Function at 0x404f80
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rdx, qword [rax + 8]
cmp rcx, rdx
jae 0x404fe1
sub rdx, rcx
cmp rdi, rdx
cmova rdi, rdx
movzx edx, byte [rax + 0x17]
test dl, 0x40
je 0x404fc8
mov rdx, qword [0x00703fe0]
test rdx, rdx
je 0x404fbf
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x404fc3
xor edx, edx
xor esi, esi
xor r8d, r8d
jmp 0x404ff1
mov rdx, qword [rax + 0x20]
mov rax, rbx
mov rbx, rdx
call fcn.00405320
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
inc r8
mov rbx, r12
cmp rdx, r8
jle 0x405085
mov r9, qword [rsi + r8*8]
mov r10, qword [r9 + 0xd0]
mov r11, qword [r9 + 0xd8]
mov r12, rbx
cmp rbx, r10
jb 0x405019
cmp rbx, r11
jb 0x405033
mov r10, qword [r9 + 0xe0]
mov r11, qword [r9 + 0xe8]
cmp rbx, r10
jb 0x404feb
cmp rbx, r11
jae 0x404feb
jmp 0x40505c
mov rdx, rbx
sub rbx, r10
sub r10, rdx
mov rdx, qword [r9 + 0x1f8]
add rcx, rbx
lea rax, [r10 + r12]
mov rbx, rdx
call fcn.00405320
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rdx, rbx
sub rbx, r10
sub r10, rdx
mov rdx, qword [r9 + 0x208]
add rcx, rbx
lea rax, [r10 + r12]
mov rbx, rdx
call fcn.00405320
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rdx, rbx
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rbx]
mov r9, r8
shr r8, 0x2a
nop
cmp r8, 0x40
jae 0x4052b3
lea r10, [0x0072b450]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
shr rbx, 0xd
and ebx, 0x1ff
mov r11, qword [r9 + rbx*8 + 0x20000]
test byte [r8], al
test byte [r9], al
mov r8b, byte [r11 + 0x63]
cmp r8b, 2
je 0x40515e
mov r8, rdx
nop
lea rax, [rsi + rdx]
mov rsi, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4052a9
mov r9, qword [r10 + rax*8]
test byte [r9], al
shr rsi, 0x16
mov r10, rsi
and esi, 0xfffff
mov rsi, qword [r9 + rsi*8]
test rsi, rsi
je 0x40513d
mov r9, rdx
shr rdx, 5
and edx, 0x1ffff
add rdx, rsi
shr r9, 3
and r9d, 3
lea r11, [rsi + 0x1ffff]
jmp 0x405148
xor r10d, r10d
xor r9d, r9d
xor r11d, r11d
xor edx, edx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x30], rdi
xor eax, eax
jmp 0x4051c3
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
lea rbx, [0x004052e0]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x50]
mov qword [rsp], rax
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
add rax, 8
mov r9d, esi
lea rsi, [rdi + rcx]
cmp rax, rsi
jae 0x40528e
mov qword [rsp + 0x28], rax
movzx esi, byte [rdx]
cmp rcx, rax
ja 0x405238
bt esi, r9d
jae 0x405238
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x24], r10d
mov dword [rsp + 0x20], r9d
mov rcx, qword [r8 + rax]
mov rax, rcx
nop
call fcn.00404b80
test al, al
jne 0x405298
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x20]
mov r10d, dword [rsp + 0x24]
mov r11, qword [rsp + 0x38]
cmp r9d, 3
jae 0x405247
lea esi, [r9 + 1]
jmp 0x4051bc
cmp r11, rdx
je 0x405256
inc rdx
xor esi, esi
jmp 0x4051bc
mov rax, rdx
mov ebx, r9d
mov ecx, r10d
mov rdi, r11
call fcn.00413a80
mov r8, qword [rsp + 0x48]
mov r10d, ecx
mov esi, ebx
mov rdx, rax
mov r11, rdi
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x30]
jmp 0x4051bc
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x005b4bde]
mov ebx, 0x24
call fcn.00435b40
mov ecx, 0x40
call fcn.004622a0
mov rax, r8
mov ecx, 0x40
nop dword [rax + rax]
call fcn.004622a0
nop
int3