Function at 0x44c0a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x44c706
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x90], 0
movups xmmword [rsp + 0x98], xmm15
mov rdx, qword [rax + 0x18]
nop
test rdx, rdx
je 0x44c3f9
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x80], rcx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x78], rdx
mov ebx, dword [rcx]
mov rax, rdx
call fcn.0044f1c0
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jne 0x44c12d
mov eax, 0xffffffff
jmp 0x44c15a
lea rdi, [rcx - 1]
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov ecx, 1
mov rsi, qword [rsp + 0x88]
call fcn.004504c0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
cmp eax, 0xffffffff
mov edx, 0
cmove eax, edx
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0xb8]
mov r10, qword [rdx + 0x38]
sub r10, qword [rdx + 0x28]
nop
test r10, r10
jbe 0x44c23e
mov r11, qword [rsp + 0x80]
cmp byte [r11 + 0x27], 1
ja 0x44c1a2
mov rbx, qword [rsp + 0x78]
xor r12d, r12d
jmp 0x44c1d8
lea r12, [r11 + 0x27]
mov r13d, dword [r11 + 0x1c]
lea r12, [r12 + r13*4]
lea r12, [r12 + 5]
mov r12d, dword [r12]
cmp r12d, 0xffffffff
sete r13b
mov rbx, qword [rsp + 0x78]
mov r15, qword [rbx + 0x130]
movzx r13d, r13b
dec r13
add r12, r15
and r12, r13
mov qword [rsp + 0x38], r10
nop dword [rax]
test r12, r12
je 0x44c65b
mov r13d, dword [r12]
test r13d, r13d
jle 0x44c65b
mov r10d, dword [r12 + 4]
nop dword [rax + rax]
test r10d, r10d
jle 0x44c236
mov qword [rsp + 0x68], r12
test eax, eax
jl 0x44c58e
cmp r13d, eax
jle 0x44c58e
nop
lea r13d, [r10 + 7]
sar r13d, 3
imul r13d, eax
movsxd r13, r13d
lea r12, [r12 + r13]
lea r12, [r12 + 8]
jmp 0x44c251
xor r10d, r10d
xor r12d, r12d
jmp 0x44c251
mov rbx, qword [rsp + 0x78]
mov r11, qword [rsp + 0x80]
xor r10d, r10d
xor r12d, r12d
mov r13, qword [rdx + 0x48]
test r13, r13
jbe 0x44c32a
mov r15, qword [rdx + 0x50]
test r15, r15
je 0x44c28a
mov eax, r10d
mov r10d, dword [r15]
shr r13, 3
cmp r10d, r13d
cmovg r10d, r13d
mov r13, qword [r15 + 8]
mov r15, r13
mov r13d, r10d
mov r10d, eax
jmp 0x44c330
cmp byte [r11 + 0x27], 0
ja 0x44c295
xor esi, esi
jmp 0x44c2d2
lea r13, [r11 + 0x27]
mov r15d, dword [r11 + 0x1c]
lea r13, [r13 + r15*4]
lea r13, [r13 + 1]
mov r13d, dword [r13]
cmp r13d, 0xffffffff
sete r15b
mov esi, r10d
mov r10, qword [rbx + 0x130]
movzx r15d, r15b
dec r15
add r10, r13
and r10, r15
mov rdi, r10
mov r10d, esi
mov rsi, rdi
test rsi, rsi
je 0x44c4ec
mov r13d, dword [rsi]
nop
test r13d, r13d
jle 0x44c4ec
mov qword [rsp + 0x60], rsi
test eax, eax
jl 0x44c421
cmp r13d, eax
jle 0x44c421
mov r13d, dword [rsi + 4]
test r13d, r13d
jle 0x44c322
lea r15d, [r13 + 7]
sar r15d, 3
imul eax, r15d
movsxd r15, eax
lea r15, [rsi + r15]
lea r15, [r15 + 8]
nop
jmp 0x44c330
xor r13d, r13d
xor r15d, r15d
jmp 0x44c330
xor r13d, r13d
xor r15d, r15d
cmp qword [rdx + 0x50], 0
je 0x44c362
lea rdx, [0x00759280]
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], 1
mov qword [rsp + 0xa0], 1
nop
jmp 0x44c3c5
cmp byte [r11 + 0x27], 2
ja 0x44c36d
xor edx, edx
jmp 0x44c3a0
lea rdx, [r11 + 0x27]
mov r11d, dword [r11 + 0x1c]
lea rdx, [rdx + r11*4]
lea rdx, [rdx + 9]
mov edx, dword [rdx]
cmp edx, 0xffffffff
sete r11b
mov eax, r10d
mov r10, qword [rbx + 0x130]
movzx r11d, r11b
dec r11
add rdx, r10
and rdx, r11
mov r10d, eax
test rdx, rdx
je 0x44c3c5
mov r11, qword [rdx]
nop
add rdx, 8
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], r11
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x90]
mov eax, r10d
mov rbx, r12
mov ecx, r13d
mov rdi, r15
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rsi, qword [rsp + 0x90]
xor eax, eax
xor ebx, ebx
mov ecx, eax
mov rdi, rbx
xor r8d, r8d
mov r9, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
nop
ret
mov rax, r11
call fcn.0044fe20
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x60]
movsxd rcx, dword [rcx]
mov qword [rsp + 0x50], rcx
call fcn.004372e0
lea rax, [0x005aef02]
mov ebx, 0x13
call fcn.00437be0
mov ecx, dword [rsp + 0x2c]
movsxd rax, ecx
nop dword [rax]
call fcn.004379e0
lea rax, [0x005ab4ba]
mov ebx, 5
call fcn.00437be0
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
call fcn.004379e0
lea rax, [0x005b21b5]
mov ebx, 0x1c
call fcn.00437be0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
call fcn.00437be0
lea rax, [0x005ac73e]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00437a40
lea rax, [0x005ab06d]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
lea rax, [0x005addcf]
mov ebx, 0x10
call fcn.00435b40
mov rax, r11
call fcn.0044fe20
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rcx + 0x40]
mov qword [rsp + 0x48], rdx
mov rcx, qword [rcx + 0x48]
mov qword [rsp + 0x40], rcx
call fcn.004372e0
lea rax, [0x005adad8]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
call fcn.00437be0
lea rax, [0x005ad43c]
mov ebx, 0xe
call fcn.00437be0
mov rax, qword [rsp + 0x48]
call fcn.00437a40
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
mov rax, qword [rsp + 0x40]
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005adeaf]
mov ebx, 0x10
call fcn.00435b40
mov rax, r11
call fcn.0044fe20
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x68]
movsxd rcx, dword [rcx]
mov qword [rsp + 0x50], rcx
call fcn.004372e0
lea rax, [0x005aef02]
mov ebx, 0x13
nop
call fcn.00437be0
mov ecx, dword [rsp + 0x2c]
movsxd rax, ecx
call fcn.004379e0
lea rax, [0x005ab4ba]
mov ebx, 5
nop dword [rax]
call fcn.00437be0
mov rax, qword [rsp + 0x50]
call fcn.004379e0
lea rax, [0x005b2daa]
mov ebx, 0x1e
nop dword [rax + rax]
call fcn.00437be0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
call fcn.00437be0
lea rax, [0x005ac73e]
mov ebx, 0xb
call fcn.00437be0
mov rax, qword [rsp + 0x30]
call fcn.00437a40
lea rax, [0x005ab06d]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
lea rax, [0x005addcf]
mov ebx, 0x10
call fcn.00435b40
mov rax, r11
nop
call fcn.0044fe20
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x48], rcx
call fcn.004372e0
lea rax, [0x005adad8]
mov ebx, 0xf
call fcn.00437be0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
call fcn.00437be0
lea rax, [0x005adb9f]
mov ebx, 0x10
call fcn.00437be0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
call fcn.00437a40
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
mov rax, qword [rsp + 0x38]
nop
call fcn.00437a40
call fcn.00437540
call fcn.00437360
lea rax, [0x005adeaf]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00435b40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.0044c0a0