Function at 0x414860
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0xb0]
cmp r12, qword [r14 + 0x10]
jbe 0x4154c7
sub rsp, 0x130
mov qword [rsp + 0x128], rbp
lea rbp, [rsp + 0x128]
cmp rbx, 8
je 0x414cb0
nop
movabs rdx, 0x800000000000
add rdx, rax
mov r12, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x4154b9
lea r13, [0x0072b450]
mov r15, qword [r13 + rdx*8]
test byte [r15], al
shr r12, 0x16
mov rsi, r12
and r12d, 0xfffff
mov r15, qword [r15 + r12*8]
test r15, r15
je 0x414902
mov r8, rax
shr rax, 5
and eax, 0x1ffff
mov r9, rdx
lea rdx, [r15 + rax]
mov rax, r8
shr r8, 3
and r8d, 3
add r15, 0x1ffff
mov r10, rsi
jmp 0x414912
mov r9, rdx
mov r10, rsi
xor edx, edx
xor r8d, r8d
xor r15d, r15d
xor esi, esi
mov r11, r12
mov r12, qword [rdi + 0x20]
nop dword [rax]
cmp rbx, 0x10
je 0x414c1b
cmp rbx, 0x18
je 0x414ae8
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0x100], rdx
lea r13, [rbx + rax]
mov r12d, esi
movabs rdx, 0x7fffffffffff
add rdx, r13
shr rdx, 0x16
nop dword [rax]
cmp r12, rdx
je 0x41496d
mov r13, rax
xor r15d, r15d
jmp 0x414978
mov r13, rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xd0], r11
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0xb8], r10
movzx r13d, byte [rdi + 0x17]
test r13b, 0x40
jne 0x414a9c
mov qword [rsp + 0xf8], rax
mov r13, qword [rdi]
cmp rcx, r13
jbe 0x414a6c
mov qword [rsp + 0xb0], r13
mov r15, qword [rdi + 8]
shr r15, 3
nop dword [rax + rax]
cmp r15, 0x39
ja 0x414a1c
mov qword [rsp + 0x148], rcx
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0x88], rax
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x88]
jmp 0x4153b7
add r15, 7
shr r15, 3
mov rsi, r10
lea r10, [r15 - 1]
nop
shr r13, 3
shl r10, 3
sub r13, r10
mov r10, qword [rsp + 0xe8]
lea r10, [r15 + r10]
lea r10, [r10 - 1]
mov r15, qword [rsp + 0xe8]
xor r15d, r15d
mov qword [rsp + 0x60], r15
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov r15, qword [rsp + 0xe8]
jmp 0x415332
mov rsi, qword [rsp + 0xe8]
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x108], rsi
xor esi, esi
mov qword [rsp + 0x58], rsi
xor esi, esi
mov qword [rsp + 0x70], rsi
mov rsi, qword [rsp + 0xe8]
jmp 0x414f2a
mov qword [rsp + 0xa8], r12
mov rdx, qword [rdi + 8]
mov r12, qword [rdi]
mov r13, qword [rsp + 0xe8]
lea r11, [r13 + 4]
mov rdi, r15
mov r9, rcx
mov r10, rbx
mov ebx, r8d
mov ecx, esi
mov rsi, rdx
mov r8, r12
call fcn.00415500
mov rdx, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xc8]
cmp rdx, r12
jmp 0x414cc1
movzx r9d, byte [r12]
cmp qword [rdi], 8
jne 0x414af9
mov r9d, 7
and r9d, 7
mov r10d, r9d
shl r9d, 4
or r9d, r10d
mov r10d, r9d
or r9d, 0x10
and r9d, 0x40
shr r9b, 1
or r9d, r10d
mov r10d, r9d
or r9d, 0x10
nop
cmp r8d, 1
ja 0x414b52
test r8d, r8d
jne 0x414b3e
movzx eax, byte [rdx]
and eax, 0xffffff88
or eax, r10d
or eax, 0x10
mov byte [rdx], al
jmp 0x414c0b
movzx eax, byte [rdx]
and eax, 0x11
shl r9d, 1
or r9d, eax
mov byte [rdx], r9b
jmp 0x414c0b
mov byte [rsp + 0x45], r9b
cmp r8d, 2
jne 0x414bb6
movzx r10d, byte [rdx]
and r10d, 0x33
mov r11d, r9d
and r9d, 0x33
shl r9d, 2
or r9d, r10d
mov byte [rdx], r9b
lea ebx, [r8 + 1]
cmp ebx, 3
jb 0x414ba0
nop
cmp rdx, r15
je 0x414b8a
inc rdx
jmp 0x414ba0
mov rax, rdx
mov ecx, esi
mov rdi, r15
call fcn.00413a80
movzx r11d, byte [rsp + 0x45]
mov rdx, rax
movzx eax, byte [rdx]
and eax, 0xffffffee
shr r11b, 2
and r11d, 0x11
or r11d, eax
mov byte [rdx], r11b
jmp 0x414c0b
cmp r8d, 3
jne 0x414c0b
movzx r10d, byte [rdx]
and r10d, 0x77
mov r11d, r9d
and r9d, 0x11
shl r9d, 3
or r10d, r9d
mov byte [rdx], r10b
cmp rdx, r15
je 0x414be2
nop
lea rax, [rdx + 1]
nop
jmp 0x414bf8
mov rax, rdx
mov ebx, r8d
mov ecx, esi
mov rdi, r15
call fcn.00413a80
movzx r11d, byte [rsp + 0x45]
movzx ecx, byte [rax]
and ecx, 0xffffffcc
shr r11b, 1
and r11d, 0x33
or r11d, ecx
mov byte [rax], r11b
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
cmp qword [rdi], 8
nop
jne 0x414c4b
cmp r8d, 0x20
sbb eax, eax
movzx ebx, byte [rdx]
mov ecx, r8d
mov esi, 0x33
shl esi, cl
and esi, eax
or ebx, esi
mov byte [rdx], bl
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov rcx, qword [rdi + 8]
shr rcx, 3
cmp rcx, 0x20
sbb eax, eax
cmp r8d, 0x20
sbb ebx, ebx
sbb esi, esi
movzx edi, byte [r12]
and edi, 3
mov r9d, 0x10
shl r9d, cl
and eax, r9d
dec eax
and eax, 0xf0
or edi, eax
movzx eax, byte [rdx]
mov ecx, r8d
mov r9d, 0x33
shl r9d, cl
and r9d, ebx
not r9d
and r9d, eax
shl edi, cl
and esi, edi
or esi, r9d
mov byte [rdx], sil
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
nop
ret
je 0x414dc5
mov rdx, qword [rsp + 0xc0]
lea r8, [0x0072b450]
mov rdx, qword [r8 + rdx*8]
test byte [rdx], al
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rdx + r8*8]
test rdx, rdx
je 0x414d22
mov rax, qword [rsp + 0xd8]
mov r8, rax
shr rax, 5
and eax, 0x1ffff
lea r9, [rdx + rax]
mov rax, r8
shr r8, 3
and r8d, 3
add rdx, 0x1ffff
mov rcx, qword [rsp + 0xb8]
nop
jmp 0x414d34
mov rax, qword [rsp + 0xd8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r10, qword [rsp + 0x140]
shr r10, 3
mov r11, rax
cmp r8d, 2
jne 0x414e7f
movzx r12d, byte [r9]
and r12d, 0x33
movzx r13d, byte [rax]
or r13d, r12d
mov byte [r9], r13b
lea ebx, [r8 + 1]
cmp ebx, 3
jae 0x414d6e
add r8d, 2
jmp 0x414db7
cmp rdx, r9
je 0x414d7b
inc r9
xor r8d, r8d
jmp 0x414db7
mov qword [rsp + 0x120], rax
mov qword [rsp + 0xa0], r10
mov rax, r9
mov rdi, rdx
call fcn.00413a80
mov r10, qword [rsp + 0xa0]
mov r11, qword [rsp + 0xd8]
mov r8d, ebx
mov rdx, rdi
mov r9, rax
mov rax, qword [rsp + 0x120]
add r10, 0xfffffffffffffffe
inc rax
nop
jmp 0x414e7f
mov rbp, qword [rsp + 0x128]
add rsp, 0x130
ret
mov qword [rsp + 0xf0], r9
mov qword [rsp + 0x78], r10
mov rsi, r10
shr rsi, 2
shl rsi, 2
mov rax, r9
mov ebx, r8d
mov rdi, rdx
call fcn.00413c00
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x50], rsi
shr rsi, 2
mov qword [rsp + 0xc8], rsi
mov rax, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.00462be0
mov r10, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
sub r10, rdx
nop
mov rdx, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xe0]
lea rax, [r8 + rdx]
mov r11, qword [rsp + 0xd8]
mov r9, qword [rsp + 0x118]
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x110]
mov ecx, dword [rsp + 0x48]
mov qword [rsp + 0xe0], rax
cmp r10, 4
jae 0x414dd5
cmp r10, 2
jne 0x414f12
movzx esi, byte [r9]
and esi, 0xffffffcc
movzx r10d, byte [rax]
or r10d, esi
mov byte [r9], r10b
nop
cmp r8d, 3
jae 0x414eb5
lea esi, [r8 + 1]
jmp 0x414ee8
cmp rdx, r9
je 0x414ec2
inc r9
xor esi, esi
nop
jmp 0x414ee8
mov rax, r9
mov ebx, r8d
mov rdi, rdx
call fcn.00413a80
mov r11, qword [rsp + 0xd8]
mov esi, ebx
mov rdx, rdi
mov r9, rax
mov rax, qword [rsp + 0xe0]
cmp esi, 3
jb 0x414f0f
cmp r9, rdx
jne 0x414f0f
mov rax, r9
mov ebx, esi
mov rdi, rdx
call fcn.00413a80
mov rax, qword [rsp + 0xe0]
mov r11, qword [rsp + 0xd8]
inc rax
mov rcx, r11
sub rax, rcx
mov rbx, rax
mov rax, r11
nop
call fcn.00462920
jmp 0x414dc5
test rsi, rsi
je 0x414f59
mov r15, r10
movzx r10d, byte [rsi]
nop
inc rsi
cmp rcx, r13
mov qword [rsp + 0x90], rax
mov eax, 8
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x90]
jmp 0x414f6e
cmp rcx, r13
mov r10, qword [rsp + 0x58]
mov qword [rsp + 0x60], r15
mov r15, qword [rsp + 0xb8]
jne 0x414f80
mov r13, qword [rdi + 8]
shr r13, 3
jmp 0x414faf
test r13, r13
je 0x41532d
mov rax, rcx
mov rcx, rdx
xor edx, edx
div r13
lea rdx, [rax - 1]
imul r13, rdx
add r13, qword [rdi + 8]
shr r13, 3
mov rax, qword [rsp + 0xf8]
mov rdx, rcx
test r13, r13
je 0x4152cf
test r8d, r8d
jne 0x415000
mov r8, r10
and r10d, 0xf
or r10, 0xf0
cmp r13, 4
ja 0x414fdb
mov ecx, 4
jmp 0x415220
mov byte [rax], r10b
nop
shr r8, 4
mov r10, qword [rsp + 0x60]
add r10, 0xfffffffffffffffc
mov rcx, r15
lea r15, [rax + 1]
mov eax, 4
jmp 0x41507a
cmp r8d, 2
jne 0x4152be
mov r8, r10
and r10d, 3
shl r10, 2
mov rcx, r10
or r10, 0x40
or rcx, 0xc0
cmp r13, 1
cmova r10, rcx
mov rcx, r15
movzx r15d, byte [rax]
and r15d, 0x33
or r10d, r15d
mov byte [rax], r10b
nop
lea r10, [rax + 1]
cmp r13, 2
ja 0x41505a
mov r15, rcx
mov ecx, 6
mov rax, r10
xor r10d, r10d
jmp 0x415220
shr r8, 2
mov r11, qword [rsp + 0x60]
add r11, 0xfffffffffffffffe
mov eax, 2
mov r15, r10
mov r10, r11
mov r11, qword [rsp + 0xd0]
add r10, 0xfffffffffffffffc
mov rdi, qword [rsp + 0x58]
jmp 0x4150b2
mov byte [r15 + 1], r8b
nop
mov r8, qword [rsp + 0x80]
shr r8, 4
add r15, 2
mov rax, qword [rsp + 0x70]
mov r11, qword [rsp + 0xd0]
mov rax, r9
mov r9, qword [rsp + 0xc0]
mov qword [rsp + 0x80], r8
and r8d, 0xf
or r8, 0xf0
lea r11, [rax + 4]
cmp r13, r11
jbe 0x415202
mov byte [r15], r8b
nop
mov r8, qword [rsp + 0x80]
shr r8, 4
mov r11, qword [rsp + 0x108]
cmp rsi, r11
je 0x415125
cmp r10, 8
jae 0x41511a
movzx r9d, byte [rsi]
mov rcx, r10
shl r9, cl
or r8, r9
inc rsi
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xc0]
jmp 0x4151d4
add r10, 0xfffffffffffffff8
nop
jmp 0x4151d4
test rsi, rsi
je 0x4151a3
cmp r10, 0x40
sbb r9, r9
movzx edx, byte [rsi]
mov rsi, rcx
mov rcx, r10
shl rdx, cl
and r9, rdx
or r8, r9
mov rdx, qword [rsp + 0x70]
lea r9, [rcx + rdx]
cmp r9, 8
jae 0x41516d
mov r10, qword [rsp + 0xe8]
movzx edx, byte [r10]
mov rcx, r9
shl rdx, cl
or r8, rdx
lea rdx, [r10 + 1]
jmp 0x415183
lea r9, [rcx + rdx]
lea r9, [r9 - 8]
mov r10, qword [rsp + 0xe8]
mov rdx, r10
mov rcx, r9
mov r9, qword [rsp + 0xc0]
mov rsi, rdx
mov r10, rcx
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc8]
jmp 0x4151d4
cmp r10, 8
jae 0x4151d0
mov rcx, r10
shl rdi, cl
or r8, rdi
mov r9, qword [rsp + 0x70]
lea r10, [rcx + r9]
mov rcx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0x58]
mov r9, qword [rsp + 0xc0]
add r10, 0xfffffffffffffff8
mov qword [rsp + 0x80], r8
and r8d, 0xf
or r8, 0xf0
lea r9, [rax + 8]
cmp r13, r9
ja 0x415085
inc r15
mov r11, r9
mov r9, qword [rsp + 0xc0]
mov rcx, r11
mov rax, r15
mov r10, r8
mov r11, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xb8]
nop dword [rax + rax]
cmp rcx, r13
jbe 0x41525b
mov r8, rcx
sub rcx, r13
add rcx, 0xfffffffffffffffc
neg rcx
cmp rcx, 0x40
sbb r13, r13
mov rsi, r15
mov r15d, 1
shl r15, cl
and r15, r13
lea r13, [r15 - 1]
mov r15, r13
shl r13, 4
or r13, r15
and r10, r13
jmp 0x415261
mov rsi, r15
mov r8, rcx
mov r13, rbx
shr rbx, 3
cmp r8, rbx
ja 0x41527b
mov byte [rax], r10b
nop
add r8, 4
lea r10, [rax + 1]
jmp 0x4152b1
lea r15, [rbx + 2]
nop
cmp r8, r15
jne 0x41529b
movzx r8d, byte [rax]
and r8d, 0xffffffcc
or r10d, r8d
mov byte [rax], r10b
cmp r12, rdx
jmp 0x414cc1
cmp r12, rdx
nop
jmp 0x414cc1
mov byte [r10], 0
add r8, 4
nop
inc r10
cmp r8, rbx
jbe 0x4152a5
mov rax, r10
xor r10d, r10d
jmp 0x41527b
lea rax, [0x005b3ecb]
mov ebx, 0x21
call fcn.00435b40
mov rax, rdi
call fcn.00459020
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x98], rbx
call fcn.004372e0
lea rax, [0x005b08e6]
mov ebx, 0x17
call fcn.00437be0
mov rax, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x98]
call fcn.00437be0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b6e44]
mov ebx, 0x2d
call fcn.00435b40
call fcn.004340c0
mov rsi, r15
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0x108], r10
mov qword [rsp + 0x70], r13
mov r10, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
jmp 0x414f2a
cmp r10, 0x40
sbb r11, r11
lea r9, [r10 + 8]
movzx edx, byte [rsi]
mov rcx, r10
shl rdx, cl
and rdx, r11
mov rcx, qword [rsp + 0x80]
or rcx, rdx
nop
inc rsi
mov rdx, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xb8]
mov r11, qword [rsp + 0xd0]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x148]
mov r9, qword [rsp + 0xc0]
mov r10, qword [rsp + 0x68]
nop dword [rax]
cmp r10, r15
jb 0x41535c
mov r10, r13
shr r13, 3
lea r15, [r13 + r13]
cmp r15, 0x39
ja 0x4153e4
mov r15, qword [rsp + 0x80]
mov rsi, r13
jmp 0x415436
mov rsi, qword [rsp + 0x80]
xor r15d, r15d
mov qword [rsp + 0x60], r13
xor r10d, r10d
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0xb8]
jmp 0x415332
mov qword [rsp + 0x58], r15
sbb r11, r11
mov rcx, r13
shl r15, cl
and r15, r11
mov r11, qword [rsp + 0x58]
or r15, r11
lea r13, [rcx + rcx]
mov rcx, qword [rsp + 0x148]
mov r11, qword [rsp + 0xd0]
cmp r13, 0x40
jbe 0x415409
nop dword [rax]
test sil, sil
je 0x4154b4
mov r13, r15
movzx r15d, sil
mov word [rsp + 0x46], r15w
mov r15d, 0x39
movzx r15d, r15b
mov eax, r15d
movzx r15d, word [rsp + 0x46]
xor edx, edx
div r15w
movzx r15d, al
imul r15, rsi
cmp r15, 0x40
mov rax, r15
sbb r15, r15
mov rdx, rcx
mov rcx, rax
mov rsi, r15
mov r15d, 1
shl r15, cl
and r15, rsi
lea rsi, [r15 - 1]
and rsi, r13
mov rax, qword [rsp + 0xf8]
mov r13, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0xc8]
jmp 0x4153ec
call fcn.004340c0
mov rax, rdx
mov ecx, 0x40
call fcn.004622a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00414860