Function at 0x453780
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453ba6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x80], sil
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x90], r9
mov rdx, qword [rdi]
lea r11, [rax + 0x34]
mov qword [rsp + 0x30], r11
mov rax, rdx
test rdx, rdx
je 0x4537e9
mov r12, qword [rdx + 0x10]
add r12, 0xffffffffffff0418
neg r12
cmp r12, r11
jge 0x4537fc
mov ebx, ecx
call fcn.00453e40
nop
mov rdx, rax
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov qword [rsp + 0x38], rdx
call fcn.00461c60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
shr rax, 6
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
mov rbx, rax
sub rax, rdx
inc rdx
test rax, rax
cmove rbx, rdx
mov qword [rcx + 8], rbx
mov edx, 1
cmove rax, rdx
mov rsi, qword [rsp + 0x88]
test rsi, rsi
jl 0x453863
mov rdx, qword [rsp + 0x98]
lea r10d, [rdx + 1]
jmp 0x45386e
mov rdx, qword [rsp + 0x98]
mov r10, rdx
cmp r10b, 3
jbe 0x45387a
mov r10d, 3
mov r8, qword [rcx + 0x10]
mov r9d, r10d
shl r10d, 6
movzx r11d, byte [rsp + 0x80]
or r10d, r11d
cmp r8, 0xfbe8
jae 0x453b97
mov byte [rcx + r8 + 0x418], r10b
mov r10, qword [rcx + 0x10]
inc r10
mov qword [rcx + 0x10], r10
cmp r9b, 3
jne 0x4538be
xor ebx, ebx
jmp 0x453b40
xor ebx, ebx
mov r9, qword [rcx + 0x10]
jmp 0x4538e0
mov r10, rax
or eax, 0xffffff80
mov byte [rcx + r9 + 0x418], al
shr r10, 7
inc r9
mov rax, r10
nop
cmp rax, 0x80
jb 0x453900
cmp r9, 0xfbe8
jb 0x4538c6
jmp 0x453b12
cmp r9, 0xfbe8
jae 0x453b05
mov byte [rcx + r9 + 0x418], al
inc r9
mov qword [rcx + 0x10], r9
mov r9, qword [rsp + 0x90]
xor eax, eax
jmp 0x453940
mov byte [rcx + r11 + 0x418], r10b
lea r10, [r11 + 1]
mov qword [rcx + 0x10], r10
inc rax
nop dword [rax + rax]
cmp rdx, rax
jle 0x453965
mov r10, qword [r9 + rax*8]
nop
mov r11, qword [rcx + 0x10]
jmp 0x453acf
cmp r11, 0xfbe8
jb 0x453928
nop dword [rax]
jmp 0x453aeb
test rsi, rsi
jne 0x453975
mov rdx, qword [rcx + 0x10]
xor eax, eax
jmp 0x453a69
jle 0x4539a2
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x40], rbx
lea rbx, [rcx + 0x18]
mov rax, qword [rsp + 0x48]
mov edi, pe_nt_image_headers64
mov rcx, rdi
call fcn.00453c20
mov rdx, qword [rsp + 0x38]
mov r8, qword [rdx + 0x10]
jmp 0x4539f1
mov rcx, qword [rcx + 0x10]
sub rcx, r8
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
jg 0x4539c8
test rbx, rbx
je 0x4539be
lea rax, [rcx - 2]
mov byte [rbx], al
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x005b29ae]
mov ebx, 0x1d
call fcn.00435b40
mov rsi, rax
or eax, 0xffffff80
mov byte [rdx + r8 + 0x418], al
shr rsi, 7
inc r8
mov rax, rsi
cmp rax, 0x80
jb 0x453a0b
nop dword [rax]
cmp r8, 0xfbe8
jb 0x4539d9
jmp 0x453a45
cmp r8, 0xfbe8
jae 0x453a36
mov byte [rdx + r8 + 0x418], al
lea rsi, [r8 + 1]
mov qword [rdx + 0x10], rsi
mov rcx, rdx
mov rbx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
jmp 0x4539a2
mov rax, r8
mov ecx, 0xfbe8
nop
call fcn.00462280
mov rax, r8
mov ecx, 0xfbe8
call fcn.00462280
mov rsi, rax
or eax, 0xffffff80
mov byte [rcx + rdx + 0x418], al
shr rsi, 7
inc rdx
mov rax, rsi
cmp rax, 0x80
jb 0x453a80
cmp rdx, 0xfbe8
jb 0x453a52
jmp 0x453aa9
cmp rdx, 0xfbe8
jae 0x453a9c
mov byte [rcx + rdx + 0x418], al
inc rdx
mov qword [rcx + 0x10], rdx
jmp 0x4539a2
mov rax, rdx
mov ecx, 0xfbe8
call fcn.00462280
mov rax, rdx
mov ecx, 0xfbe8
call fcn.00462280
mov r12, r10
or r10d, 0xffffff80
mov byte [rcx + r11 + 0x418], r10b
shr r12, 7
inc r11
mov r10, r12
cmp r10, 0x80
jb 0x453953
nop dword [rax]
cmp r11, 0xfbe8
jb 0x453ab6
jmp 0x453af8
mov rax, r11
mov ecx, 0xfbe8
call fcn.00462280
mov rax, r11
mov ecx, 0xfbe8
call fcn.00462280
mov rax, r9
mov ecx, 0xfbe8
call fcn.00462280
mov rax, r9
mov ecx, 0xfbe8
call fcn.00462280
mov r9, rbx
or ebx, 0xffffff80
mov byte [rcx + r10 + 0x418], bl
shr r9, 7
inc r10
mov rbx, r9
nop word [rax + rax]
cmp rbx, 0x80
jb 0x453b54
cmp r10, 0xfbe8
jb 0x453b1f
jmp 0x453b8a
cmp r10, 0xfbe8
jae 0x453b7d
mov byte [rcx + r10 + 0x418], bl
lea r9, [r10 + 1]
mov qword [rcx + 0x10], r9
lea rbx, [rcx + r10]
lea rbx, [rbx + 0x418]
jmp 0x4538c0
mov rax, r10
mov ecx, 0xfbe8
call fcn.00462280
mov rax, r10
mov ecx, 0xfbe8
call fcn.00462280
mov rax, r8
mov ecx, 0xfbe8
nop
call fcn.00462280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.00453780