Function at 0x415500
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415829
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rdi
test r10, 0x1f
jne 0x415817
mov qword [rsp + 0xa0], r10
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x58], rax
cmp r9, r8
je 0x4155ba
test r8, r8
je 0x415812
mov rcx, rax
mov rax, r9
xor edx, edx
div r8
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rdx, r8
shr r8, 3
mov r9, rsi
shr rsi, 3
mov r12, r8
sub r8, rsi
test r8, r8
jbe 0x4155b3
mov byte [rsp + 0x30], 1
cmp r8, 1
jbe 0x4155a9
mov byte [rsp + 0x32], 0x81
lea rsi, [r8 - 1]
mov ebx, 3
jmp 0x4157d0
mov ebx, 2
jmp 0x415685
xor ebx, ebx
jmp 0x415685
xor ebx, ebx
mov rcx, rax
mov edi, 2
mov rax, r11
call fcn.004159a0
mov rdx, rax
shl rax, 3
mov rsi, qword [rsp + 0x88]
nop dword [rax + rax]
cmp rsi, rax
jne 0x41561e
lea rcx, [rdx + 3]
shr rcx, 2
mov rdx, qword [rsp + 0xa0]
shr rdx, 5
mov rsi, qword [rsp + 0x58]
lea rbx, [rsi + rdx]
lea rax, [rsi + rcx]
mov rcx, rax
sub rbx, rax
mov rax, rcx
call fcn.00462920
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x28], rdx
call fcn.004372e0
lea rax, [0x005b6974]
mov ebx, 0x2b
call fcn.00437be0
mov rax, qword [rsp + 0x28]
nop
call fcn.004378e0
lea rax, [0x005ad3e8]
mov ebx, 0xe
call fcn.00437be0
mov rax, qword [rsp + 0x88]
nop
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b66ef]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00435b40
cmp rbx, 0x28
jae 0x4157ac
mov byte [rsp + rbx + 0x30], pe_nt_image_headers64
lea rsi, [rbx + 1]
jmp 0x4156b1
mov r8, r12
bts r12, 7
mov byte [rsp + rsi + 0x30], r12b
shr r8, 7
inc rsi
mov r12, r8
cmp r12, 0x80
jb 0x4156cb
nop word [rax + rax]
cmp rsi, 0x28
jb 0x41569a
jmp 0x41579f
cmp rsi, 0x28
jae 0x415792
mov byte [rsp + rsi + 0x30], r12b
inc rsi
lea r8, [rax - 1]
mov rax, r8
jmp 0x415700
mov r12, r8
bts r8, 7
mov byte [rsp + rsi + 0x30], r8b
shr r12, 7
inc rsi
mov r8, r12
nop dword [rax]
cmp r8, 0x80
jb 0x415711
cmp rsi, 0x28
jb 0x4156e6
jmp 0x415785
cmp rsi, 0x28
jae 0x415776
mov byte [rsp + rsi + 0x30], r8b
lea r8, [rsi + 1]
cmp r8, 0x28
jae 0x415769
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov byte [rsp + rsi + 0x31], 0
mov rax, r11
lea rbx, [rsp + 0x30]
mov edi, 2
call fcn.004159a0
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
imul rdx, rsi
mov rsi, qword [rsp + 0x88]
add rdx, rsi
shr rdx, 3
jmp 0x4155e5
mov rax, r8
mov ecx, 0x28
call fcn.00462280
mov rax, rsi
mov ecx, 0x28
nop
call fcn.00462280
mov rax, rsi
mov ecx, 0x28
call fcn.00462280
mov rax, rsi
mov ecx, 0x28
call fcn.00462280
mov rax, rsi
mov ecx, 0x28
call fcn.00462280
mov rax, rbx
mov ecx, 0x28
call fcn.00462280
mov r8, rsi
bts rsi, 7
mov byte [rsp + rbx + 0x30], sil
shr r8, 7
inc rbx
mov rsi, r8
cmp rsi, 0x80
jb 0x4157e2
cmp rbx, 0x28
jb 0x4157b9
nop
jmp 0x415805
cmp rbx, 0x28
jae 0x4157f5
mov byte [rsp + rbx + 0x30], sil
inc rbx
jmp 0x415685
mov rax, rbx
mov ecx, 0x28
nop dword [rax]
call fcn.00462280
mov rax, rbx
mov ecx, 0x28
call fcn.00462280
call fcn.004340c0
lea rax, [0x005b5934]
mov ebx, 0x27
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x40]
jmp fcn.00415500