Function at 0x41a1a0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
lea r12, [rsp - 0x130]
cmp r12, qword [r14 + 0x10]
jbe 0x41ae26
sub rsp, 0x1b0
mov qword [rsp + 0x1a8], rbp
lea rbp, [rsp + 0x1a8]
mov eax, 2
lea rcx, [0x00759034]
xchg dword [rcx], eax
mov eax, dword [0x00759034]
nop dword [rax]
cmp eax, 1
jne 0x41a1ec
mov eax, 1
jmp 0x41a1f2
cmp eax, 2
sete al
movsd qword [rsp + 0xb0], xmm0
mov byte [0x007592a4], al
test al, al
je 0x41a20c
mov eax, 1
jmp 0x41a213
movzx eax, byte [0x007592a5]
mov byte [0x007592a0], al
mov rax, qword [0x00759a38]
mov qword [0x00705760], rax
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [r14 + 0x30]
nop
mov rcx, qword [rsp]
mov qword [rsp + 0x38], rcx
inc dword [rax + 0xd8]
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x180], rax
mov rdx, r14
test byte [rdx], al
mov qword [rax + 0xd0], 5
lea rdi, [rax + 0xc8]
mov qword [rsp + 0x1a0], rdi
cmp dword [0x007592a0], 0
jne 0x41a299
lea rdx, [0x005ab60e]
mov qword [rax + 0xc8], rdx
jmp 0x41a2a5
lea rdx, [0x005ab60e]
call fcn.00461f00
mov qword [rsp + 0x190], r14
mov rdx, qword [r14 + 0x30]
mov byte [rdx + 0xf9], 2
mov rdx, qword [r14 + 0x30]
mov rax, qword [rdx + 0x90]
mov qword [rsp + 0x188], rax
mov ebx, 2
mov ecx, 4
call fcn.00439ea0
mov rdx, qword [rsp + 0x188]
mov byte [rdx + 0xb0], 6
movups xmmword [rsp + 0xb8], xmm15
lea rsi, [0x0041ae40]
mov qword [rsp + 0xb8], rsi
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0xc0], rsi
lea rsi, [rsp + 0xb8]
mov qword [rsp], rsi
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
lea rdx, [0x005c5c60]
mov qword [rsp], rdx
nop
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x190]
mov rdx, qword [rdx + 0x30]
mov byte [rdx + 0xf9], 0
mov rax, qword [rsp + 0x188]
mov ebx, 4
mov ecx, 2
nop
call fcn.00439ea0
cmp byte [0x0070b1f0], 0
je 0x41a3a7
nop
mov eax, 8
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00453680
mov rcx, qword [rsp + 0x180]
mov qword [rcx + 0xd0], 0
cmp dword [0x007592a0], 0
jne 0x41a3d0
mov qword [rcx + 0xc8], 0
jmp 0x41a3df
mov rdi, qword [rsp + 0x1a0]
xor edx, edx
call fcn.00461f00
cmp dword [0x00759034], 0
jne 0x41ae0f
mov rcx, qword [0x0075ad98]
mov qword [0x0075c4a0], rcx
lea rax, [0x007599c0]
movsd xmm0, qword [rsp + 0xb0]
call fcn.004207c0
mov rax, qword [0x007599d8]
call 0x424980
mov rax, qword [0x00759a28]
mov rbx, qword [0x00759a30]
call fcn.00420c60
nop
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp]
mov qword [rsp + 0x30], rcx
call fcn.00463be0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp]
movsxd rdx, dword [rsp + 8]
mov rbx, qword [0x00705750]
mov rsi, qword [rsp + 0x30]
mov rdi, rsi
sub rsi, rbx
add qword [0x00705748], rsi
mov qword [0x00705740], rdi
imul rcx, rcx, 0x3b9aca00
add rcx, rdx
mov rdx, qword [0x00705750]
mov rbx, rdi
sub rdi, rdx
test rdi, rdi
jge 0x41a4c5
mov edx, 1
lea rsi, [0x0075e918]
lock xadd qword [rsi], rdx
jmp 0x41a562
cmp rdi, 0x10
jl 0x41a533
bsr rdx, rdi
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx - 3]
mov r8, rsi
shl rsi, 4
cmp rsi, 0x2d0
jb 0x41a4fb
mov r8d, 0x2c
mov edx, 0xf
jmp 0x41a539
add rdx, 0xfffffffffffffffc
cmp rdx, 0x40
sbb r9, r9
not r9
or rdx, r9
mov rax, rcx
mov rcx, rdx
sar rdi, cl
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3c
add rdi, rdx
sar rdi, 4
shl rdi, 4
sub rdx, rdi
mov rcx, rax
jmp 0x41a539
xor r8d, r8d
mov rdx, rdi
shl r8, 4
lea rax, [r8 + rdx]
cmp rax, 0x2d0
jae 0x41ae05
lea rdx, [0x0075d298]
lea rdx, [rdx + rax*8]
mov esi, 1
lock xadd qword [rdx], rsi
lea rdx, [0x0075ae08]
mov rsi, rcx
xchg qword [rdx], rcx
lea rcx, [0x0075c498]
mov rdx, rbx
xchg qword [rcx], rbx
movzx ecx, byte [0x0075be18]
mov rbx, qword [0x00705748]
lea rdi, [0x0075ae18]
mov qword [rdi + rcx*8], rbx
movzx ecx, byte [0x0075be18]
lea rbx, [0x0075b618]
mov qword [rbx + rcx*8], rsi
mov rcx, qword [0x00705748]
add qword [0x0075ae10], rcx
movsxd rcx, dword [0x0070571c]
mov rbx, qword [0x00705730]
sub rbx, qword [0x00705728]
imul rbx, rcx
mov qword [rsp + 0x40], rbx
mov rsi, qword [0x00759a98]
add rsi, qword [0x00759a90]
add rsi, qword [0x00759aa0]
mov rdi, qword [0x00705740]
sub rdi, qword [0x00705738]
imul rdi, rcx
mov qword [rsp + 0x58], rdi
lea rcx, [rsi + rbx]
add rcx, rdi
add rcx, qword [0x007056e0]
mov qword [0x007056e0], rcx
mov rsi, qword [0x00705c80]
sub rdx, rsi
movsxd rsi, dword [0x00759038]
imul rdx, rsi
add rdx, qword [0x00705c88]
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
xorps xmm1, xmm1
cvtsi2sd xmm1, rdx
divsd xmm0, xmm1
movsd qword [0x0075be20], xmm0
mov qword [0x007051b4], 0
cmp byte [0x007056d8], 0
nop
je 0x41a668
inc dword [0x0075be1c]
nop
nop
lea rax, [0x00705708]
call fcn.0040b700
inc dword [0x0075be18]
lea rax, [0x00705710]
call fcn.0043e020
nop
nop
lea rax, [0x00705708]
call fcn.0040b920
call fcn.0042c620
nop
mov ecx, dword [0x007051bc]
mov eax, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x41a6ce
lea edx, [rax + 1]
lea rsi, [0x007051bc]
lock cmpxchg dword [rsi], edx
sete dl
nop
test dl, dl
je 0x41a69b
mov edx, dword [0x0072b3f0]
test ecx, ecx
jmp 0x41a6d4
mov edx, dword [0x0072b3f0]
jne 0x41adf3
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x28], edx
lea rax, [0x005c5c68]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.0042c6a0
call fcn.004255a0
lea rax, [0x005c5c30]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
lea rax, [0x005c5c78]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
test eax, eax
sete cl
lea rax, [0x007051bc]
mov ebx, dword [rsp + 0x28]
call fcn.00423060
cmp dword [0x007594fc], 0
jle 0x41a7d8
movsd xmm0, qword [0x005f60b0]
mulsd xmm0, qword [0x0075be20]
movsd qword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc8], xmm15
movups xmmword [rsp + 0xd0], xmm15
call fcn.004372e0
mov rax, qword [0x00705728]
sub rax, qword [0x007591b0]
mov rcx, rax
movabs rax, 0x8637bd05af6c69b6
mul rcx
shr rdx, 0x13
mov eax, 0x17
jmp 0x41a840
lea rax, [0x006e1198]
xor ebx, ebx
xor ecx, ecx
call fcn.00447820
nop
lea rax, [0x006e1190]
xor ebx, ebx
xor ecx, ecx
call fcn.00447820
nop
mov rdx, qword [rsp + 0x180]
mov esi, dword [rdx + 0xd8]
lea edi, [rsi - 1]
mov dword [rdx + 0xd8], edi
cmp esi, 1
jne 0x41a82a
cmp byte [r14 + 0xb1], 0
nop
je 0x41a82a
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x1a8]
add rsp, 0x1b0
ret
mov rax, rsi
nop dword [rax]
cmp rdx, 0xa
jae 0x41a84c
cmp rax, 0x14
jl 0x41a8a0
mov rcx, rax
movabs rax, 0xcccccccccccccccd
mov rbx, rdx
mul rdx
shr rdx, 3
lea rsi, [rdx + rdx*4]
shl rsi, 1
sub rbx, rsi
cmp rcx, 0x18
jae 0x41ade6
lea rsi, [rbx + 0x30]
mov byte [rsp + rcx + 0xc8], sil
lea rsi, [rcx - 1]
cmp rcx, 0x15
jne 0x41a83a
mov byte [rsp + rcx + 0xc7], 0x2e
lea rsi, [rcx - 2]
jmp 0x41a83a
cmp rax, 0x18
jae 0x41addc
add rdx, 0x30
mov byte [rsp + rax + 0xc8], dl
mov edx, dword [0x0075be18]
mov qword [rsp + 0xa8], rdx
lea rcx, [rax - 0x18]
mov rsi, rcx
sar rcx, 0x3f
and rax, rcx
lea rbx, [rsp + rax + 0xc8]
neg rsi
lea rax, [rsp + 0x138]
mov rcx, rsi
call fcn.0044cec0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0xa0], rbx
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ab27c]
mov ebx, 3
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
nop
call fcn.004378e0
lea rax, [0x005ab053]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xa0]
call fcn.00437be0
lea rax, [0x005ab10d]
mov ebx, 2
call fcn.00437be0
movsd xmm0, qword [rsp + 0xb0]
cvttsd2si rax, xmm0
call fcn.004379e0
lea rax, [0x005ab147]
mov ebx, 3
nop dword [rax + rax]
call fcn.00437be0
call fcn.00437360
mov rdx, qword [0x00705728]
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xe8], xmm15
mov rsi, qword [0x00705730]
mov qword [rsp + 0xe0], rsi
mov rsi, qword [0x00705738]
mov qword [rsp + 0xe8], rsi
mov rsi, qword [0x00705740]
mov qword [rsp + 0xf0], rsi
xor eax, eax
jmp 0x41aa40
sub rdi, rdx
lea rax, [rsp + 0xc8]
mov ebx, 0x18
mov rcx, rbx
call fcn.0041be40
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x118]
call fcn.0044cec0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0xa0], rbx
call fcn.004372e0
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xa0]
call fcn.00437be0
call fcn.00437360
mov rdx, qword [rsp + 0x68]
lea rax, [rdx + 1]
mov rdx, qword [rsp + 0x48]
nop dword [rax]
cmp rax, 3
jge 0x41aaa0
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + rax*8 + 0xe0]
mov qword [rsp + 0x48], rdi
nop dword [rax + rax]
test rax, rax
je 0x41a9d4
mov qword [rsp + 0x98], rdx
call fcn.004372e0
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
call fcn.00437360
mov rdx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x48]
jmp 0x41a9d4
call fcn.004372e0
lea rax, [0x005ac7a1]
mov ebx, 0xb
call fcn.00437be0
call fcn.00437360
movups xmmword [rsp + 0x158], xmm15
movups xmmword [rsp + 0x160], xmm15
movups xmmword [rsp + 0x170], xmm15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x158], rax
mov rax, qword [0x00759a90]
mov qword [rsp + 0x160], rax
mov rax, qword [0x00759aa0]
add rax, qword [0x00759a98]
mov qword [rsp + 0x168], rax
mov rax, qword [0x00759aa8]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x178], rax
xor eax, eax
jmp 0x41ab88
lea rax, [rsp + 0xc8]
mov ebx, 0x18
mov rcx, rbx
call fcn.0041be40
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0xf8]
call fcn.0044cec0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0xa0], rbx
call fcn.004372e0
mov rax, qword [rsp + 0x198]
mov rbx, qword [rsp + 0xa0]
call fcn.00437be0
call fcn.00437360
mov rdx, qword [rsp + 0x60]
lea rax, [rdx + 1]
cmp rax, 5
jge 0x41ac0a
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + rax*8 + 0x158]
mov qword [rsp + 0x50], rdi
cmp rax, 2
je 0x41abac
cmp rax, 3
jne 0x41abd4
call fcn.004372e0
lea rax, [0x005ab033]
mov ebx, 1
nop dword [rax]
call fcn.00437be0
call fcn.00437360
mov rdi, qword [rsp + 0x50]
jmp 0x41ab28
test rax, rax
je 0x41ab28
nop dword [rax]
call fcn.004372e0
lea rax, [0x005ab02f]
mov ebx, 1
call fcn.00437be0
call fcn.00437360
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
jmp 0x41ab28
mov rax, qword [0x00705758]
mov qword [rsp + 0xa8], rax
mov rcx, qword [0x00705760]
mov qword [rsp + 0x90], rcx
mov rdx, qword [0x00705768]
mov qword [rsp + 0x88], rdx
mov rbx, qword [0x00705770]
mov qword [rsp + 0x80], rbx
mov rsi, qword [0x00759a50]
mov qword [rsp + 0x78], rsi
mov rdi, qword [0x00759a60]
mov qword [rsp + 0x70], rdi
movsxd r8, dword [0x00705720]
mov qword [rsp + 0x98], r8
call fcn.004372e0
lea rax, [0x005ac080]
mov ebx, 9
nop
call fcn.00437be0
mov rax, qword [rsp + 0xa8]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ab079]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x90]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ab079]
mov ebx, 2
call fcn.00437be0
mov rax, qword [rsp + 0x88]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ab4b5]
mov ebx, 5
call fcn.00437be0
mov rax, qword [rsp + 0x80]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ac390]
mov ebx, 0xa
call fcn.00437be0
mov rax, qword [rsp + 0x78]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005acbd9]
mov ebx, 0xc
call fcn.00437be0
mov rax, qword [rsp + 0x70]
shr rax, 0x14
call fcn.004378e0
lea rax, [0x005ad081]
mov ebx, 0xd
call fcn.00437be0
mov rax, qword [rsp + 0x98]
call fcn.004379e0
lea rax, [0x005ab055]
mov ebx, 2
call fcn.00437be0
call fcn.00437360
cmp byte [0x007056d8], 0
je 0x41ad92
call fcn.004372e0
lea rax, [0x005ac01d]
mov ebx, 9
call fcn.00437be0
call fcn.00437360
call fcn.004372e0
call fcn.00437540
nop dword [rax]
call fcn.00437360
mov rax, qword [r14 + 0x30]
nop
movzx ecx, byte [rax + 0xe7]
lea edx, [rcx - 1]
mov byte [rax + 0xe7], dl
nop word [rax + rax]
cmp cl, 1
jne 0x41a7d8
nop
nop
lea rax, [0x007590d8]
call fcn.0040b920
jmp 0x41a7d8
mov ecx, 0x18
call fcn.00462280
mov rax, rcx
mov ecx, 0x18
call fcn.00462280
lea rax, [0x005b1d61]
mov ebx, 0x1b
nop
call fcn.00435b40
mov ecx, 0x2d0
call fcn.004622a0
lea rax, [0x005b2957]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00435b40
nop
movsd qword [rsp + 8], xmm0
call fcn.0045fba0
movsd xmm0, qword [rsp + 8]
jmp fcn.0041a1a0