Function at 0x449ee0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x44a19f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rdx, qword [r14 + 0x30]
mov rsi, r14
nop
cmp qword [rdx], rsi
jne 0x44a18d
lea esi, [rax - 1]
test esi, eax
jne 0x44a17c
cmp dword [0x007594e8], 0
jne 0x449f42
mov dword [rsp + 0x78], eax
cmp eax, 0x8000
jae 0x449f31
mov ecx, eax
xor ebx, ebx
jmp 0x44a080
mov ecx, eax
mov rdx, rcx
shr rcx, 0xd
mov rbx, rcx
xor esi, esi
nop
jmp 0x449fa0
mov rcx, qword [0x00759180]
mov edx, eax
lea rdx, [rcx + rdx]
lea rdx, [rdx - 1]
neg rcx
and rdx, rcx
mov eax, edx
mov qword [rsp + 0x58], rax
lea rbx, [0x0075adb8]
call fcn.00417420
test rax, rax
je 0x449f84
mov rcx, qword [rsp + 0x58]
lea rbx, [rax + rcx]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x005b1970]
mov ebx, 0x1a
call fcn.00435b40
shr rcx, 1
inc rsi
nop dword [rax + rax]
cmp rcx, 1
ja 0x449f95
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rsi
nop
nop
lea rax, [0x00759f40]
nop
call fcn.0040b700
mov rax, qword [rsp + 0x30]
cmp rax, 0x23
jae 0x44a06e
shl rax, 4
lea rcx, [0x00759f48]
mov rbx, qword [rcx + rax]
test rbx, rbx
jne 0x449fec
xor eax, eax
jmp 0x449ffe
mov qword [rsp + 0x48], rbx
add rax, rcx
call fcn.00427640
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
nop
nop
lea rax, [0x00759f40]
call fcn.0040b920
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jne 0x44a042
lea rax, [0x0071b2c0]
mov rbx, qword [rsp + 0x58]
mov ecx, 1
call fcn.00426440
test rax, rax
je 0x44a05d
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x68], rcx
mov rcx, rax
mov rcx, qword [rcx + 0x18]
mov edx, dword [rsp + 0x78]
mov edx, edx
lea rbx, [rcx + rdx]
mov rax, rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x005ad33f]
mov ebx, 0xd
call fcn.00435b40
mov ecx, 0x23
call fcn.00462280
inc ebx
shr eax, 1
nop dword [rax]
cmp eax, 0x2000
ja 0x44a078
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x44a09d
cmp qword [rdx + 0xd0], 0
je 0x44a0f0
movzx eax, bl
cmp rax, 2
jae 0x44a172
mov byte [rsp + 0x1f], bl
shl rax, 6
lea rcx, [0x00759640]
add rax, rcx
mov qword [rsp + 0x60], rax
nop
call fcn.0040b700
movzx eax, byte [rsp + 0x1f]
call fcn.00449840
mov qword [rsp + 0x20], rax
nop
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.0040b920
mov ecx, dword [rsp + 0x78]
mov rsi, qword [rsp + 0x20]
jmp 0x44a15c
mov rax, qword [rsi + 0x40]
test byte [rax], al
movzx edx, bl
cmp rdx, 2
jae 0x44a165
shl rdx, 4
mov rsi, qword [rax + rdx + 0x468]
mov rdi, rsi
test rsi, rsi
jne 0x44a144
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
nop dword [rax]
call fcn.00449b80
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + rcx + 0x468]
mov rax, rdx
mov rdx, rcx
mov rdi, rsi
mov ecx, dword [rsp + 0x78]
mov rsi, rdi
mov rdi, qword [rdi]
mov qword [rax + rdx + 0x468], rdi
mov edi, ecx
sub qword [rax + rdx + 0x470], rdi
mov rcx, rsi
nop
jmp 0x44a046
mov rax, rdx
mov ecx, 2
call fcn.00462280
mov ecx, 2
call fcn.00462280
lea rax, [0x005b208b]
mov ebx, 0x1b
call fcn.00435b40
lea rax, [0x005b415f]
mov ebx, 0x21
call fcn.00435b40
nop
mov dword [rsp + 8], eax
call fcn.00464340
mov eax, dword [rsp + 8]
jmp fcn.00449ee0