Function at 0x42f900
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x800]
cmp r12, qword [r14 + 0x10]
jbe 0x42fc71
sub rsp, 0x880
mov qword [rsp + 0x878], rbp
lea rbp, [rsp + 0x878]
lea rdi, [rsp + 0x78]
mov ecx, 0x100
mov rdx, rax
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rbx, qword [r14 + 0x30]
cmp qword [0x006e1310], 0xffffffffffffffff
je 0x42fadc
test rdx, rdx
jge 0x42f97d
mov rcx, rdx
mov edx, 0xffffffff
jmp 0x42f9c6
jne 0x42f986
mov rcx, rdx
xor edx, edx
jmp 0x42f9c6
cmp rdx, 0xf4240
jge 0x42f999
mov rcx, rdx
mov edx, 1
jmp 0x42f9c6
movabs rcx, 0x38d7ea4c68000
cmp rdx, rcx
jge 0x42f9be
movabs rax, 0x431bde82d7b634db
mov rcx, rdx
imul rdx
sar rdx, 0x12
jmp 0x42f9c6
mov rcx, rdx
mov edx, 0x3b9aca00
movsxd rsi, dword [0x00759038]
test rsi, rsi
je 0x42fc6b
mov eax, 0x40
mov edi, edx
nop dword [rax]
cmp rsi, 0xffffffffffffffff
je 0x42f9ed
cqo
idiv rsi
jmp 0x42f9f2
neg rax
xor edx, edx
mov dword [rsp + 0x48], eax
cmp eax, 8
jae 0x42fa08
mov dword [rsp + 0x48], 8
test rcx, rcx
jmp 0x42fa0b
test rcx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rbx
je 0x42fa1e
mov byte [rbx + 0xe5], 1
mov rax, qword [0x006e1310]
mov rcx, qword [0x006e1100]
lea rdx, [rsp + 0x78]
mov ebx, dword [rsp + 0x48]
lea rsi, [rsp + 0x48]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov eax, edi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
call fcn.00432f60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x38], 0
je 0x42fa9b
mov rdx, qword [rsp + 0x70]
mov byte [rdx + 0xe5], 0
mov rdx, qword [rsp + 0x60]
xor eax, eax
jmp 0x42fb40
mov rax, qword [rsp + 0x70]
mov byte [rax + 0xe5], 0
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
cmp eax, 0x102
jne 0x42faee
xor eax, eax
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
xor eax, eax
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
mov dword [rsp + 0x54], eax
call fcn.004372e0
lea rax, [0x005b8067]
mov ebx, 0x34
call fcn.00437be0
mov eax, dword [rsp + 0x54]
movsxd rax, eax
call fcn.004379e0
lea rax, [0x005ab12f]
mov ebx, 3
call fcn.00437be0
call fcn.00437360
lea rax, [0x005b08fd]
mov ebx, 0x17
call fcn.00435b40
lea eax, [rbx + 1]
nop
cmp dword [rsp + 0x48], eax
jbe 0x42fc4c
cmp rax, 0x40
jae 0x42fc61
mov dword [rsp + 0x4c], eax
mov ebx, eax
shl rax, 5
mov rsi, qword [rsp + rax + 0x80]
test rsi, rsi
jne 0x42fb97
xor esi, esi
lea rdi, [0x00759048]
xchg dword [rdi], esi
test rdx, rdx
jne 0x42fb3b
nop dword [rax + rax]
call fcn.0042f800
mov rdx, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x4c]
lea rdi, [0x00759048]
jmp 0x42fb3b
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x44], 0
mov rax, qword [rsi + 0x20]
mov rcx, qword [0x00703f80]
mov rax, qword [rax + 8]
lea rbx, [rsp + 0x44]
lea rdi, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rdi
nop
call fcn.00432ee0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x30], 0
nop
je 0x42fc06
xor eax, eax
jmp 0x42fc22
call fcn.00463720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov edi, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x68]
mov ecx, eax
lea rax, [rsp + 0x58]
call fcn.0042fca0
mov rdx, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x4c]
lea rdi, [0x00759048]
jmp 0x42fb3b
mov rax, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
mov ecx, 0x40
call fcn.00462280
call fcn.004340c0
nop
mov qword [rsp + 8], rax
call fcn.0045fba0
mov rax, qword [rsp + 8]
jmp fcn.0042f900