Function at 0x450b20
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x450ed7
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
movzx edx, byte [rbx + 0x17]
and edx, 0x1f
cmp dl, 0xb
jbe 0x450bcd
cmp dl, 0x11
jbe 0x450b98
nop
cmp dl, 0x16
je 0x450bf7
cmp dl, 0x19
jne 0x450b8e
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xc0], rbx
mov rdx, qword [rbx + 0x40]
mov qword [rsp + 0x50], rdx
xor esi, esi
jmp 0x450e6b
cmp dl, 0x1a
je 0x450bf7
jmp 0x450e02
cmp dl, 0xc
je 0x450bf7
nop dword [rax]
cmp dl, 0x11
jne 0x450e02
cmp qword [rbx + 0x40], 1
jne 0x450e02
mov rbx, qword [rbx + 0x30]
call fcn.00450b20
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
cmp dl, 6
ja 0x450bee
lea r8d, [rdx - 1]
cmp r8b, 4
jbe 0x450bf7
nop dword [rax]
cmp dl, 6
je 0x450d12
jmp 0x450e02
cmp dl, 0xa
ja 0x450d09
mov rdx, qword [rbx]
mov r8, qword [rax + 0x30]
mov r9, qword [0x006e1308]
cmp r9, r8
jle 0x450cf6
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
mov qword [rsp + 0x80], 2
mov r10, qword [rax + 0x18]
add r10, rcx
mov qword [rsp + 0x88], r10
mov r10, qword [rax + 0x30]
mov qword [rsp + 0x98], r10
mov qword [rsp + 0xa0], rdx
mov rcx, qword [rax + 8]
lea rsi, [rcx + 1]
mov rbx, qword [rax]
mov rdi, qword [rax + 0x10]
cmp rdi, rsi
jae 0x450cb8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r9
lea rax, [0x0059a7a0]
nop dword [rax]
call fcn.004490a0
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 0x10], rcx
cmp dword [0x007592a0], 0
jne 0x450ca0
mov qword [rdi], rax
jmp 0x450ca5
call fcn.00461de0
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov rcx, rbx
mov rbx, rax
mov rax, rdi
lea rdx, [rcx + 1]
mov qword [rax + 8], rdx
lea rcx, [rcx + rcx*4]
mov rdx, qword [rsp + 0x80]
mov qword [rbx + rcx*8], rdx
lea rcx, [rbx + rcx*8]
lea rcx, [rcx + 8]
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rcx + 0x10], xmm0
inc qword [rax + 0x30]
cmp r9, r8
setg al
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
cmp dl, 0xb
jne 0x450e02
mov rdx, qword [rbx]
mov r8, qword [rax + 0x30]
mov r9, qword [0x006e1308]
cmp r9, r8
jle 0x450def
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov qword [rsp + 0x58], 2
mov r10, qword [rax + 0x18]
add r10, rcx
mov qword [rsp + 0x60], r10
mov r10, qword [rax + 0x30]
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x78], rdx
mov rcx, qword [rax + 8]
lea rsi, [rcx + 1]
mov rbx, qword [rax]
mov rdi, qword [rax + 0x10]
cmp rdi, rsi
jae 0x450dba
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r9
lea rax, [0x0059a7a0]
call fcn.004490a0
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 0x10], rcx
cmp dword [0x007592a0], 0
jne 0x450da2
mov qword [rdi], rax
jmp 0x450da7
call fcn.00461de0
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov rcx, rbx
mov rbx, rax
mov rax, rdi
lea rdx, [rcx + 1]
mov qword [rax + 8], rdx
lea rcx, [rcx + rcx*4]
mov rdx, qword [rsp + 0x58]
mov qword [rbx + rcx*8], rdx
lea rcx, [rbx + rcx*8]
lea rcx, [rcx + 8]
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rcx + 0x10], xmm0
inc qword [rax + 0x30]
cmp r9, r8
setg al
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, rbx
call fcn.00459020
mov ecx, 0x16
mov rdi, rax
mov rsi, rbx
lea r8, [0x005b83f2]
mov r9d, 0x37
xor eax, eax
lea rbx, [0x005aff5c]
call fcn.0044cbc0
call fcn.0040b080
mov rbx, rax
lea rax, [0x00579660]
nop
call fcn.004353c0
mov rdi, qword [rsp + 0x40]
lea rsi, [rdi + 1]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
cmp rsi, rdx
jge 0x450eb6
mov rdi, qword [rbx + 0x38]
mov r8, qword [rbx + 0x40]
cmp rsi, r8
jae 0x450ecb
mov qword [rsp + 0x40], rsi
lea rdx, [rsi + rsi*2]
mov rbx, qword [rdi + rdx*8 + 8]
mov rdx, qword [rdi + rdx*8 + 0x10]
shr rdx, 1
add rdx, rcx
mov rcx, rdx
call fcn.00450b20
nop
test al, al
jne 0x450e45
xor eax, eax
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov eax, 1
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, rsi
mov rcx, r8
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00450b20