Function at 0x42d860
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42dd7c
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x800000000000
lea rsi, [rbx + rdx]
add rdx, rcx
cmp rdx, rsi
jbe 0x42d897
nop
mov rdi, rcx
sub rcx, rbx
jmp 0x42d89c
mov rdi, rcx
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x42dd0d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x68], rax
nop
call fcn.0042d640
test rax, rax
jle 0x42d902
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsi + 8]
mov rdi, qword [rsi]
lea r8, [rax - 1]
nop word [rax + rax]
cmp rcx, r8
jbe 0x42dd05
shl r8, 4
mov rdi, qword [rdi + r8 + 8]
mov r8, qword [rsp + 0x40]
cmp rdi, r8
sete dil
nop
jmp 0x42d90e
mov rsi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x40]
xor edi, edi
mov rcx, qword [rsi + 8]
mov r9, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rax, rcx
jge 0x42d93f
nop
jae 0x42dd00
mov r10, rax
shl rax, 4
mov r11, qword [r9 + rax]
mov r12, qword [rsp + 0x48]
cmp r11, r12
sete r11b
jmp 0x42d94a
mov r10, rax
mov r12, qword [rsp + 0x48]
xor r11d, r11d
test r11b, r11b
je 0x42da44
test dil, dil
je 0x42da3f
nop dword [rax]
cmp r10, rcx
jae 0x42dcf7
lea rax, [r10 - 1]
mov rdi, r10
shl r10, 4
mov r11, qword [r9 + r10 + 8]
nop dword [rax]
cmp rcx, rax
jbe 0x42dcf2
shl rax, 4
mov qword [r9 + rax + 8], r11
mov rcx, qword [rsi + 8]
mov r9, qword [rsi]
mov r11, qword [rsi + 0x10]
nop dword [rax]
cmp rdi, rcx
ja 0x42dcea
mov r13, rcx
sub rcx, rdi
sub r11, rdi
mov r15, r11
neg r11
sar r11, 0x3f
and r11, r10
lea rax, [r11 + r9]
inc rdi
cmp r13, rdi
jb 0x42dcdf
lea r10, [rcx - 1]
cmp rcx, r10
cmovg rcx, r10
lea r10, [r15 - 1]
neg r10
shl rdi, 4
sar r10, 0x3f
and r10, rdi
lea rbx, [r9 + r10]
cmp rbx, rax
je 0x42da0d
shl rcx, 4
call fcn.00462be0
mov rsi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsi + 8]
lea rcx, [rax - 1]
nop dword [rax]
cmp rdx, rcx
jb 0x42dcda
mov qword [rsi + 8], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jmp 0x42dc71
test r11b, r11b
jmp 0x42da74
test dil, dil
je 0x42da71
lea rax, [r10 - 1]
cmp rcx, rax
jbe 0x42dcd5
shl rax, 4
mov qword [r9 + rax + 8], r12
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jmp 0x42dc71
test r11b, r11b
je 0x42da99
cmp r10, rcx
jae 0x42dccd
shl r10, 4
mov qword [r9 + r10], r8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jmp 0x42dc71
mov qword [rsp + 0x28], r10
lea rdi, [rcx + 1]
cmp rdx, rdi
jl 0x42db3e
jb 0x42dcc5
mov qword [rsi + 8], rdi
mov rdx, qword [rsi]
mov r9, qword [rsi + 0x10]
lea rax, [r10 + 1]
cmp rax, rdi
ja 0x42dcb8
sub rcx, r10
sub r9, r10
lea r11, [r9 - 1]
neg r11
shl rax, 4
sar r11, 0x3f
and r11, rax
lea rax, [rdx + r11]
cmp r10, rdi
ja 0x42dcad
lea rdi, [rcx + 1]
cmp rcx, rdi
cmovg rcx, rdi
neg r9
mov rdi, r10
shl r10, 4
sar r9, 0x3f
and r9, r10
lea rbx, [r9 + rdx]
cmp rbx, rax
je 0x42dc4b
shl rcx, 4
nop dword [rax + rax]
call fcn.00462be0
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
jmp 0x42dc4b
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x50], r9
mov qword [rsi + 8], rdi
mov rax, rdx
shl rdx, 1
mov qword [rsi + 0x10], rdx
shl rax, 5
mov rcx, qword [rsi + 0x20]
mov ebx, 8
call fcn.0040db40
mov rdx, qword [rsp + 0x68]
mov qword [rdx], rax
mov rsi, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x28]
nop
cmp rcx, rsi
ja 0x42dca5
mov rsi, qword [rsp + 0x20]
cmp rcx, rsi
ja 0x42dc9a
mov rbx, qword [rsp + 0x50]
nop dword [rax]
cmp rax, rbx
je 0x42dbc2
shl rcx, 4
call fcn.00462be0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rdx + 8]
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
lea rax, [rcx + 1]
cmp rdi, rax
jb 0x42dc92
sub rdi, rcx
dec rdi
mov r10, qword [rsp + 0x18]
sub r10, rcx
cmp r10, rdi
cmovl rdi, r10
sub r9, rcx
dec r9
neg r9
shl rax, 4
sar r9, 0x3f
and r9, rax
lea rax, [r8 + r9]
mov r8, rcx
sub rcx, rsi
mov rsi, r8
shl r8, 4
sar rcx, 0x3f
and rcx, r8
add rbx, rcx
nop
cmp rbx, rax
je 0x42dc3b
shl rdi, 4
mov rcx, rdi
call fcn.00462be0
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x28]
mov rdi, rsi
mov r8, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, rdx
mov rdx, qword [rsi]
mov rcx, qword [rsi + 8]
cmp rdi, rcx
jae 0x42dc8a
shl rdi, 4
mov qword [rdx + rdi], r8
mov qword [rdx + rdi + 8], r12
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
jbe 0x42dc79
nop
sub r12, r8
jmp 0x42dc7c
xor r12d, r12d
add qword [rsi + 0x18], r12
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rdi
call fcn.00462280
mov rcx, rdi
call fcn.00462340
mov rdx, rsi
nop dword [rax]
call fcn.00462300
mov rdx, rsi
call fcn.00462300
mov rax, r10
mov rcx, rdi
call fcn.00462340
mov rcx, rdi
nop dword [rax + rax]
call fcn.00462340
mov rcx, rdi
call fcn.00462300
mov rax, r10
call fcn.00462280
call fcn.00462280
call fcn.00462300
mov rax, rdi
mov rcx, r13
call fcn.00462340
mov rax, rdi
call fcn.00462340
call fcn.00462280
mov rax, r10
call fcn.00462280
nop
call fcn.00462280
mov rax, r8
call fcn.00462280
call fcn.004372e0
lea rax, [0x005ae897]
mov ebx, 0x12
nop
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.00437a40
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.00437a40
lea rax, [0x005ab11f]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x005b5f47]
mov ebx, 0x29
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.0042d860