Function at 0x44e9a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x78]
cmp r12, qword [r14 + 0x10]
jbe 0x44f1a7
sub rsp, 0xf8
mov qword [rsp + 0xf0], rbp
lea rbp, [rsp + 0xf0]
mov rdx, qword [rax]
mov esi, dword [rdx]
mov dword [rsp + 0x1c], esi
cmp esi, 0xfffffff0
jne 0x44f035
cmp byte [rdx + 4], 0
nop dword [rax]
jne 0x44f035
cmp byte [rdx + 5], 0
jne 0x44f035
cmp byte [rdx + 6], 1
jne 0x44f035
cmp byte [rdx + 7], 8
nop
jne 0x44f035
mov rdi, qword [rdx + 0x18]
cmp qword [rax + 0xb0], rdi
jne 0x44f035
mov qword [rsp + 0x100], rax
mov rcx, qword [rax + 0x88]
mov rdx, qword [rax + 0x80]
lea rsi, [rcx - 1]
xor ebx, ebx
jmp 0x44ea40
mov rbx, r8
nop dword [rax + rax]
cmp rbx, rsi
jge 0x44ec29
mov edi, dword [rdx + rbx*8]
lea r8, [rbx + 1]
cmp rcx, r8
jbe 0x44f02d
lea r9, [rdx + rbx*8]
lea r9, [r9 + 8]
cmp dword [r9], edi
jae 0x44ea35
mov rcx, qword [rax + 0x70]
mov rdi, qword [rax + 0x68]
mov r9d, dword [rdx + rbx*8 + 4]
cmp rcx, r9
jbe 0x44f025
add r9, rdi
mov edx, dword [rdx + rbx*8 + 0xc]
cmp rcx, rdx
jbe 0x44f01b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x98], r8
lea rcx, [rdx + rdi]
nop dword [rax]
cmp r8, rsi
jl 0x44eab3
mov ecx, 3
lea rdx, [0x005ab270]
jmp 0x44eadc
mov qword [rsp + 0xc0], r9
mov rbx, rax
mov rax, rcx
call fcn.0044fe20
mov r9, qword [rsp + 0xc0]
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0x48], rcx
mov rbx, rax
mov rax, r9
call fcn.0044fe20
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0x80]
mov rdi, qword [rsp + 0x40]
cmp rdi, rdx
jae 0x44f010
mov r8d, dword [rsi + rdi*8]
mov r9, qword [rsp + 0x98]
cmp rdx, r9
jbe 0x44f005
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xb8], rax
mov eax, dword [rsi + rdi*8 + 8]
mov qword [rsp + 0x88], rax
mov rdx, qword [rcx + 0x198]
mov qword [rsp + 0xb0], rdx
mov rbx, qword [rcx + 0x1a0]
mov qword [rsp + 0x80], rbx
call fcn.004372e0
lea rax, [0x005b74e4]
mov ebx, 0x2f
call fcn.00437be0
mov rax, qword [rsp + 0x90]
call fcn.00437a40
call fcn.00437500
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
call fcn.00437be0
lea rax, [0x005ab13b]
mov ebx, 3
call fcn.00437be0
mov rax, qword [rsp + 0x88]
call fcn.00437a40
call fcn.00437500
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x48]
nop dword [rax]
call fcn.00437be0
lea rax, [0x005ac749]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x80]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
xor edx, edx
jmp 0x44ef74
test rcx, rcx
jbe 0x44eef5
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x98], rcx
mov ebx, dword [rdx]
call fcn.0044f1c0
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0x80]
mov rdi, qword [rsp + 0x20]
cmp rdx, rdi
jbe 0x44eeea
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x98]
mov ebx, dword [rsi + rdx*8 - 8]
mov rax, rcx
nop
call fcn.0044f1c0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rcx + 0xa0]
mov qword [rsp + 0x78], rdx
mov rsi, qword [rsp + 0x28]
cmp rsi, rdx
jne 0x44ee45
cmp qword [rcx + 0xa8], rax
jne 0x44ee45
mov rdx, qword [rcx + 0x1d8]
mov rsi, qword [rcx + 0x1d0]
test rdx, rdx
je 0x44ecd8
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x44ed0a
mov rbp, qword [rsp + 0xf0]
add rsp, 0xf8
ret
mov rdi, qword [rsp + 0xa8]
add rdi, 0x28
mov rcx, qword [rsp + 0x100]
mov rsi, rdi
mov rax, rdx
mov rdx, qword [rsp + 0x98]
mov rdi, qword [rsi]
mov qword [rsp + 0xc8], rdi
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0xd0], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0xe0], xmm0
mov rdi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
mov r9, qword [rsp + 0xd8]
mov rbx, qword [rdi]
cmp qword [rdi + 8], r8
jne 0x44ed8e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], rsi
mov rax, r9
mov rcx, r8
call fcn.00402ec0
test al, al
je 0x44ed8e
mov rdx, qword [rsp + 0x80]
inc rdx
mov rsi, qword [rsp + 0x98]
cmp rsi, rdx
jg 0x44ece8
jmp 0x44ecd8
mov rax, qword [rsp + 0x100]
mov rcx, qword [rax + 0x1c0]
mov qword [rsp + 0xb8], rcx
mov rax, qword [rax + 0x1c8]
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0xb0], rdx
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x80], rbx
call fcn.004372e0
lea rax, [0x005b2ed6]
mov ebx, 0x1e
call fcn.00437be0
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
call fcn.00437be0
lea rax, [0x005ab4ba]
mov ebx, 5
call fcn.00437be0
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x80]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ace01]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00435b40
mov rax, qword [rcx + 0xa8]
mov qword [rsp + 0x70], rax
call fcn.004372e0
lea rax, [0x005abc07]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.00437a40
lea rax, [0x005ab73b]
mov ebx, 6
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
lea rax, [0x005abca5]
mov ebx, 8
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x70]
call fcn.00437a40
lea rax, [0x005ab735]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b007a]
mov ebx, 0x16
call fcn.00435b40
mov rax, rdi
mov rcx, rdx
call fcn.00462280
xor eax, eax
call fcn.00462280
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xb8], rax
mov eax, dword [rsi + rdi*8]
mov qword [rsp + 0x90], rax
call fcn.004372e0
lea rax, [0x005ab0d7]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x90]
call fcn.00437a40
call fcn.00437500
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x38]
lea rdx, [rax + 1]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x100]
cmp rdx, rax
jg 0x44eff4
mov rsi, qword [rcx + 0x70]
mov rdi, qword [rcx + 0x68]
mov r8, qword [rcx + 0x88]
mov r9, qword [rcx + 0x80]
cmp rdx, r8
jae 0x44efe9
mov r8d, dword [r9 + rdx*8 + 4]
cmp rsi, r8
jbe 0x44efde
mov qword [rsp + 0x38], rdx
lea rax, [rdi + r8]
mov rbx, rcx
call fcn.0044fe20
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0x80]
mov rdi, qword [rsp + 0x38]
cmp rdi, rdx
jb 0x44eefc
mov rax, rdi
mov rcx, rdx
call fcn.00462280
mov rax, r8
mov rcx, rsi
call fcn.00462280
mov rax, rdx
mov rcx, r8
call fcn.00462280
lea rax, [0x005b248d]
mov ebx, 0x1c
call fcn.00435b40
mov rax, r9
mov rcx, rdx
call fcn.00462280
mov rax, rdi
mov rcx, rdx
call fcn.00462280
mov rax, rdx
nop
call fcn.00462280
mov rax, r9
call fcn.00462280
mov rax, r8
call fcn.00462280
movzx ecx, byte [rdx + 4]
mov qword [rsp + 0x68], rcx
movzx ebx, byte [rdx + 5]
mov qword [rsp + 0x60], rbx
movzx esi, byte [rdx + 6]
mov qword [rsp + 0x58], rsi
movzx edi, byte [rdx + 7]
mov qword [rsp + 0x50], rdi
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x78], rdx
mov r8, qword [rax + 0xb0]
mov qword [rsp + 0x70], r8
mov r9, qword [rax + 0x198]
mov qword [rsp + 0xb8], r9
mov rax, qword [rax + 0x1a0]
mov qword [rsp + 0x98], rax
call fcn.004372e0
lea rax, [0x005b1a26]
mov ebx, 0x1a
nop dword [rax]
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
call fcn.00437a40
lea rax, [0x005ab9bb]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x68]
call fcn.004378e0
lea rax, [0x005ab9c2]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x60]
nop
call fcn.004378e0
lea rax, [0x005abcb5]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005ac3b8]
mov ebx, 0xa
call fcn.00437be0
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005af673]
mov ebx, 0x15
call fcn.00437be0
mov rax, qword [rsp + 0x78]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ab9d0]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ad0f6]
mov ebx, 0xd
call fcn.00437be0
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b2991]
mov ebx, 0x1d
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.0044e9a0