Function at 0x43e340
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43e71b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x43e709
mov qword [rsp + 0x20], r14
cmp qword [rcx + 0x130], 0
je 0x43e397
call fcn.0043c820
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x130]
xor ebx, ebx
mov rax, rcx
call fcn.0043cc40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
cmp byte [rdx + 0xe8], 0
je 0x43e3b8
jmp 0x43e6f8
call fcn.0043ca80
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
test byte [rax], al
mov byte [rax + 0x22b0], 0
cmp dword [0x00705c40], 0
jne 0x43e6d5
cmp dword [rax + 0x2270], 0
je 0x43e3f6
mov qword [rsp + 0x30], rax
call fcn.0043b360
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
cmp byte [rdx + 0xe4], 0
je 0x43e42c
cmp qword [rax + 0x998], 0
jne 0x43e6e7
mov edx, dword [rax + 0x190]
nop word [rax + rax]
cmp dword [rax + 0x194], edx
jne 0x43e6e7
xor ebx, ebx
call fcn.0043e740
cmp byte [0x0070b1f0], 0
jne 0x43e445
cmp byte [0x0070b1f1], 0
je 0x43e482
call fcn.00453500
test rax, rax
je 0x43e47c
mov qword [rsp + 0x18], rax
mov ebx, 4
mov ecx, 1
nop
call fcn.00439ea0
mov rax, qword [rsp + 0x18]
xor ebx, ebx
call fcn.00454ae0
mov rdx, qword [rsp + 0x18]
test rdx, rdx
mov rax, rdx
setne cl
nop
jmp 0x43e486
xor eax, eax
xor ecx, ecx
test rax, rax
jne 0x43e4c1
cmp dword [0x0075902c], 0
je 0x43e4c1
mov byte [rsp + 0x15], cl
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rbx, qword [rdx + 0xa0]
lea rax, [0x007599c0]
call fcn.00420320
test rax, rax
setne cl
movzx edx, byte [rsp + 0x15]
or ecx, edx
mov byte [rsp + 0x17], cl
test rax, rax
je 0x43e4d1
mov rdx, qword [rsp + 0x20]
jmp 0x43e547
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rdx + 0x30]
mov rsi, qword [rsi + 0xa0]
mov esi, dword [rsi + 0x10]
imul esi, esi, 0xc10c9715
cmp esi, 0x4325c53
ja 0x43e547
cmp dword [0x00705bd0], 0
jle 0x43e547
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa0]
mov ebx, 1
nop
call fcn.00443c20
mov qword [rsp + 0x28], rax
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x43e550
xor ebx, ebx
jmp 0x43e56f
mov rcx, qword [rdx + 0x30]
mov rax, qword [rcx + 0xa0]
nop dword [rax + rax]
call fcn.004444e0
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
test rax, rax
jne 0x43e583
call fcn.0043cdc0
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
mov byte [rsp + 0x16], bl
mov qword [rsp + 0x28], rax
mov rsi, qword [rdx + 0x30]
cmp byte [rsi + 0xe4], 0
je 0x43e5b2
call fcn.0043dfa0
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x16]
cmp byte [0x00705bd8], 0
jne 0x43e5bf
xor esi, esi
jmp 0x43e5e2
mov ebx, 1
call fcn.00458ac0
xor eax, 1
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x16]
mov esi, eax
mov rax, qword [rsp + 0x28]
test sil, sil
je 0x43e69b
nop
nop
lea rax, [0x00705b78]
call fcn.0040b700
cmp byte [0x00705bd8], 0
jne 0x43e609
mov eax, 1
jmp 0x43e618
mov rax, qword [rsp + 0x28]
mov ebx, 1
call fcn.00458ac0
test al, al
jne 0x43e679
nop
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0xa0], 0
mov rdx, qword [0x00705be8]
test rdx, rdx
je 0x43e645
mov rbx, rcx
mov qword [rdx + 0xa0], rcx
jmp 0x43e653
nop
mov rdx, rcx
mov qword [0x00705be0], rcx
mov rbx, rdx
nop
mov qword [0x00705be8], rbx
inc dword [0x00705bf0]
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rcx, qword [rsp + 0x20]
jmp 0x43e3b8
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x17]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x16]
test cl, cl
je 0x43e6b4
nop
call fcn.0043c7a0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x16]
cmp qword [rax + 0xe8], 0
nop dword [rax]
jne 0x43e3ae
call fcn.0043cc40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.0043cb40
mov rax, qword [rsp + 0x20]
mov rcx, rax
jmp 0x43e3b8
lea rax, [0x005b45fd]
mov ebx, 0x22
call fcn.00435b40
lea rax, [0x005adf8f]
mov ebx, 0x10
call fcn.00435b40
lea rax, [0x005b0942]
mov ebx, 0x17
call fcn.00435b40
nop
nop dword [rax + rax]
call fcn.0045fba0
jmp fcn.0043e340