Function at 0x4386a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0xd8]
mov rsi, qword [r14 + 0x30]
mov r8, qword [rsi + 0xa0]
mov r9, r14
test byte [r9], al
cmp qword [r8 + 0x9b8], 0
jne 0x438705
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x58], r8
nop
lea rax, [0x00705c18]
call fcn.0040b700
mov rcx, qword [rsp + 0x58]
lea rdx, [rcx + 0x9b0]
mov qword [rsp + 0x50], rdx
nop dword [rax]
jmp 0x4387c5
mov rcx, qword [r8 + 0x9b8]
mov r9, qword [r8 + 0x9b0]
lea rax, [rcx - 1]
nop word [rax + rax]
cmp rcx, rax
jbe 0x4387c0
mov r10, qword [r9 + rcx*8 - 8]
lea rdi, [r9 + rcx*8]
lea rdi, [rdi - 8]
cmp dword [0x007592a0], 0
jne 0x43874a
mov qword [r9 + rcx*8 - 8], 0
jmp 0x438752
xor r9d, r9d
call fcn.00461f80
mov rdx, qword [r8 + 0x9c0]
cmp rdx, rax
jb 0x4387b5
mov qword [r8 + 0x9b8], rax
cmp qword [r10 + 0x18], 0
jne 0x4387a4
nop
mov ecx, dword [rsi + 0xd8]
lea edx, [rcx - 1]
mov dword [rsi + 0xd8], edx
nop dword [rax]
cmp ecx, 1
jne 0x438797
cmp byte [r14 + 0xb1], 0
je 0x438797
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, r10
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x005b6377]
mov ebx, 0x2a
call fcn.00435b40
mov rcx, rax
call fcn.00462300
nop dword [rax]
call fcn.00462280
mov r8, qword [rcx + 0x9c0]
shr r8, 1
cmp qword [rcx + 0x9b8], r8
jge 0x4388c5
mov r8, qword [0x00705c20]
test r8, r8
je 0x4388c5
mov r9, qword [r8 + 8]
cmp dword [0x007592a0], 0
jne 0x43880a
mov qword [0x00705c20], r9
mov qword [r8 + 8], 0
jmp 0x438825
lea rdi, [0x00705c20]
call fcn.00461f80
lea rdi, [r8 + 8]
xor r9d, r9d
nop dword [rax]
call fcn.00461f80
mov r9, qword [rcx + 0x9b8]
lea rsi, [r9 + 1]
mov rbx, qword [rcx + 0x9b0]
mov rdi, qword [rcx + 0x9c0]
nop
cmp rdi, rsi
jae 0x438897
mov qword [rsp + 0x48], r8
lea rax, [0x00574260]
mov rcx, r9
call fcn.004490a0
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x9c0], rcx
cmp dword [0x007592a0], 0
jne 0x43887c
mov qword [rdx + 0x9b0], rax
mov rdi, qword [rsp + 0x50]
jmp 0x438886
mov rdi, qword [rsp + 0x50]
call fcn.00461de0
mov rcx, rdx
mov rdx, rdi
mov r8, qword [rsp + 0x48]
mov r9, rbx
mov rbx, rax
lea r10, [r9 + 1]
mov qword [rcx + 0x9b8], r10
lea rdi, [rbx + r9*8]
cmp dword [0x007592a0], 0
jne 0x4388b8
mov qword [rbx + r9*8], r8
jmp 0x4387c5
call fcn.00461f60
nop dword [rax]
jmp 0x4387c5
nop
nop
lea rax, [0x00705c18]
call fcn.0040b920
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + 0x9b8], 0
jne 0x438985
lea rax, [0x005a0a60]
call fcn.0040d7e0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x9b8]
mov rbx, qword [rcx + 0x9b0]
mov rdi, qword [rcx + 0x9c0]
lea rsi, [rdx + 1]
cmp rdi, rsi
jae 0x43895f
mov qword [rsp + 0x48], rax
lea rax, [0x00574260]
mov rcx, rdx
call fcn.004490a0
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x9c0], rcx
cmp dword [0x007592a0], 0
jne 0x438947
mov qword [rdx + 0x9b0], rax
jmp 0x438951
mov rdi, qword [rsp + 0x50]
call fcn.00461de0
mov rcx, rdx
mov rdx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
lea rsi, [rdx + 1]
mov qword [rcx + 0x9b8], rsi
lea rdi, [rbx + rdx*8]
cmp dword [0x007592a0], 0
jne 0x438980
mov qword [rbx + rdx*8], rax
jmp 0x438985
call fcn.00461de0
mov rsi, qword [rsp + 0x40]
mov r8, rcx
jmp 0x438705