Function at 0x42c320
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42c5cd
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x48], rbx
cmp qword [0x00703fb8], 0
jne 0x42c3b2
mov byte [rsp + 0x68], r8b
mov eax, 0x15f8f8
lea rbx, [0x0075ade0]
call fcn.00417420
cmp dword [0x007592a0], 0
jne 0x42c37e
mov qword [0x00703fb8], rax
jmp 0x42c38a
lea rdi, [0x00703fb8]
call fcn.00461de0
cmp qword [0x00703fb8], 0
je 0x42c5bb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
movzx r8d, byte [rsp + 0x68]
xor edx, edx
xor esi, esi
jmp 0x42c3d7
mov r9, qword [rcx + rdx*8]
inc rdx
add r9, rsi
mov r10, r9
shl r9, 0xa
lea rsi, [r10 + r9]
mov r9, rsi
shr rsi, 6
xor rsi, r9
cmp rdi, rdx
jg 0x42c3b8
mov r9, qword [0x00703fb8]
test byte [r9], al
add rsi, rbx
mov r10, rsi
shl rsi, 0xa
add rsi, r10
mov r10, rsi
shr rsi, 6
xor r10, rsi
lea rsi, [r10 + r10*8]
mov r10, rsi
shr rsi, 0xb
xor r10, rsi
mov rdx, rax
movabs rax, 0xba6a1fbc53191a92
mov rsi, rdx
mul r10
shr rdx, 0x11
imul r11, rdx, 0x2bf1f
mov rax, r10
sub rax, r11
cmp rax, 0x2bf1f
jae 0x42c5b1
mov r9, qword [r9 + rax*8]
nop
jmp 0x42c445
mov r9, qword [r9]
test r9, r9
je 0x42c480
cmp qword [r9 + 0x10], rsi
jne 0x42c442
cmp qword [r9 + 0x18], r10
jne 0x42c442
cmp qword [r9 + 0x20], rbx
jne 0x42c442
mov rdx, qword [r9 + 0x28]
cmp rdx, 0x20
ja 0x42c5a7
cmp rdi, rdx
jne 0x42c442
xor r11d, r11d
jmp 0x42c582
test r8b, r8b
je 0x42c569
mov qword [rsp + 0x18], r10
mov qword [rsp + 0x28], rax
mov rax, rsi
mov rbx, rdi
call fcn.0042c1a0
nop
mov rdx, qword [rax + 0x28]
cmp rdx, 0x20
ja 0x42c575
mov rsi, qword [rsp + 0x58]
cmp rsi, rdx
cmovl rdx, rsi
lea rsi, [rax + 0x30]
mov rbx, qword [rsp + 0x50]
cmp rbx, rsi
je 0x42c4e0
mov qword [rsp + 0x20], rax
shl rdx, 3
mov rax, rsi
mov rcx, rdx
call fcn.00462be0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x20], rcx
mov rcx, qword [0x00703fb8]
test byte [rcx], al
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rcx + rdx*8]
mov qword [rax], rcx
mov rcx, qword [0x00703fb8]
test byte [rcx], al
mov qword [rcx + rdx*8], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, 1
jne 0x42c533
mov rcx, qword [0x00759130]
mov qword [rax + 8], rcx
mov qword [0x00759130], rax
jmp 0x42c55f
cmp rcx, 3
jne 0x42c54d
mov rcx, qword [0x007591f8]
mov qword [rax + 8], rcx
mov qword [0x007591f8], rax
jmp 0x42c55f
mov rcx, qword [0x007590a8]
mov qword [rax + 8], rcx
mov qword [0x007590a8], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ebx, 0x20
call fcn.004623a0
inc r11
cmp r11, rdx
jge 0x42c59a
mov r12, qword [r9 + r11*8 + 0x30]
mov r13, qword [rcx + r11*8]
cmp r13, r12
je 0x42c57f
jmp 0x42c442
mov rax, r9
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov ebx, 0x20
call fcn.004623a0
mov ecx, 0x2bf1f
call fcn.00462280
lea rax, [0x005b35e1]
mov ebx, 0x1f
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], r8b
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx r8d, byte [rsp + 0x30]
jmp fcn.0042c320