Function at 0x422620
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42292c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
lea rdx, [rcx - 1]
test rdx, rcx
jne 0x4228f0
test rcx, rcx
je 0x4228f0
cmp rcx, 0x40
ja 0x4228b5
nop dword [rax]
test rdi, rdi
jne 0x42266a
mov rdx, rcx
jmp 0x42267f
nop
lea rdx, [rcx + rdi]
lea rdx, [rdx - 1]
mov rsi, rcx
neg rcx
and rcx, rdx
mov rdx, rsi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rcx
shr rbx, 6
jmp 0x4226a7
mov rsi, qword [rsp + 0x20]
lea rbx, [rsi - 1]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
test rbx, rbx
jl 0x4226f3
test byte [rax], al
cmp rbx, 8
jae 0x4228a8
mov rcx, qword [rax + rbx*8]
or rcx, qword [rax + rbx*8 + 0x40]
mov rax, rcx
mov rbx, rdx
call fcn.00422320
cmp rax, 0xffffffffffffffff
je 0x42268f
mov rax, qword [rsp + 0x20]
test rax, rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
jl 0x42279d
test byte [rax], al
nop dword [rax + rax]
cmp rbx, 8
jae 0x42289b
mov rcx, qword [rax + rbx*8]
or rcx, qword [rax + rbx*8 + 0x40]
mov rax, rcx
mov rbx, rdx
call fcn.00422320
mov rcx, rax
not rax
bsr rdx, rax
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rdi, [rdx - 0x3f]
neg rdi
cmp rdi, 0x40
sbb rdi, rdi
mov r8, qword [rsp + 0x20]
mov r9, r8
shl r8, 6
lea r10, [rdx + r8]
lea r10, [r10 + 1]
lea r8, [rdx + r8]
lea r8, [r8 + 1]
lea r11, [rdx + 1]
neg r11
mov rax, rcx
mov rcx, r11
shl rax, cl
and rax, rdi
test rax, rax
je 0x422789
bsr rcx, rax
cmove rcx, rsi
add rcx, 0xffffffffffffffc1
neg rcx
jmp 0x42281c
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], r8
lea rcx, [rdx + 1]
lea rdx, [r9 - 1]
jmp 0x4227c8
xor eax, eax
mov rbx, rax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x18]
dec rdi
mov rsi, 0xffffffffffffffff
mov r8, qword [rsp + 0x30]
mov r10, qword [rsp + 0x28]
mov rdx, rdi
test rdx, rdx
jl 0x42281c
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rdx*8]
or rax, qword [rcx + rdx*8 + 0x40]
mov rbx, qword [rsp + 0x60]
call fcn.00422320
bsr rcx, rax
mov rdx, 0xffffffffffffffff
cmove rcx, rdx
inc rcx
mov rsi, qword [rsp + 0x10]
sub rsi, rcx
lea rcx, [rsi + 0x40]
test rax, rax
je 0x4227ac
mov r8, qword [rsp + 0x30]
mov r10, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
cmp rdx, rcx
mov rsi, rcx
cmovb rcx, rdx
mov rdx, r8
sub r8, rcx
mov rdi, qword [0x00759178]
nop dword [rax + rax]
cmp rdi, 0x2000
jbe 0x422888
cmp qword [0x00759180], rdi
jae 0x422888
shr rdi, 0xd
nop
lea r9, [r8 + rdi]
lea r9, [r9 - 1]
neg rdi
and r9, rdi
cmp r10, r9
jb 0x422883
nop
sub rdx, rsi
and rdi, r8
cmp rdi, rdx
jb 0x42287e
sub r8, rdi
add rcx, r8
jmp 0x42288b
mov rdi, r8
jmp 0x42288b
mov rdi, r8
jmp 0x42288b
mov rdi, r8
mov rax, rdi
mov rbx, rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rbx
mov ecx, 8
call fcn.00462280
mov rax, rbx
mov ecx, 8
call fcn.00462280
call fcn.004372e0
lea rax, [0x005adaf6]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x60]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005ad325]
mov ebx, 0xd
call fcn.00435b40
call fcn.004372e0
lea rax, [0x005adaf6]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x60]
call fcn.004378e0
call fcn.00437540
call fcn.00437360
lea rax, [0x005b3f2e]
mov ebx, 0x21
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00422620