Function at 0x6adc0b50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov esi, dword [esp + 0x80]
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.6adc0100
mov ebx, eax
test eax, eax
je 0x6adc1078
movzx eax, word [eax]
test ax, ax
je 0x6ae0ea90
cmp word [ebx + 2], 0x3a
jne 0x6ae0ea90
cmp word [ebx + 4], 0x5c
jne 0x6ae0ea90
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 4], str._lc:_
mov dword [esp + 0x28], eax
call eax
mov dword [esp + 4], 0x68
mov dword [esp], 1
call fcn.6adab440
mov esi, eax
test eax, eax
je 0x6adc1078
cmp byte [0x6ae67079], 0
je 0x6adc0f20
lea eax, [esp + 0x34]
mov dword [esp], eax
call dword [0x6ae67070]
sub esp, 4
test eax, eax
js 0x6ae0eaf9
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov dword [esi + 4], edi
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [eax + 0x14]
sub esp, 8
test eax, eax
js 0x6ae0eac7
mov eax, dword [edi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 5
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [eax + 0x18]
sub esp, 0x14
test eax, eax
js 0x6ae0eaae
lea ebp, [esp + 0x40]
cmp byte [0x6ae67078], 0
mov eax, dword [edi]
mov dword [esp], edi
mov dword [esp + 4], ebp
jne 0x6adc0e88
call dword [eax + 0x90]
sub esp, 8
test eax, eax
js 0x6ae0eae0
cmp byte [0x6ae67078], 0
mov eax, dword [edi]
je 0x6adc0ec0
lea ecx, [esp + 0x38]
mov eax, dword [eax + 0x88]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], ecx
mov dword [esp], edi
call eax
sub esp, 0x1c
test eax, eax
js 0x6ae0e997
lea ebp, [esp + 0x50]
cmp byte [0x6ae67078], 0
mov eax, dword [edi]
mov dword [esp], edi
mov dword [esp + 4], ebp
je 0x6adc0eb0
call dword [eax + 0x34]
sub esp, 8
test eax, eax
js 0x6ae0e9ad
mov eax, dword [esp + 0x50]
call fcn.6adc0a50
test eax, eax
js 0x6ae0e9f7
cmp byte [0x6ae67078], 0
mov eax, dword [edi]
mov dword [esp + 4], ebp
mov dword [esp], edi
je 0x6adc0ea0
call dword [eax + 0x8c]
sub esp, 8
test eax, eax
js 0x6ae0ea09
mov eax, dword [esp + 0x50]
call fcn.6adc0a50
test eax, eax
js 0x6ae0ea39
mov eax, dword [esp + 0x34]
lea ecx, [esi + 8]
cmp byte [0x6ae67078], 0
mov edx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], ecx
je 0x6adc1050
call dword [edx + 0xa0]
sub esp, 0x18
test eax, eax
js 0x6ae0ea4e
mov dword [esp + 8], 4
mov dword [esp + 4], 0x6ae25f02
mov eax, dword [esi + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_wcsncmp
mov edi, eax
test eax, eax
jne 0x6ae0ea63
mov eax, dword [esi + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea edx, [ebx + 6]
mov dword [esp], edx
mov ebp, eax
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_wcslen
mov edx, dword [esp + 0x84]
lea ebp, [ebp + eax + 2]
mov eax, dword [esp + 0x84]
add ebp, ebp
mov word [eax + 2], bp
lea eax, [ebp - 2]
movzx ebp, bp
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov edx, dword [esp + 0x84]
mov dword [edx + 4], eax
test eax, eax
je 0x6adc1060
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov ecx, dword [esi + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
lea edx, [ecx + 8]
mov dword [esp + 4], str.___ls_ls
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0x88]
mov dword [esi], 1
mov dword [eax], esi
mov dword [esp], ebx
call fcn.6adab410
add esp, 0x6c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [eax + 0x84]
sub esp, 8
jmp 0x6adc0c73
call dword [eax + 0x98]
sub esp, 8
jmp 0x6adc0d44
call dword [eax + 0x38]
sub esp, 8
jmp 0x6adc0d0c
lea edx, [esp + 0x38]
mov eax, dword [eax + 0x94]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
sub esp, 0x1c
jmp 0x6adc0ce4
mov dword [esp], 0x6ae0f020
call fcn.6ae06e50
movzx edi, byte [0x6ae67079]
mov eax, edi
test al, al
je 0x6adc0f60
mov dword [esp], 0x6ae0f020
call fcn.6ae07190
cmp byte [0x6ae67079], 0
jne 0x6adc0be3
jmp 0x6ae0ea7b
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp], str.vssapi.dll
mov dword [esp + 0x2c], eax
call eax
mov dword [0x6ae67074], eax
sub esp, 4
test eax, eax
je 0x6ae0e950
mov dword [esp + 4], str.CreateVssBackupComponentsInternal
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
call ebp
mov dword [0x6ae67070], eax
sub esp, 8
test eax, eax
je 0x6adc10b0
mov byte [0x6ae67078], 0
mov eax, dword [0x6ae67074]
mov dword [esp + 4], str.VssFreeSnapshotPropertiesInternal
mov dword [esp], eax
call ebp
mov dword [0x6ae6706c], eax
sub esp, 8
test eax, eax
je 0x6adc1088
mov dword [esp], str.ole32.dll
mov eax, dword [esp + 0x2c]
call eax
mov dword [0x6ae67068], eax
sub esp, 4
test eax, eax
je 0x6ae0eb42
mov dword [esp + 4], str.CoInitialize
mov dword [esp], eax
call ebp
mov dword [0x6ae67064], eax
sub esp, 8
test eax, eax
je 0x6ae0eb34
mov eax, dword [0x6ae67068]
mov dword [esp + 4], str.CoUninitialize
mov dword [esp], eax
call ebp
mov dword [0x6ae67060], eax
sub esp, 8
test eax, eax
je 0x6ae0eb12
mov dword [esp], 0
mov edi, 1
call dword [0x6ae67064]
sub esp, 4
mov eax, edi
mov byte [0x6ae67079], al
jmp 0x6adc0f39
call dword [edx + 0xa8]
sub esp, 0x18
jmp 0x6adc0da3
mov edi, 0x27
mov dword [esp], esi
call fcn.6adc0b10
jmp 0x6adc0e6f
mov edi, 0x27
jmp 0x6adc0e6f
mov eax, dword [0x6ae67074]
mov dword [esp + 4], str.VssFreeSnapshotProperties
mov dword [esp], eax
call ebp
mov dword [0x6ae6706c], eax
sub esp, 8
test eax, eax
jne 0x6adc0fce
jmp 0x6ae0e961
mov eax, dword [0x6ae67074]
mov dword [esp + 4], str._CreateVssBackupComponents__YGJPAPAVIVssBackupComponents___Z
mov dword [esp], eax
call ebp
mov dword [0x6ae67070], eax
sub esp, 8
test eax, eax
je 0x6ae0e983
mov byte [0x6ae67078], 1
jmp 0x6adc0fac
mov dword [esp], str.vssapi.dll_not_found
call fcn.6ae0b475
jmp 0x6adc103f
mov dword [esp], str.VssFreeSnapshotProperties___not_found_in_vssapi.dll
call fcn.6ae0b475
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x6ae67074]
mov dword [esp], eax
call ebp
push edx
jmp 0x6adc103f
mov dword [esp], str.CreateVssBackupComponents___not_found_in_vssapi.dll
call fcn.6ae0b475
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x6ae0e973
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.AddToSnapshotSet___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.PrepareForBackup___error:__x
call fcn.6ae0b475
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
push eax
cmp dword [esp + 0x50], 0
je 0x6ae0ea1b
mov dword [esp], str.64_bit_Windows_doesnt_allow_32_bit_applications_to_create_VSS_snapshots._n________Run_the_64_bit_version_of_this_application_instead.
mov edi, 0x59
call fcn.6ae0b475
jmp 0x6adc1065
mov dword [esp + 4], eax
mov dword [esp], str.IVssAsync.Wait___error_while_preparing_for_backup:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.DoSnapshotSet___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
lea eax, [esp + 0x38]
mov dword [esp], str.A_problem_occurred_while_creating_a_VSS_snapshot_of___ls_._n________Aborting_the_operation.
mov edi, 0x59
mov dword [esp + 4], eax
call fcn.6ae0b475
jmp 0x6adc1065
mov dword [esp + 4], eax
mov dword [esp], str.IVssAsync.Wait___error_while_doing_snapshot_set:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.GetSnapshotProperties___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov eax, dword [esi + 0x2c]
mov dword [esp], str.Unexpected_volume_shadow_device_path:__ls
mov dword [esp + 4], eax
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp], str.The_Volume_Shadow_Copy_Service__VSS__API_could_not_be_initialized._Probably_it_isnt_supported_on_this_computer.
lea ebp, [esp + 0x50]
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 8], ebx
mov edi, 0x44
mov dword [esp + 4], esi
mov dword [esp], str.__ls___full_path___ls__:_Path_format_not_recognized
call fcn.6ae0b475
jmp 0x6adc0e6f
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.SetBackupState___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.InitializeForBackup___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.StartSnapshotSet___error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.CreateVssBackupComponents_error:__x
call fcn.6ae0b475
jmp 0x6ae0e9bd
mov dword [esp], str.CoUninitialize___not_found_in_ole32.dll
call fcn.6ae0b475
mov eax, dword [0x6ae67068]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esp], eax
call ebp
push ecx
jmp 0x6ae0e973
mov dword [esp], str.CoInitialize___not_found_in_ole32.dll
call fcn.6ae0b475
jmp 0x6ae0eb1e
mov dword [esp], str.ole32.dll_not_found
call fcn.6ae0b475
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x6ae0e973