Function at 0x40a2a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a567
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [rax + 0x38]
cmp qword [rax + 0x40], 0
je 0x40a555
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
movzx esi, byte [rbx + 0x14]
test sil, 1
jne 0x40a2f4
nop dword [rax + rax]
test cl, cl
je 0x40a4b5
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov byte [rsp + 0x58], cl
mov rdx, qword [0x006fc020]
mov rcx, rbx
mov rbx, rax
mov rax, rdx
call fcn.0040a5a0
test rax, rax
jne 0x40a3f8
nop
nop
lea rax, [0x00759120]
nop
call fcn.0040b700
mov rax, qword [0x006fc020]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.0040a5a0
nop dword [rax + rax]
test rax, rax
je 0x40a365
mov qword [rsp + 0x20], rax
nop
nop
lea rax, [0x00759120]
call fcn.0040b920
mov rax, qword [rsp + 0x20]
nop dword [rax]
jmp 0x40a3f8
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rdx + 0x40]
dec rsi
shl rsi, 3
lea rax, [rsi + 0x20]
xor ebx, ebx
lea rcx, [0x0075ae00]
call fcn.0040db40
test byte [rax], al
cmp dword [0x007592a0], 0
jne 0x40a3a5
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rax + 8], rdx
jmp 0x40a3c5
mov rdi, rax
mov rcx, qword [rsp + 0x48]
call fcn.00461ee0
lea rdx, [rax + 8]
mov rdi, rdx
mov rbx, qword [rsp + 0x50]
nop
call fcn.00461f20
mov qword [rsp + 0x30], rax
mov dword [rax + 0x10], 0
call fcn.0040a7a0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.0040a600
nop
nop
lea rax, [0x00759120]
call fcn.0040b920
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
jne 0x40a414
movzx ecx, byte [rsp + 0x58]
test cl, cl
je 0x40a41e
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
nop
call fcn.0040a7a0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x18], rbx
lea rax, [0x00598760]
call fcn.0040d7e0
cmp dword [0x007592a0], 0
jne 0x40a495
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x007592a0], 0
jne 0x40a485
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rbx, rax
lea rax, [0x00587ac0]
nop dword [rax + rax]
call fcn.004353c0
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00461ee0
jmp 0x40a471
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x50]
nop
call fcn.00461ee0
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x48]
call fcn.00461ee0
jmp 0x40a456
mov ebx, dword [rdx]
call fcn.00459200
nop dword [rax]
call fcn.00459960
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x18], rbx
lea rax, [0x00598760]
call fcn.0040d7e0
cmp dword [0x007592a0], 0
jne 0x40a535
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x007592a0], 0
jne 0x40a525
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rbx, rax
lea rax, [0x00587ac0]
nop dword [rax + rax]
call fcn.004353c0
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00461ee0
jmp 0x40a511
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x50]
nop
call fcn.00461ee0
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x48]
call fcn.00461ee0
jmp 0x40a4f6
lea rax, [0x005b344e]
mov ebx, 0x1f
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0040a2a0