Function at 0x436540
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x436a7d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
test rdx, rdx
je 0x436577
mov edx, dword [rdx + 0x90]
cmp edx, 2
je 0x436a6b
mov qword [rsp + 0x78], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x4365ac
mov r9, qword [rsp + 0x40]
lea rdi, [r9 + 1]
mov rax, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
movzx ecx, byte [rsp + 0x16]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x16], cl
mov qword [rsp + 0x40], rdi
mov r9d, dword [rax + 0x90]
cmp r9d, 4
ja 0x436780
nop dword [rax]
cmp r9d, 1
je 0x4367f2
cmp r9d, 2
jne 0x436770
cmp byte [rax + 0xb2], 0
je 0x436635
cmp byte [rax + 0xb1], 0
je 0x436630
cmp qword [rax + 0x10], 0xfffffffffffffade
jne 0x43662b
cmp qword [rax + 0x30], rdx
jne 0x436626
mov r9d, dword [rdx + 0x300]
cmp r9d, ebx
sete r9b
jmp 0x436640
xor r9d, r9d
jmp 0x436640
xor r9d, r9d
jmp 0x436640
xor r9d, r9d
jmp 0x436640
xor r9d, r9d
nop dword [rax + rax]
test r9b, r9b
jne 0x436830
mov ebx, 2
mov ecx, 0x1002
call fcn.00439dc0
nop dword [rax + rax]
test al, al
je 0x436749
mov rax, qword [rsp + 0x78]
mov word [rax + 0xb1], 0x101
mov qword [rax + 0x10], 0xfffffffffffffade
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x60], rdx
mov esi, dword [rdx + 0x300]
mov dword [rsp + 0x24], esi
mov rdi, qword [rsp + 0x50]
cmp rdi, rdx
je 0x4366a2
mov edi, 1
jmp 0x4366ac
mov edi, dword [rsp + 0x20]
cmp esi, edi
setne dil
mov byte [rsp + 0x17], dil
mov ebx, 0x1002
mov ecx, 2
nop dword [rax + rax]
call fcn.00439a00
cmp dword [0x00759518], 0
jne 0x43671f
movzx eax, byte [rsp + 0x17]
test al, al
je 0x43671f
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
cmp rcx, rax
jg 0x436724
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
call fcn.004332c0
mov rcx, qword [rsp + 0x28]
lea rsi, [rcx + 0x1388]
mov rcx, rsi
jmp 0x436724
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x24]
mov rsi, rcx
movzx ecx, byte [rsp + 0x16]
jmp 0x436830
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
jmp 0x436830
cmp r9d, 3
jb 0x43679a
jmp 0x4367f2
cmp r9d, 6
je 0x43693f
cmp r9d, 8
je 0x436830
cmp r9d, 9
je 0x4367ab
bt r9d, 0xc
nop
jb 0x436830
jmp 0x436952
mov ebx, 9
mov ecx, 4
call fcn.0043a380
test al, al
jne 0x4367e2
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
jmp 0x436830
mov rax, qword [rsp + 0x78]
mov r9d, 4
mov ecx, 1
mov byte [rsp + 0x16], cl
mov ebx, r9d
bts r9d, 0xc
mov ecx, r9d
call fcn.00439dc0
test al, al
jne 0x436912
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x16]
mov rdx, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x16], cl
test rdi, rdi
jne 0x43686b
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
lea r8, [rax + 0x2710]
mov qword [rsp + 0x30], r8
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jge 0x4368c5
mov dword [rsp], 0xa
nop dword [rax + rax]
call fcn.00461980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov r8, qword [rsp + 0x30]
nop
jmp 0x43658b
lea rax, [0x005c5e60]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
lea r8, [rax + 0x1388]
jmp 0x43658b
mov rax, qword [rsp + 0x78]
mov word [rax + 0xb1], 0
mov rdx, qword [rax]
add rdx, 0x13a0
mov qword [rax + 0x10], rdx
xor ebx, ebx
movzx ecx, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov ebx, 1
xor ecx, ecx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
nop
mov qword [rsp + 0x58], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x1c], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x48], rdx
call fcn.004372e0
lea rax, [0x005adf5f]
mov ebx, 0x10
nop
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004379e0
lea rax, [0x005ae997]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00437be0
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x48], rdx
call fcn.004372e0
lea rax, [0x005adf2f]
mov ebx, 0x10
call fcn.00437be0
mov rax, qword [rsp + 0x58]
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004379e0
lea rax, [0x005ae984]
mov ebx, 0x13
nop dword [rax]
call fcn.00437be0
mov eax, dword [rsp + 0x18]
mov eax, eax
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ade6f]
mov ebx, 0x10
call fcn.00435b40
lea rax, [0x005b5a45]
mov ebx, 0x27
call fcn.00435b40
nop
mov qword [rsp + 8], rax
call fcn.00464340
mov rax, qword [rsp + 8]
jmp fcn.00436540