Function at 0x429520
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x98]
cmp r12, qword [r14 + 0x10]
jbe 0x42a0b9
sub rsp, 0x118
mov qword [rsp + 0x110], rbp
lea rbp, [rsp + 0x110]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rbx
test byte [rax], al
movups xmmword [rsp + 0xe8], xmm15
mov rsi, qword [0x006e1340]
mov qword [rsp + 0xe8], rsi
mov rsi, qword [0x006e1320]
mov qword [rsp + 0xf0], rsi
movups xmmword [rsp + 0x100], xmm15
lea rsi, [0x0042a0e0]
mov qword [rsp + 0x100], rsi
lea rsi, [rsp + 0xe8]
mov qword [rsp + 0x108], rsi
xor ecx, ecx
xor edx, edx
mov rsi, 0xffffffffffffffff
xor edi, edi
jmp 0x4295e0
mov r10, qword [rsp + 0xe0]
lea rcx, [r10 + 1]
mov rax, qword [rsp + 0x120]
mov rsi, qword [rsp + 0xa0]
mov rdx, rsi
nop dword [rax + rax]
cmp rcx, 5
jge 0x4296f8
lea r8, [0x006e28e0]
mov r9, qword [r8 + rcx*8]
cmp r9, 0x40
sbb r10, r10
mov r11, rcx
mov rcx, r9
mov r12d, 1
shl r12, cl
and r12, r10
lea r13, [0x006e2920]
mov r15, qword [r13 + r11*8]
shl rdx, cl
and rdx, r10
lea r9, [r11 + r11*2]
mov r10, qword [rax + r9*8 + 0x10]
mov r9, qword [rax + r9*8]
lea rcx, [rdx + r12]
cmp r10, rcx
jb 0x42a0b0
nop word [rax + rax]
cmp rdx, rcx
ja 0x42a0a8
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
lea rsi, [0x006e2960]
mov r13, qword [rsi + r11*8]
cmp r13, 0x40
sbb r8, r8
sub rdx, r10
mov r10, qword [rsp + 0xa8]
shl r10, 3
sar rdx, 0x3f
and r10, rdx
add r9, r10
mov r10, qword [rax + 0x10078]
mov rdx, r12
neg r12
movabs rdi, 0x800000000000
add r10, rdi
mov rcx, r13
shr r10, cl
and r10, r8
and r12, r10
mov r8, qword [rsp + 0xa8]
cmp r12, r8
jne 0x4296c2
lea r12, [rdx - 1]
and r12, r10
jmp 0x4296c5
xor r12d, r12d
mov qword [rsp + 0xe0], r11
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0x68], r15
mov qword [rsp + 0xf8], r9
mov qword [rsp + 0x80], r12
mov rcx, r12
xor r10d, r10d
xor r13d, r13d
jmp 0x429995
mov rsi, rdx
shr rdx, 0xd
nop
cmp rdx, 0x2000
jae 0x429978
mov qword [rsp + 0xe0], rsi
mov rdx, qword [rax + rdx*8 + 0x78]
test byte [rdx], al
and esi, 0x1fff
shl rsi, 7
add rdx, rsi
xor ecx, ecx
mov rax, rdx
call fcn.0042be20
cmp rax, 0xffffffffffffffff
je 0x4297df
mov qword [rsp + 0x88], rax
shl rbx, 0xd
mov rcx, qword [rsp + 0xe0]
mov rsi, rcx
shl rcx, 0x16
mov qword [rsp + 0xd0], rcx
lea rdi, [rbx + rcx]
movabs r8, 0xffff800000000000
lea rax, [rdi + r8]
mov r9, qword [rsp + 0x100]
lea rbx, [rsi + 1]
shl rbx, 0x16
sub rbx, rdi
lea rdx, [rsp + 0x100]
call r9
mov rbx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x120]
call fcn.00429440
mov rcx, qword [rsp + 0x88]
shl rcx, 0xd
mov rsi, qword [rsp + 0xd0]
add rcx, rsi
movabs rsi, 0xffff800000000000
add rcx, rsi
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x110]
add rsp, 0x118
ret
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x60]
mov rax, qword [rsp + 0xe0]
nop word [rax + rax]
cmp rax, rcx
jae 0x429973
mov rcx, qword [rdx + rax*8]
mov rdx, rcx
and ecx, 0x1fffff
movabs rbx, 0x8000000000000000
test rbx, rdx
mov ebx, 0x200000
cmovne rcx, rbx
bt rdx, 0x3f
jae 0x42995c
mov ebx, 0x200000
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
jae 0x42994d
mov edx, 0x200000
mov qword [rsp + 0x18], rdx
call fcn.004372e0
lea rax, [0x005ae3c9]
mov ebx, 0x11
call fcn.00437be0
mov eax, 4
call fcn.004379e0
lea rax, [0x005ab0d9]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0xe0]
call fcn.004379e0
lea rax, [0x005ab5be]
mov ebx, 5
call fcn.00437be0
mov rax, qword [rsp + 0x28]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x20]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x18]
call fcn.004378e0
lea rax, [0x005ab06d]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
call fcn.004372e0
lea rax, [0x005ae885]
mov ebx, 0x12
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x128]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005addbf]
mov ebx, 0x10
call fcn.00435b40
shr rdx, 0x2a
and edx, 0x1fffff
jmp 0x429851
mov rbx, rdx
shr rbx, 0x15
and ebx, 0x1fffff
bt rdx, 0x3f
jmp 0x42983c
call fcn.00462280
mov rax, rdx
mov ecx, 0x2000
call fcn.004622a0
inc r12
mov r10, rdi
movabs rdi, 0x800000000000
cmp r12, rdx
jge 0x429c00
nop
jae 0x42a09d
mov rdi, qword [r9 + r12*8]
test rdi, rdi
jne 0x4299b3
xor edi, edi
jmp 0x429985
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x60], r10
cmp r15, 0x40
sbb rbx, rbx
mov rdi, qword [rsi + r11*8]
cmp rdi, 0x40
sbb r9, r9
mov r10, qword [rsp + 0x100]
lea r13, [r12 + r8]
mov qword [rsp + 0xa0], r13
mov rcx, r15
mov r8d, 1
shl r8, cl
and rbx, r8
shl rbx, 0xd
mov rcx, rdi
shl r13, cl
and r13, r9
movabs rdi, 0xffff800000000000
lea r9, [rdi + r13]
lea rdx, [rsp + 0x100]
mov rax, r9
call r10
mov rsi, qword [rsp + 0xc8]
mov rdi, rsi
and esi, 0x1fffff
movabs r8, 0x8000000000000000
test rdi, r8
mov r9d, 0x200000
cmovne rsi, r9
mov r10, qword [rsp + 0x60]
lea r11, [r10 + rsi]
mov rbx, qword [rsp + 0x128]
cmp rbx, r11
jbe 0x429b9d
bt rdi, 0x3f
jae 0x429a7e
mov eax, 0x200000
jmp 0x429a91
mov r11, rdi
shr rdi, 0x15
and edi, 0x1fffff
mov rax, rdi
mov rdi, r11
cmp rbx, rax
jbe 0x4295b9
test r10, r10
jne 0x429aab
bt rdi, 0x3f
mov rcx, qword [rsp + 0x68]
jmp 0x429ad1
mov rcx, qword [rsp + 0x68]
cmp rcx, 0x40
sbb r11, r11
mov r12d, 1
shl r12, cl
and r12, r11
cmp rsi, r12
jae 0x429b48
bt rdi, 0x3f
jae 0x429ade
cmp rcx, 0x40
mov edi, 0x200000
jmp 0x429aec
shr rdi, 0x2a
and edi, 0x1fffff
cmp rcx, 0x40
sbb r13, r13
mov rsi, qword [rsp + 0x98]
lea r10, [rsi + 1]
shl r10, cl
and r13, r10
sub r13, rdi
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xf8]
mov r11, qword [rsp + 0xe0]
mov r12, rsi
mov r15, qword [rsp + 0x68]
lea rsi, [0x006e2960]
jmp 0x429985
lea rdi, [r10 + r12]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xd8]
lea rsi, [0x006e2960]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xf8]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0x98]
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0xb0]
jmp 0x429985
mov rcx, qword [rsp + 0x68]
cmp rcx, 0x40
sbb rdx, rdx
mov rsi, qword [rsp + 0x98]
shl rsi, cl
and rsi, rdx
test r10, r10
mov r13, qword [rsp + 0xb0]
cmove r13, rsi
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xd8]
lea rsi, [0x006e2960]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xf8]
mov r10, r11
mov r11, qword [rsp + 0xe0]
cmp rbx, r10
jbe 0x429eaf
test r11, r11
je 0x429e96
mov rdi, qword [rsp + 0x78]
mov r10, rdi
and edi, 0x1fffff
movabs r12, 0x8000000000000000
test r12, r10
mov r13d, 0x200000
cmovne rdi, r13
bt r10, 0x3f
jae 0x429c46
mov r15d, 0x200000
jmp 0x429c69
mov r15, r10
shr r10, 0x15
and r10d, 0x1fffff
bt r15, 0x3f
mov rsi, r10
mov r10, r15
mov r15, rsi
lea rsi, [0x006e2960]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
jae 0x429c7d
mov r10d, 0x200000
jmp 0x429c88
shr r10, 0x2a
and r10d, 0x1fffff
mov qword [rsp + 0x48], r10
call fcn.004372e0
lea rax, [0x005ae3c9]
mov ebx, 0x11
nop
call fcn.00437be0
mov rax, qword [rsp + 0xe0]
lea rcx, [rax - 1]
mov rax, rcx
call fcn.004379e0
lea rax, [0x005ab0d9]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x70]
call fcn.004379e0
lea rax, [0x005ab3b5]
mov ebx, 4
call fcn.00437be0
mov rax, qword [rsp + 0x58]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x50]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
call fcn.004372e0
lea rax, [0x005ae396]
mov ebx, 0x11
call fcn.00437be0
mov rax, qword [rsp + 0xe0]
call fcn.004379e0
lea rax, [0x005ac804]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x128]
call fcn.004378e0
lea rax, [0x005ab9f3]
mov ebx, 7
call fcn.00437be0
mov rax, qword [rsp + 0x80]
call fcn.004379e0
call fcn.00437540
nop dword [rax]
call fcn.00437360
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x10078]
mov qword [rsp + 0xd0], rax
nop dword [rax]
call fcn.004372e0
lea rax, [0x005b0e8e]
mov ebx, 0x18
call fcn.00437be0
mov rax, qword [rsp + 0xd0]
nop
call fcn.00437a40
lea rax, [0x005ab777]
mov ebx, 6
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
nop
call fcn.004379e0
call fcn.00437540
call fcn.00437360
mov rax, qword [rsp + 0xe0]
lea rcx, [0x006e2960]
mov rcx, qword [rcx + rax*8]
mov qword [rsp + 0xc0], rcx
lea rdx, [0x006e28e0]
mov rdx, qword [rdx + rax*8]
mov qword [rsp + 0xb8], rdx
nop dword [rax]
call fcn.004372e0
lea rax, [0x005b2bd5]
mov ebx, 0x1d
call fcn.00437be0
mov rax, qword [rsp + 0xc0]
nop
call fcn.004378e0
lea rax, [0x005af6b2]
mov ebx, 0x15
call fcn.00437be0
mov rax, qword [rsp + 0xb8]
nop
call fcn.004378e0
call fcn.00437540
call fcn.00437360
xor eax, eax
jmp 0x429ff5
mov rbx, qword [0x006e1328]
xor eax, eax
mov rbp, qword [rsp + 0x110]
add rsp, 0x118
ret
mov qword [rsp + 0xb0], r13
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsi + r11*8]
mov qword [rsp + 0xc0], rcx
call fcn.00429440
mov rcx, qword [rsp + 0xc0]
cmp rcx, 0x40
sbb rdx, rdx
mov rsi, qword [rsp + 0xb0]
shl rsi, 0xd
mov rdi, qword [rsp + 0xa8]
shl rdi, cl
and rdi, rdx
lea rcx, [rdi + rsi]
movabs rdx, 0xffff800000000000
add rcx, rdx
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x110]
add rsp, 0x118
nop
ret
mov qword [rsp + 0x30], rsi
call fcn.004372e0
lea rax, [0x005ae3c9]
mov ebx, 0x11
call fcn.00437be0
mov rax, qword [rsp + 0xe0]
call fcn.004379e0
lea rax, [0x005ab0d9]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
lea rdx, [rcx + rax]
mov rax, rdx
call fcn.004379e0
lea rax, [0x005ab5be]
mov ebx, 5
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x38]
call fcn.004378e0
lea rax, [0x005ab075]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.004378e0
lea rax, [0x005ab06d]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x90]
inc rax
mov rcx, qword [rsp + 0xd8]
nop dword [rax]
cmp rax, rcx
jge 0x42a08c
mov rdx, qword [rsp + 0xf8]
mov rbx, qword [rdx + rax*8]
mov rsi, rbx
and ebx, 0x1fffff
movabs rdi, 0x8000000000000000
test rdi, rsi
mov r8d, 0x200000
cmovne rbx, r8
bt rsi, 0x3f
jae 0x42a044
mov r9d, 0x200000
jmp 0x42a05f
mov r9, rsi
shr rsi, 0x15
and esi, 0x1fffff
bt r9, 0x3f
mov r10, rsi
mov rsi, r9
mov r9, r10
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rbx
jae 0x42a07d
mov esi, 0x200000
jmp 0x429f21
shr rsi, 0x2a
and esi, 0x1fffff
jmp 0x429f21
lea rax, [0x005addbf]
mov ebx, 0x10
call fcn.00435b40
mov rax, r12
mov rcx, rdx
call fcn.00462280
mov rax, rdx
call fcn.00462340
mov rdx, r10
call fcn.00462300
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00429520