Function at 0x464320
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x130]
cmp r12, qword [r14 + 0x10]
jbe 0x44bca8
sub rsp, 0x1b0
mov qword [rsp + 0x1a8], rbp
lea rbp, [rsp + 0x1a8]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x18]
mov rsi, rdx
cmp qword [rdx + 0x10], 0xfffffffffffffb2e
nop dword [rax]
je 0x44bc96
mov qword [rsp + 0xb8], r14
mov rax, qword [rcx + 0x90]
mov qword [rsp + 0xf8], rax
nop dword [rax]
cmp rdx, rax
jne 0x44bb52
cmp byte [rax + 0xb7], 0
jne 0x44b81e
mov rdx, qword [rcx + 8]
mov qword [rsp + 0x100], rdx
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x108], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rsp + 0x118], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rsp + 0x128], xmm0
mov rcx, qword [r14 + 0x30]
mov qword [rcx + 0x10], 0
mov rcx, qword [r14 + 0x30]
mov qword [rcx + 0x30], 0
mov rcx, qword [r14 + 0x30]
mov qword [rcx + 8], 0
mov rcx, qword [r14 + 0x30]
mov qword [rcx + 0x18], 0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
cmp rcx, 0xfffffffffffffade
jne 0x44b1f8
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xd8], 0
jne 0x44b1b9
cmp dword [rdx + 0xc0], 0
nop
jne 0x44b1b9
cmp qword [rdx + 0xd0], 0
jne 0x44b1b9
mov rdx, qword [rdx + 0xa0]
cmp dword [rdx + 4], 1
je 0x44b1f8
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
lea rcx, [rax + 0x38]
mov qword [rsp], rcx
call fcn.0045f9c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rax]
nop dword [rax + rax]
test rdx, rdx
je 0x44b80d
mov rsi, qword [rax + 0x38]
lea rdi, [rsi - 8]
mov qword [rsp + 0x30], rdi
cmp rdx, rdi
jbe 0x44b3f0
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xa0], rsi
mov rcx, qword [rax + 8]
mov qword [rsp + 0x98], rcx
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x90], rdx
mov rbx, qword [rsp + 0x100]
mov qword [rsp + 0x88], rbx
mov rsi, qword [rsp + 0x128]
mov qword [rsp + 0x80], rsi
mov rdi, qword [rax + 0x40]
mov qword [rsp + 0x78], rdi
mov r8, qword [rax + 0x60]
mov qword [rsp + 0x70], r8
mov r9, qword [rax + 0x50]
mov qword [rsp + 0xf0], r9
call fcn.004372e0
lea rax, [0x005afb35]
mov ebx, 0x15
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
lea rax, [0x005abced]
mov ebx, 8
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
call fcn.00437a40
lea rax, [0x005ab075]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x98]
call fcn.00437a40
lea rax, [0x005ad952]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x90]
nop
call fcn.00437a40
lea rax, [0x005ab2f5]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0x88]
nop
call fcn.00437a40
lea rax, [0x005ab2e5]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0x80]
nop
call fcn.00437a40
lea rax, [0x005ad3db]
mov ebx, 0xd
call fcn.00437be0
mov rax, qword [rsp + 0x78]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ab2f5]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0xa0]
nop
call fcn.00437a40
lea rax, [0x005ab2e5]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ab70b]
mov ebx, 6
call fcn.00437be0
mov rax, qword [rsp + 0xf0]
nop
call fcn.00437b60
lea rax, [0x005ab11f]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x30]
cmp qword [rax], rdi
ja 0x44b707
nop dword [rax]
cmp rcx, 0xfffffffffffffade
jne 0x44b482
mov rdx, qword [rsp + 0xb8]
mov rdx, qword [rdx + 0x30]
cmp qword [rdx], rax
je 0x44b6f6
cmp qword [rdx + 0xa0], 0
jne 0x44b435
cmp dword [rdx + 0xd8], 0
je 0x44b6e5
cmp byte [rax + 0xb3], 0
je 0x44b45f
mov byte [rax + 0xb3], 0
call fcn.0044bd60
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x30]
cmp byte [rax + 0xb2], 0
je 0x44b475
call fcn.0043eee0
mov rax, qword [rsp + 0xf8]
call fcn.0043ee60
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x40]
mov rax, rdx
call fcn.0044f6a0
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
shl rcx, 1
test rax, rax
je 0x44b4d8
mov qword [rsp + 0x68], rcx
call fcn.00450340
movsxd rcx, eax
add rcx, 0x13a0
mov rax, qword [rsp + 0xf8]
mov rdx, qword [rax + 8]
sub rdx, qword [rax + 0x38]
mov rsi, qword [rsp + 0x68]
jmp 0x44b6cb
mov rsi, qword [rsp + 0xb0]
cmp rsi, 0xfffffffffffffeed
cmove rcx, rdx
mov rdx, qword [0x006e1338]
cmp rdx, rcx
jb 0x44b58b
nop dword [rax + rax]
cmp qword [0x006e1330], rcx
jb 0x44b58b
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0xf8]
mov ebx, 2
mov ecx, 8
call fcn.00439ea0
mov rax, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x50]
call fcn.0044acc0
mov rax, qword [rsp + 0xf8]
mov ebx, 8
mov ecx, 2
call fcn.00439ea0
mov rdx, qword [rsp + 0xf8]
add rdx, 0x38
mov qword [rsp], rdx
call fcn.0045f9c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x1a8]
add rsp, 0x1b0
ret
cmp qword [0x006e1330], rdx
jbe 0x44b67b
call fcn.004372e0
lea rax, [0x005b4099]
mov ebx, 0x21
call fcn.00437be0
mov rax, qword [0x006e1338]
call fcn.004378e0
lea rax, [0x005accbd]
mov ebx, 0xc
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rax]
mov qword [rsp + 0xa8], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xa0], rax
call fcn.004372e0
lea rax, [0x005acfc9]
mov ebx, 0xc
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
lea rax, [0x005abced]
mov ebx, 8
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
call fcn.00437a40
lea rax, [0x005ab075]
mov ebx, 2
nop
call fcn.00437be0
mov rax, qword [rsp + 0xa0]
call fcn.00437a40
lea rax, [0x005ab0db]
mov ebx, 2
nop
call fcn.00437be0
call fcn.00437360
lea rax, [0x005ad6ce]
mov ebx, 0xe
call fcn.00435b40
nop dword [rax + rax]
call fcn.004372e0
lea rax, [0x005b4099]
mov ebx, 0x21
call fcn.00437be0
mov rax, qword [0x006e1330]
nop dword [rax]
call fcn.004378e0
lea rax, [0x005accbd]
mov ebx, 0xc
call fcn.00437be0
call fcn.00437360
nop dword [rax + rax]
jmp 0x44b5d0
shl rdi, 1
mov rsi, rdi
mov rdi, rsi
sub rsi, rdx
cmp rsi, rcx
jb 0x44b6c5
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
nop
jmp 0x44b4d8
lea rax, [0x005b45b9]
mov ebx, 0x22
call fcn.00435b40
lea rax, [0x005aef15]
mov ebx, 0x13
call fcn.00435b40
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x2c], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x60], rdx
nop dword [rax]
call fcn.004372e0
lea rax, [0x005acfbd]
mov ebx, 0xc
call fcn.00437be0
mov rax, qword [rsp + 0xf8]
nop
call fcn.00437b60
lea rax, [0x005ab9ec]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005ad151]
mov ebx, 0xd
call fcn.00437be0
mov eax, dword [rsp + 0x2c]
mov eax, eax
nop dword [rax]
call fcn.00437a40
lea rax, [0x005ab0d3]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
call fcn.004372e0
lea rax, [0x005b361f]
mov ebx, 0x1f
nop
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
lea rax, [0x005ab138]
mov ebx, 3
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005b2c2c]
mov ebx, 0x1d
call fcn.00435b40
lea rax, [0x005b12ee]
mov ebx, 0x19
call fcn.00435b40
mov rdx, qword [rcx + 8]
mov qword [rsp + 0x138], rdx
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rsp + 0x150], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rsp + 0x160], xmm0
mov rcx, qword [rsp + 0x138]
mov qword [rax + 0x70], rcx
mov rcx, qword [rsp + 0x140]
mov qword [rax + 0x78], rcx
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.0044f6a0
test rax, rax
jne 0x44baf6
mov eax, 9
lea rcx, [0x005ac0d1]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0xf8]
mov rsi, qword [rbx]
mov qword [rsp + 0xa8], rsi
mov rdi, qword [rbx + 8]
mov qword [rsp + 0xa0], rdi
mov r8, qword [rsp + 0x140]
mov qword [rsp + 0x98], r8
mov r9, qword [rsp + 0x138]
mov qword [rsp + 0x90], r9
mov r10, qword [rsp + 0x160]
mov qword [rsp + 0x88], r10
mov r11, qword [rbx + 0x40]
mov qword [rsp + 0x80], r11
mov r12, qword [rbx + 0x38]
mov qword [rsp + 0x78], r12
mov r13, qword [rbx + 0x60]
mov qword [rsp + 0x70], r13
mov r15, qword [rbx + 0x50]
mov qword [rsp + 0xf0], r15
call fcn.004372e0
lea rax, [0x005afb20]
mov ebx, 0x15
call fcn.00437be0
mov rax, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x40]
call fcn.00437be0
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.00437a40
lea rax, [0x005ab2f9]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.00437a40
lea rax, [0x005abced]
mov ebx, 8
nop
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
call fcn.00437a40
lea rax, [0x005ab075]
mov ebx, 2
nop
call fcn.00437be0
mov rax, qword [rsp + 0xa0]
call fcn.00437a40
lea rax, [0x005ad952]
mov ebx, 0xf
nop
call fcn.00437be0
mov rax, qword [rsp + 0x98]
call fcn.00437a40
lea rax, [0x005ab2f5]
mov ebx, 4
nop
call fcn.00437be0
mov rax, qword [rsp + 0x90]
call fcn.00437a40
lea rax, [0x005ab2e5]
mov ebx, 4
nop
call fcn.00437be0
mov rax, qword [rsp + 0x88]
call fcn.00437a40
lea rax, [0x005ad3db]
mov ebx, 0xd
nop
call fcn.00437be0
mov rax, qword [rsp + 0x80]
call fcn.00437a40
lea rax, [0x005ab2f5]
mov ebx, 4
nop
call fcn.00437be0
mov rax, qword [rsp + 0x78]
call fcn.00437a40
lea rax, [0x005ab2e5]
mov ebx, 4
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x70]
call fcn.00437a40
lea rax, [0x005ab70b]
mov ebx, 6
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0xf0]
call fcn.00437b60
lea rax, [0x005ab11f]
mov ebx, 2
nop
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
mov rax, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x160]
mov rdi, qword [rsp + 0xf8]
xor esi, esi
nop
call fcn.004577a0
lea rax, [0x005b3ad9]
mov ebx, 0x20
call fcn.00435b40
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], rax
call fcn.0044fe20
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0xe0]
mov ecx, dword [rcx]
mov rax, qword [rsp + 0xe8]
mov ebx, ecx
call fcn.0044f1c0
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rcx + 0x40]
sub rdx, rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xc0]
jmp 0x44b889
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx]
mov qword [rsp + 0xd0], rax
mov rdx, qword [rcx + 0x50]
mov qword [rsp + 0xc8], rdx
call fcn.004372e0
lea rax, [0x005b3a79]
mov ebx, 0x20
call fcn.00437be0
mov rax, qword [rsp + 0x58]
call fcn.00437a40
lea rax, [0x005ab3ad]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0xd8]
call fcn.00437b60
lea rax, [0x005ac06e]
mov ebx, 9
call fcn.00437be0
mov rax, qword [rsp + 0xf8]
call fcn.00437b60
lea rax, [0x005ab9ad]
mov ebx, 7
nop
call fcn.00437be0
mov rax, qword [rsp + 0xd0]
call fcn.00437b60
lea rax, [0x005acc15]
mov ebx, 0xc
nop
call fcn.00437be0
mov rax, qword [rsp + 0xc8]
call fcn.00437b60
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x30]
test byte [rax], al
mov rcx, qword [rax + 8]
mov qword [rsp + 0x170], rcx
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x178], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x188], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rsp + 0x198], xmm0
mov rax, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0x180]
xor esi, esi
nop dword [rax]
call fcn.004577a0
lea rax, [0x005b4eae]
mov ebx, 0x24
call fcn.00435b40
lea rax, [0x005b099e]
mov ebx, 0x17
call fcn.00435b40
nop
call fcn.0045fba0
jmp 0x44b0a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x44b0a0