Function at 0x44f820
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x44fdd6
sub rsp, 0xc0
mov qword [rsp + 0xb8], rbp
lea rbp, [rsp + 0xb8]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rbx
test ecx, ecx
je 0x44f872
test rsi, rsi
je 0x44f889
nop
mov rdx, rdi
shr rdi, 3
and edi, 1
xor r9d, r9d
jmp 0x44fd8d
mov eax, 0xffffffff
xor ebx, ebx
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
test rax, rax
je 0x44f937
mov rdx, qword [rbx + 0x58]
mov r9, qword [rbx + 0x50]
mov r10, qword [rbx + 0x60]
mov r11d, ecx
cmp rdx, r11
jb 0x44fd7b
mov qword [rsp + 0xe8], rsi
mov byte [rsp + 0xf0], r8b
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x78], r10
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0xd8], ecx
mov qword [rsp + 0xe0], rdi
call fcn.0044f640
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0xffffffff
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
sub rcx, rdx
mov rsi, qword [rsp + 0x70]
sub rsi, rdx
mov rdi, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdx
mov r8, qword [rsp + 0xb0]
add rcx, r8
jmp 0x44f9b6
test r8b, r8b
je 0x44f945
cmp dword [0x00759050], 0
je 0x44f95c
mov eax, 0xffffffff
xor ebx, ebx
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
nop dword [rax]
call fcn.0044f640
mov qword [rsp + 0x68], rax
call fcn.004372e0
lea rax, [0x005b2685]
mov ebx, 0x1c
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x68]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005ad66c]
mov ebx, 0xe
call fcn.00435b40
mov rsi, rbx
mov rdi, rcx
mov rcx, rax
mov rax, rdx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
nop dword [rax]
call fcn.0044f640
cmp qword [rsp + 0x40], rax
sete r8b
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea rdi, [rsp + 0x40]
lea rsi, [rsp + 0x34]
call fcn.004506a0
test dil, dil
je 0x44faec
mov rdx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0xe0]
cmp rsi, rdx
jae 0x44f9aa
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
je 0x44fad3
mov rdi, qword [r14 + 0x30]
movabs rax, 0xa0761d6478bd642f
add rax, qword [rdi + 0xf0]
movabs r8, 0xe7037ed1a0b428db
xor r8, rax
mov rcx, rdx
mov rbx, rax
mul r8
nop
nop
mov qword [rdi + 0xf0], rbx
mov rdi, rsi
shr rsi, 3
and esi, 1
shl rsi, 7
lea r8, [rcx + rsi]
mov r9d, dword [rcx + rsi + 8]
mov r10d, dword [rcx + rsi + 0xc]
mov r11, qword [rcx + rsi]
xor rax, rdx
mov eax, eax
shl rax, 3
shr rax, 0x20
nop dword [rax]
cmp rax, 8
jae 0x44fd71
shl rax, 4
mov qword [r8 + rax], r11
mov dword [r8 + rax + 8], r9d
mov dword [r8 + rax + 0xc], r10d
mov edx, dword [rsp + 0x34]
mov qword [rcx + rsi], rdi
mov edi, dword [rsp + 0xd8]
mov dword [rcx + rsi + 8], edi
mov dword [rcx + rsi + 0xc], edx
mov eax, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
cmp dword [0x00759050], 0
jne 0x44fc70
movzx edx, byte [rsp + 0xf0]
test dl, dl
je 0x44fc70
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
call fcn.0044fe20
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
call fcn.004372e0
lea rax, [0x005b4dd6]
mov ebx, 0x24
call fcn.00437be0
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x78]
call fcn.00437be0
lea rax, [0x005ab2f1]
mov ebx, 4
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x68]
call fcn.00437a40
lea rax, [0x005ac408]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0xe0]
call fcn.00437a40
lea rax, [0x005ab4d3]
mov ebx, 5
nop
call fcn.00437be0
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.00437c60
nop dword [rax]
call fcn.00437540
call fcn.00437360
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbx + 0x58]
mov rdx, qword [rbx + 0x50]
mov rsi, qword [rbx + 0x60]
mov rax, qword [rsp + 0x80]
cmp rcx, rax
jb 0x44fd6c
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0xa8]
call fcn.0044f640
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x34], 0xffffffff
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
sub rcx, rdx
mov rsi, qword [rsp + 0x70]
sub rsi, rdx
mov rdi, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdx
mov rdx, qword [rsp + 0xb0]
add rcx, rdx
jmp 0x44fd01
mov eax, 0xffffffff
xor ebx, ebx
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
call fcn.004372e0
lea rax, [0x005abb89]
mov ebx, 7
call fcn.00437be0
movsxd rax, dword [rsp + 0x34]
nop
call fcn.004379e0
lea rax, [0x005ac41c]
mov ebx, 0xa
call fcn.00437be0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
call fcn.0044f640
cmp qword [rsp + 0x40], rax
sete r8b
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
lea rdi, [rsp + 0x40]
lea rsi, [rsp + 0x34]
call fcn.004506a0
test dil, dil
jne 0x44fc87
lea rax, [0x005b248d]
mov ebx, 0x1c
call fcn.00435b40
call fcn.00462340
mov ecx, 8
call fcn.00462280
mov rax, r11
mov rcx, rdx
call fcn.00462340
lea r9, [r11 + 1]
mov rdi, r10
cmp r9, 8
jge 0x44fdce
mov r10, rdi
shl rdi, 7
add rdi, rsi
mov r11, r9
shl r9, 4
mov r12d, dword [rdi + r9 + 8]
cmp r12d, ecx
jne 0x44fd86
mov r12, qword [rdi + r9]
cmp r12, rdx
jne 0x44fd86
mov eax, dword [rdi + r9 + 0xc]
xor ebx, ebx
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
mov rdi, rdx
jmp 0x44f889
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], r8b
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx r8d, byte [rsp + 0x30]
jmp fcn.0044f820