Function at 0x43cdc0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x43d763
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
mov qword [rsp + 0xc8], r14
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
cmp dword [0x00705c40], 0
je 0x43ce11
call fcn.0043cb40
jmp 0x43cdee
mov qword [rsp + 0xd8], rax
test byte [rax], al
cmp dword [rax + 0x2270], 0
je 0x43ce31
call fcn.0043b360
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
call fcn.0043e740
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
cmp byte [0x00758fec], 0
je 0x43ce74
cmp byte [0x00758fed], 0
je 0x43ce74
call fcn.00417e00
test rax, rax
je 0x43ce6a
xor ebx, ebx
mov ecx, 1
call fcn.00439740
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [0x006fc018]
mov rcx, qword [rcx]
nop
test rcx, rcx
je 0x43ceab
mov qword [rsp], rcx
mov qword [rsp + 8], 0
call fcn.004619c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xd8]
call fcn.004444e0
nop dword [rax + rax]
test rax, rax
jne 0x43d4e2
cmp dword [0x00705bd0], 0
je 0x43cf1b
nop
nop
lea rax, [0x00705b78]
nop dword [rax + rax]
call fcn.0040b700
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
call fcn.00443c20
mov qword [rsp + 0xb0], rax
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rax, qword [rsp + 0xb0]
test rax, rax
jne 0x43d4d0
mov edx, dword [0x00759040]
test edx, edx
je 0x43cf42
mov edx, dword [0x00759044]
test edx, edx
jbe 0x43cf3e
mov rdx, qword [0x00705b68]
test rdx, rdx
setne dl
jmp 0x43cf44
xor edx, edx
jmp 0x43cf44
xor edx, edx
test dl, dl
je 0x43cf5d
xor eax, eax
call fcn.0042f900
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x43d462
mov rdx, qword [rsp + 0xc8]
mov rsi, qword [rdx + 0x30]
mov edi, dword [0x00759038]
cmp byte [rsi + 0xe4], 0
je 0x43cf7f
mov esi, 1
jmp 0x43cf97
mov esi, dword [0x00705bbc]
mov r8d, dword [0x00705bb8]
shl esi, 1
sub edi, r8d
cmp esi, edi
setb sil
test sil, sil
jne 0x43cfa8
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x43d007
mov rcx, qword [rdx + 0x30]
cmp byte [rcx + 0xe4], 0
jne 0x43cfcc
mov byte [rcx + 0xe4], 1
mov ecx, 1
lea rbx, [0x00705bbc]
lock xadd dword [rbx], ecx
mov rax, qword [rsp + 0x58]
call fcn.0043d860
test rax, rax
jne 0x43d452
nop
test sil, sil
jne 0x43cdee
test rdi, rdi
je 0x43cfff
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x43d007
cmp rdi, rdx
jl 0x43d007
jmp 0x43d004
mov rdx, qword [rsp + 0x50]
mov rdi, rdx
cmp dword [0x0075902c], 0
je 0x43d06e
mov rdx, qword [rsp + 0xd8]
mov rsi, qword [rdx + 0x1238]
nop
test rsi, rsi
je 0x43d042
cmp qword [rsi + 0x10], 0
jne 0x43d03a
mov rsi, qword [rdx + 0x1240]
cmp qword [rsi + 0x10], 0
je 0x43d042
mov eax, 1
nop
jmp 0x43d078
mov rsi, qword [0x007055c0]
test rsi, rsi
jne 0x43d067
mov esi, dword [0x00705648]
cmp dword [0x0070564c], esi
jbe 0x43d063
mov eax, 1
jmp 0x43d078
xor eax, eax
jmp 0x43d078
mov eax, 1
jmp 0x43d078
mov rdx, qword [rsp + 0xd8]
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rcx
test al, al
je 0x43d08c
nop
jmp 0x43d6c7
mov rcx, qword [0x00704f30]
mov qword [rsp + 0xb8], rcx
mov rdx, qword [0x00704f38]
mov qword [rsp + 0x80], rdx
mov rbx, qword [0x00704f40]
mov qword [rsp + 0x88], rbx
mov rsi, qword [0x00704f90]
mov qword [rsp + 0xa0], rsi
mov rdi, qword [0x00704f98]
mov qword [rsp + 0x70], rdi
mov r8, qword [0x00704fa0]
mov qword [rsp + 0x78], r8
mov r9, qword [0x00704fd0]
mov qword [rsp + 0x98], r9
mov r10, qword [0x00704fd8]
mov qword [rsp + 0x40], r10
mov r11, qword [0x00704fe0]
mov qword [rsp + 0x48], r11
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
cmp dword [0x00705c40], 0
jne 0x43d12f
mov rax, qword [rsp + 0xd8]
cmp dword [rax + 0x2270], 0
je 0x43d145
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
nop dword [rax]
jmp 0x43cdee
cmp dword [0x00705bd0], 0
jne 0x43d64a
call fcn.00442320
mov rcx, qword [rsp + 0xd8]
nop
cmp rax, rcx
jne 0x43d6b6
mov rax, rcx
call fcn.00443e60
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rcx + 0x30]
movzx ebx, byte [rdx + 0xe4]
mov byte [rsp + 0x3f], bl
test bl, bl
je 0x43d27e
mov byte [rdx + 0xe4], 0
mov edx, 0xffffffff
lea r9, [0x00705bbc]
lock xadd dword [r9], edx
dec edx
nop dword [rax + rax]
test edx, edx
jl 0x43d6a5
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
call fcn.0043dbe0
test rax, rax
je 0x43d22d
nop dword [rax]
call fcn.004421a0
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe4], 1
mov edx, 1
lea rbx, [0x00705bbc]
lock xadd dword [rbx], edx
jmp 0x43cdee
call fcn.0043ddc0
test rax, rax
jne 0x43d4f2
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
call fcn.0043dd20
mov rcx, qword [rsp + 0xc8]
movzx ebx, byte [rsp + 0x3f]
jmp 0x43d283
mov rax, qword [rsp + 0x50]
mov edx, dword [0x00759040]
test edx, edx
je 0x43d2b4
mov edx, dword [0x00759044]
test edx, edx
ja 0x43d29c
test rax, rax
je 0x43d2b0
xor edx, edx
lea rsi, [0x00705b68]
xchg qword [rsi], rdx
test rdx, rdx
setne dl
jmp 0x43d2b6
xor edx, edx
jmp 0x43d2b6
xor edx, edx
test dl, dl
je 0x43d607
lea rdx, [0x00705b70]
mov rsi, rax
xchg qword [rdx], rax
mov rdi, qword [rcx + 0x30]
cmp qword [rdi + 0xa0], 0
jne 0x43d692
cmp byte [rdi + 0xe4], 0
jne 0x43d681
test rsi, rsi
je 0x43d34f
mov rdi, qword [rsp + 0x58]
test rdi, rdi
jne 0x43d33e
mov qword [rsp + 0x90], rsi
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp]
lea rdx, [0x00705b70]
movzx ebx, byte [rsp + 0x3f]
mov rsi, qword [rsp + 0x90]
mov rdi, rcx
mov rcx, qword [rsp + 0xc8]
sub rsi, rdi
test rsi, rsi
mov edi, 0
cmovl rsi, rdi
jmp 0x43d358
xor edi, edi
mov rsi, 0xffffffffffffffff
cmp qword [0x007590e8], 0
cmovne rsi, rdi
mov rax, rsi
call fcn.0042f900
mov qword [rsp + 0x60], rax
xor ecx, ecx
lea rdx, [0x00705b70]
xchg qword [rdx], rcx
nop dword [rax]
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp]
lea rdx, [0x00705b68]
xchg qword [rdx], rcx
cmp qword [0x007590e8], 0
je 0x43d3c5
cmp qword [rsp + 0x60], 0
jne 0x43d3c5
call fcn.0043c0c0
nop
jmp 0x43cdee
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
call fcn.00443f80
mov qword [rsp + 0xc0], rax
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x43d5f7
nop
call fcn.004421a0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x43d586
movzx ecx, byte [rsp + 0x3f]
test cl, cl
je 0x43d445
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe4], 1
mov edx, 1
lea rsi, [0x00705bbc]
lock xadd dword [rsi], edx
nop
jmp 0x43cdee
mov rcx, qword [rsp + 0xc8]
jmp 0x43cdee
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
nop
nop
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x43d47d
mov rcx, qword [rax + 0xa0]
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x68]
call fcn.0043e020
mov rax, qword [rsp + 0xd8]
mov ebx, 4
mov ecx, 1
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x43d4b6
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
call fcn.00454ae0
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd0], rbx
call fcn.004421a0
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe4], 1
mov ecx, 1
lea rdx, [0x00705bbc]
lock xadd dword [rdx], ecx
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 0x1228], 3
mov rax, qword [rsp + 0xd0]
mov ebx, 4
mov ecx, 1
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x43d56c
mov rax, qword [rsp + 0xd0]
xor ebx, ebx
call fcn.00454ae0
mov rax, qword [rsp + 0xd0]
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
nop
nop
mov qword [rsp + 0xd8], rcx
test rcx, rcx
je 0x43d5a1
mov rdx, qword [rcx + 0xa0]
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x60]
call fcn.0043e020
mov rax, qword [rsp + 0xd8]
mov ebx, 4
mov ecx, 1
nop dword [rax]
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x43d5dd
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
call fcn.00454ae0
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
lea rax, [rsp + 0x60]
nop dword [rax]
call fcn.0043e020
jmp 0x43d640
test rax, rax
je 0x43d619
mov edx, dword [0x00759040]
test edx, edx
setne dl
jmp 0x43d61b
xor edx, edx
test dl, dl
je 0x43d640
mov rdx, qword [0x00705b70]
test rdx, rdx
je 0x43d630
cmp rdx, rax
jle 0x43d640
call fcn.0042f800
mov rcx, qword [rsp + 0xc8]
nop dword [rax]
call fcn.0043c0c0
jmp 0x43cdee
xor ebx, ebx
call fcn.00443c20
mov qword [rsp + 0xa8], rax
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rax, qword [rsp + 0xa8]
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
lea rax, [0x005b484a]
mov ebx, 0x23
call fcn.00435b40
lea rax, [0x005b241d]
mov ebx, 0x1c
nop
call fcn.00435b40
lea rax, [0x005b3e47]
mov ebx, 0x21
call fcn.00435b40
lea rax, [0x005af9e5]
mov ebx, 0x15
call fcn.00435b40
mov rsi, qword [0x00759110]
test rsi, rsi
je 0x43d6f9
mov rax, rsi
sar rsi, 0x13
shl rsi, 3
nop
mov r8, qword [rsi]
lea r9, [0x00759110]
lock cmpxchg qword [r9], r8
sete r8b
test r8b, r8b
je 0x43d6c7
jmp 0x43d702
lea r9, [0x00759110]
xor esi, esi
test rsi, rsi
je 0x43d08c
mov qword [rdx + 0x1228], 3
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0xd8], rax
mov ebx, 4
mov ecx, 1
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x43d749
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
call fcn.00454ae0
mov rax, qword [rsp + 0xd8]
xor ebx, ebx
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
call fcn.0045fba0
jmp fcn.0043cdc0