Function at 0x424520
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x424806
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
call fcn.004372e0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x68]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x30], rdx
nop
call fcn.004372e0
lea rax, [0x005b4e1e]
mov ebx, 0x24
call fcn.00437be0
mov rax, qword [rsp + 0x80]
nop
call fcn.00437ba0
lea rax, [0x005ac7f9]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005ac76a]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.004378e0
lea rax, [0x005b7006]
mov ebx, 0x2e
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov rcx, qword [rax + 0x48]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], 1
mov qword [rsp + 0x68], 0
xor ecx, ecx
jmp 0x42462b
inc qword [rsp + 0x68]
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x38], rcx
jbe 0x4247f0
mov qword [rsp + 0x20], rcx
mov rdx, qword [rax + 0x68]
imul rdx, rcx
add rdx, qword [rax + 0x18]
mov qword [rsp + 0x28], rdx
call fcn.004372e0
mov rax, qword [rsp + 0x28]
call fcn.00437a40
call fcn.00437360
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
cmp qword [rcx + 0x30], rax
jbe 0x424679
mov edx, 1
jmp 0x42468b
mov rdx, qword [rsp + 0x58]
movzx ebx, byte [rsp + 0x60]
movzx edx, byte [rdx]
test dl, bl
setne dl
mov byte [rsp + 0x1f], dl
test dl, dl
je 0x4246b0
call fcn.004372e0
lea rax, [0x005ab6f9]
mov ebx, 6
call fcn.00437be0
call fcn.00437360
jmp 0x4246cb
call fcn.004372e0
lea rax, [0x005ab717]
mov ebx, 6
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rax]
test al, cl
je 0x424700
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ac077]
mov ebx, 9
call fcn.00437be0
call fcn.00437360
jmp 0x42471b
call fcn.004372e0
lea rax, [0x005ac0b6]
mov ebx, 9
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rax]
test al, cl
je 0x424736
movzx eax, byte [rsp + 0x1f]
xor eax, 1
jmp 0x424738
xor eax, eax
mov byte [rsp + 0x1e], al
nop dword [rax]
test al, al
je 0x424760
call fcn.004372e0
lea rax, [0x005ab9de]
mov ebx, 7
call fcn.00437be0
call fcn.00437360
nop
call fcn.004372e0
call fcn.00437540
call fcn.00437360
movzx eax, byte [rsp + 0x1e]
test al, al
je 0x4247a5
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + 0x68]
cmp rsi, 0x400
mov edi, 0x400
cmova rsi, rdi
mov rax, qword [rsp + 0x28]
lea rbx, [rsi + rax]
xor ecx, ecx
nop
call fcn.00437d40
nop
movzx ecx, byte [rsp + 0x48]
cmp cl, 0x80
jne 0x4247bc
inc qword [rsp + 0x40]
mov byte [rsp + 0x48], 1
jmp 0x4247c2
shl ecx, 1
mov byte [rsp + 0x48], cl
inc qword [rsp + 0x50]
nop
movzx ecx, byte [rsp + 0x60]
cmp cl, 0x80
jne 0x4247e5
inc qword [rsp + 0x58]
mov byte [rsp + 0x60], 1
nop dword [rax]
jmp 0x424615
shl ecx, 1
mov byte [rsp + 0x60], cl
jmp 0x424615
lea rax, [0x005b2439]
mov ebx, 0x1c
nop dword [rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.00424520