Function at 0x41b580
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b9de
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
cmp dword [0x00759524], 0
nop
jle 0x41b5b1
mov qword [rsp + 0x78], rax
call fcn.0042d2c0
mov rax, qword [rsp + 0x78]
cmp dword [0x00759034], 2
jne 0x41b9cc
mov qword [0x00705658], rax
mov rcx, qword [0x007055c0]
mov qword [rsp + 0x50], rcx
test rcx, rcx
jne 0x41b885
mov edx, dword [0x00705648]
cmp dword [0x0070564c], edx
ja 0x41b885
cmp dword [0x007594ec], 0
jle 0x41b5fa
call fcn.0041c260
cmp qword [0x007055c0], 0
jne 0x41b86f
movups xmmword [0x007056a8], xmm15
cmp dword [0x007592a0], 0
jne 0x41b626
mov qword [0x007056a0], 0
jmp 0x41b634
lea rdi, [0x007056a0]
xor ecx, ecx
call fcn.00461ee0
mov rcx, qword [0x00704f30]
mov qword [rsp + 0x60], rcx
mov rdx, qword [0x00704f38]
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x41b66f
lea rax, [rcx + 0x1238]
call fcn.00424e80
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
cmp rax, rdx
jge 0x41b6cf
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + rax*8]
mov qword [rsp + 0x58], rbx
cmp dword [0x007594ec], 0
jle 0x41b695
mov rax, rbx
call fcn.0042eac0
jmp 0x41b6a5
test byte [rbx], al
lea rax, [rbx + 0x1260]
nop
call fcn.0042e940
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
mov rdx, qword [rcx + 0x1238]
test rdx, rdx
je 0x41b650
cmp qword [rdx + 0x10], 0
jne 0x41b71f
mov rdx, qword [rcx + 0x1240]
cmp qword [rdx + 0x10], 0
je 0x41b650
jmp 0x41b71f
mov rcx, qword [0x00704f30]
mov rdx, qword [0x00704f38]
xor eax, eax
nop
jmp 0x41b6e5
inc rax
cmp rax, rdx
jge 0x41b702
mov rsi, qword [rcx + rax*8]
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x41b6e2
mov qword [rsi + 8], 0
nop
jmp 0x41b6e2
mov rbx, qword [0x00705640]
lea rax, [0x007599c0]
call fcn.004205a0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
nop
call fcn.004372e0
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax]
mov qword [rsp + 0x38], rcx
movzx edx, byte [rax + 0x1258]
mov byte [rsp + 0x17], dl
nop dword [rax]
call fcn.004372e0
lea rax, [0x005acb3d]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ad0a8]
mov ebx, 0xd
call fcn.00437be0
movzx eax, byte [rsp + 0x17]
nop dword [rax + rax]
call fcn.00437580
call fcn.00437360
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x1238]
test rcx, rcx
je 0x41b84c
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x48], rax
call fcn.004372e0
lea rax, [0x005ac0bf]
mov ebx, 9
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004379e0
call fcn.00437360
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x1240]
test rax, rax
je 0x41b82c
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x48], rax
call fcn.004372e0
lea rax, [0x005ac0c8]
mov ebx, 9
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004379e0
call fcn.00437360
call fcn.004372e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b7428]
mov ebx, 0x2f
call fcn.00435b40
call fcn.004372e0
lea rax, [0x005acc99]
mov ebx, 0xc
nop dword [rax]
call fcn.00437be0
call fcn.00437360
jmp 0x41b80c
call fcn.004372e0
lea rax, [0x005acc8d]
mov ebx, 0xc
nop dword [rax]
call fcn.00437be0
call fcn.00437360
jmp 0x41b7cd
lea rax, [0x005ad7a0]
mov ebx, 0xe
nop dword [rax + rax]
call fcn.00435b40
mov eax, dword [0x00705648]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x0070564c]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x00705668]
mov qword [rsp + 0x48], rdx
mov rbx, qword [0x00705670]
mov qword [rsp + 0x40], rbx
mov rsi, qword [0x00705678]
mov qword [rsp + 0x20], rsi
mov rdi, qword [0x00705680]
mov qword [rsp + 0x18], rdi
call fcn.004372e0
lea rax, [0x005ad6a4]
mov ebx, 0xe
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x50]
call fcn.00437a40
lea rax, [0x005ab741]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
lea rax, [0x005ab723]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.004378e0
lea rax, [0x005acc21]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004379e0
lea rax, [0x005ac7ac]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.004379e0
lea rax, [0x005acc2d]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.004379e0
lea rax, [0x005ad0dc]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.004379e0
call fcn.00437540
call fcn.00437360
lea rax, [0x00579660]
lea rbx, [0x005f6b50]
call fcn.004353c0
lea rax, [0x005b861a]
mov ebx, 0x38
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.0041b580