx, qword [0x00704d78]
mov rsi, qword [0x00704d70]
mov rax, qword [rsp + 0x30]
cmp rax, rcx
jae 0x401500
mov rdi, qword [rsp + 0x38]
mov byte [rsi + rdi + 0x18], 1
mov rcx, qword [0x00704d78]
mov rsi, qword [0x00704d70]
cmp rax, rcx
jae 0x4014fa
movzx r9d, byte [rsp + 0x1f]
mov byte [rsi + rdi + 0x19], r9b
mov rsi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
jmp 0x401090
call fcn.004372e0
lea rax, [0x005b2e5e]
mov ebx, 0x1e
call fcn.00437be0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.00437be0
lea rax, [0x005ab0cf]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
mov rsi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
jmp 0x401090
call fcn.00462280
nop
call fcn.00462280
call fcn.00462280
mov byte [r9 + rax + 0x19], r10b
lea rax, [r11 + 1]
cmp rax, rdi
jge 0x401090
mov rcx, qword [0x00704d78]
mov r9, qword [0x00704d70]
cmp rax, rcx
jae 0x401557
mov r11, rax
shl rax, 5
mov byte [r9 + rax + 0x18], 1
mov rcx, qword [0x00704d78]
mov r9, qword [0x00704d70]
cmp r11, rcx
jb 0x40150a
mov rax, r11
call fcn.00462280
call fcn.00462280
mov rax, r10
nop
call fcn.00462340
mov eax, 4
mov rcx, rdx
call fcn.00462340
mov rax, rcx
mov rcx, rdx
mov rdx, rax
nop dword [rax + rax]
call fcn.004622c0
mov rax, rsi
mov rcx, rbx
call fcn.00462340
mov rdx, rbx
call fcn.004622c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00401060