Function at 0x410b40
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x410e19
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x48], ecx
nop dword [rax]
test rbx, rbx
je 0x410e05
movzx ecx, byte [rbx + 8]
test cl, 4
jne 0x410df4
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x48]
mov rbx, rsi
call rcx
mov qword [rsp + 0x18], rax
mov rbx, qword [rsp + 0x40]
movzx ecx, byte [rbx + 8]
xor ecx, 4
mov byte [rbx + 8], cl
cmp qword [rbx + 0x10], 0
jne 0x410bec
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rdx + 0x40]
mov rax, qword [rbx]
mov ecx, 1
call fcn.0040cde0
cmp dword [0x007592a0], 0
jne 0x410bd9
mov rbx, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
jmp 0x410be7
mov rbx, qword [rsp + 0x40]
lea rdi, [rbx + 0x10]
call fcn.00461de0
mov rax, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x38]
jmp 0x410c12
mov rax, rdx
call fcn.0040fee0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rdx, qword [rsp + 0x38]
movzx ecx, byte [rbx + 9]
mov esi, 1
shl rsi, cl
lea rcx, [rsi - 1]
and rcx, rax
cmp qword [rbx + 0x18], 0
je 0x410c4d
mov qword [rsp + 0x20], rcx
mov rax, rdx
call fcn.00410e40
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
movzx esi, word [rdx + 0x52]
imul rcx, rsi
add rcx, qword [rbx + 0x10]
xor edi, edi
xor r8d, r8d
nop
jmp 0x410cd9
mov r11, r9
mov rcx, rdi
mov r9, r8
cmp qword [rbx + 0x18], 0
jne 0x410d5f
mov rsi, qword [rbx]
inc rsi
movzx edi, byte [rbx + 9]
cmp rsi, 8
jle 0x410cab
mov r8, rcx
mov ecx, edi
mov r10d, 1
shl r10, cl
shr r10, 1
lea r12, [r10 + r10*2]
lea r10, [r10 + r12*4]
nop
cmp r10, rsi
jb 0x410bf3
jmp 0x410cb0
mov r8, rcx
mov ecx, edi
movzx esi, word [rbx + 0xa]
cmp cl, 0xf
jbe 0x410cbe
mov ecx, 0xf
and ecx, 0xf
mov edi, 1
shl edi, cl
cmp si, di
jae 0x410bf3
jmp 0x410d62
mov rcx, r10
xor r9d, r9d
jmp 0x410d06
mov r9, rcx
lea r10, [rcx + rsi]
lea r10, [r10 - 8]
mov r10, qword [r10]
test r10, r10
jne 0x410cd6
jmp 0x410c62
lea r10, [rdi + 1]
mov rdi, rcx
mov r8, r9
mov rcx, r11
mov r9, r10
cmp r9, 8
jae 0x410cde
test byte [rcx], al
movzx r10d, byte [rcx + r9]
cmp r10b, 1
ja 0x410d34
test rdi, rdi
mov r11, rcx
cmovne rcx, rdi
mov rdi, r9
cmovne r9, r8
test r10b, r10b
jne 0x410cf6
jmp 0x410c6b
mov r10, rcx
lea r11, [rcx + r9*4]
lea r11, [r11 + 8]
mov r11d, dword [r11]
cmp dword [rsp + 0x48], r11d
je 0x410d57
mov r11, r10
mov rcx, rdi
mov rdi, r9
mov r9, r8
jmp 0x410cf6
mov rcx, r10
mov rsi, r9
jmp 0x410dba
mov r8, rcx
test r8, r8
jne 0x410d8a
mov rax, rbx
mov rbx, rdx
mov rcx, r11
call fcn.0040e020
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov r8, rax
xor r9d, r9d
mov rax, qword [rsp + 0x18]
shr rax, 0x38
cmp al, 5
jae 0x410d95
add eax, 5
test byte [r8], al
mov rsi, r9
and r9d, 7
mov byte [r8 + r9], al
mov rcx, r8
lea rdi, [r8 + rsi*4]
lea rdi, [rdi + 8]
nop
mov r8d, dword [rsp + 0x48]
mov dword [rdi], r8d
inc qword [rbx]
movzx edx, byte [rdx + 0x51]
imul rsi, rdx
movzx edx, byte [rbx + 8]
lea rax, [rsi + rcx]
lea rax, [rax + 0x28]
test dl, 4
je 0x410de3
and edx, 0xfffffffb
mov byte [rbx + 8], dl
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x005af9a6]
mov ebx, 0x15
call fcn.00435b40
lea rax, [0x005af9a6]
mov ebx, 0x15
call fcn.00435b40
lea rax, [0x00586de0]
lea rbx, [0x005f6b40]
call fcn.004353c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.0045fba0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00410b40