Function at 0x413ca0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rdi, rax
or rax, rbx
or rax, rcx
nop word [rax + rax]
test rax, 7
jne 0x4140fa
cmp byte [0x007592a4], 0
je 0x413e2e
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rdi]
mov rdx, rax
shr rax, 0x16
shr rdx, 0x2a
cmp rdx, 0x40
jb 0x413cfe
xor r8d, r8d
jmp 0x413d47
lea r8, [0x0072b450]
mov r8, qword [r8 + rdx*8]
test r8, r8
je 0x413d44
mov r9, rax
and eax, 0xfffff
mov r8, qword [r8 + rax*8]
test r8, r8
je 0x413d3c
mov rax, rdi
shr rdi, 0xd
and edi, 0x1ff
mov r8, qword [r8 + rdi*8 + 0x20000]
mov rdi, rax
mov rax, r9
jmp 0x413d47
mov rax, r9
xor r8d, r8d
jmp 0x413d47
xor r8d, r8d
test r8, r8
je 0x413e10
mov sil, byte [r8 + 0x63]
cmp sil, 1
jne 0x413e06
nop
cmp qword [r8 + 0x18], rdi
ja 0x413e06
cmp qword [r8 + 0x70], rdi
jbe 0x413e06
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
cmp rdx, 0x40
jae 0x4140ed
lea r8, [0x0072b450]
mov rdx, qword [r8 + rdx*8]
test byte [rdx], al
mov r8, rax
and eax, 0xfffff
mov rdx, qword [rdx + rax*8]
test rdx, rdx
je 0x413dce
mov r9, rdi
shr rdi, 5
and edi, 0x1ffff
lea r10, [rdx + rdi]
mov r11, r9
shr r9, 3
and r9d, 3
add rdx, 0x1ffff
jmp 0x413ddc
mov r11, rdi
xor r8d, r8d
xor r9d, r9d
xor edx, edx
xor r10d, r10d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rsi
test rbx, rbx
jne 0x413dfa
xor eax, eax
jmp 0x413ff6
mov qword [rsp + 0x78], rbx
xor eax, eax
jmp 0x413ee8
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [0x00703fe0]
test rdx, rdx
je 0x413e25
mov r8, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x413e2a
xor edx, edx
xor r8d, r8d
xor eax, eax
jmp 0x413e40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
inc rax
nop dword [rax + rax]
cmp rdx, rax
jle 0x413e7a
mov r9, qword [r8 + rax*8]
mov r10, qword [r9 + 0xd0]
cmp rdi, r10
jb 0x413e38
cmp qword [r9 + 0xd8], rdi
jbe 0x413e38
mov rax, rdi
sub rdi, r10
mov rsi, qword [r9 + 0x1f8]
call fcn.00414320
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [0x00703fe0]
test rdx, rdx
je 0x413e8f
mov r8, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x413e94
xor edx, edx
xor r8d, r8d
xor eax, eax
jmp 0x413ea0
inc rax
nop dword [rax + rax]
cmp rdx, rax
jle 0x413eda
mov r9, qword [r8 + rax*8]
mov r10, qword [r9 + 0xe0]
cmp rdi, r10
jb 0x413e98
cmp qword [r9 + 0xe8], rdi
jbe 0x413e98
mov rax, rdi
sub rdi, r10
mov rsi, qword [r9 + 0x208]
call fcn.00414320
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
add rax, 8
cmp rcx, rax
jbe 0x413fe8
mov qword [rsp + 0x30], rax
movzx r12d, byte [r10]
bt r12d, r9d
nop
jae 0x413f8c
lea r12, [rax + r11]
lea r13, [rax + rbx]
mov r15, qword [rsi + 0x1260]
mov r12, qword [r12]
mov r13, qword [r13]
mov qword [r15], r12
mov qword [r15 + 8], r13
mov r12, qword [rsi + 0x1260]
add r12, 0x10
mov qword [rsi + 0x1260], r12
cmp qword [rsi + 0x1268], r12
jne 0x413f8c
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x2c], r8d
xor eax, eax
xor ebx, ebx
call fcn.0042ea00
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x40]
cmp r9d, 3
jae 0x413f9a
inc r9d
jmp 0x413ee4
cmp rdx, r10
je 0x413faa
inc r10
xor r9d, r9d
jmp 0x413ee4
mov rax, r10
mov ebx, r9d
mov ecx, r8d
mov rdi, rdx
call fcn.00413a80
mov rsi, qword [rsp + 0x58]
mov r11, qword [rsp + 0x40]
mov r8d, ecx
mov r9d, ebx
mov rdx, rdi
mov r10, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
jmp 0x413ee4
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
add rax, 8
cmp rcx, rax
jbe 0x413fe8
mov qword [rsp + 0x38], rax
movzx r12d, byte [r10]
bt r12d, r9d
jae 0x414091
lea r12, [rax + r11]
mov r13, qword [rsi + 0x1260]
mov r12, qword [r12]
mov qword [r13], r12
mov qword [r13 + 8], 0
mov r12, qword [rsi + 0x1260]
add r12, 0x10
mov qword [rsi + 0x1260], r12
nop dword [rax + rax]
cmp qword [rsi + 0x1268], r12
jne 0x414091
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x2c], r8d
mov dword [rsp + 0x28], r9d
xor eax, eax
xor ebx, ebx
call fcn.0042ea00
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x40]
cmp r9d, 3
jae 0x4140a0
inc r9d
jmp 0x413ff2
cmp rdx, r10
je 0x4140b0
inc r10
xor r9d, r9d
jmp 0x413ff2
mov rax, r10
mov ebx, r9d
mov ecx, r8d
mov rdi, rdx
nop dword [rax]
call fcn.00413a80
mov rsi, qword [rsp + 0x58]
mov r11, qword [rsp + 0x40]
mov r8d, ecx
mov r9d, ebx
mov rdx, rdi
mov r10, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
jmp 0x413ff2
mov rax, rdx
mov ecx, 0x40
call fcn.004622a0
lea rax, [0x005b5baa]
mov ebx, 0x28
call fcn.00435b40
nop
int3