Function at 0x6adc3f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x1ac
mov dword [esp + eax + 0xc0], edx
add eax, 4
cmp eax, 0x18
jb 0x6adc3f8e
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x84], 0
mov dword [esp + 0xbc], eax
test byte [eax + 0x15], 0x80
jne 0x6adc4088
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp], eax
call fcn.6adbcc50
mov esi, eax
test esi, esi
jne 0x6adc40b7
cmp word [esp + 0x90], 7
jbe 0x6add8969
mov edx, dword [esp + 0x94]
cmp edx, str.___
je 0x6adc4029
test edx, edx
je 0x6add8969
xor eax, eax
lea esi, [esi]
movzx ebx, word [eax + str.___]
cmp word [edx + eax], bx
jne 0x6add8969
add eax, 2
cmp eax, 8
jne 0x6adc4010
mov eax, dword [esp + 0x1c8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.6ada6f90
mov ebx, dword [esp + 0x94]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
test esi, esi
je 0x6adc40e0
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc4077
sub dword [eax], 1
je 0x6adc40c7
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xd4]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp], eax
call fcn.6adc5f00
mov esi, eax
test esi, esi
je 0x6adc3fe4
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc4077
sub dword [eax], 1
jne 0x6adc4077
mov dword [esp], eax
call fcn.6adc5ec0
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c8]
mov ecx, dword [eax + 0x84]
mov edx, dword [eax + 0x80]
lea eax, [esp + 0x84]
mov dword [esp], pe_nt_image_headers32
mov dword [esp + 4], eax
xor eax, eax
call fcn.6adc13d0
test eax, eax
js 0x6add87d6
mov ebx, dword [esp + 0x84]
lea eax, [esp + 0x110]
lea edi, [esp + 0x98]
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0x90
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6add885e
mov eax, dword [esp + 0x110]
mov dword [esp + 0xc4], eax
xor eax, eax
cmp dword [esp + 0x118], 8
je 0x6adc4580
mov byte [esp + 0xc0], al
lea eax, [esp + 0xa0]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6adc4560
cmp dword [esp + 0x9c], 0xb
mov edx, dword [esp + 0xbc]
jbe 0x6add888e
mov eax, dword [esp + 0xa8]
mov dword [edx + 0x9c], 0
mov dword [edx + 0x98], eax
lea edx, [esp + 0xd8]
mov eax, ebx
call fcn.6adc14b0
test eax, eax
js 0x6add88e2
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp byte [esp + 0xc0], 0
jne 0x6adc42b8
mov eax, dword [esp + 0x1c8]
xor edx, edx
mov ecx, dword [eax + 0x80]
lea eax, [esp + 0xbc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 4], 0x6adee9a0
mov eax, dword [eax + 0x84]
mov dword [esp], eax
mov eax, dword [esp + 0x1c0]
call fcn.6adc2dd0
mov esi, eax
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc428a
sub dword [eax], 1
je 0x6adc4570
test esi, esi
jne 0x6adc4077
mov eax, dword [esp + 0xcc]
or eax, dword [esp + 0xc8]
jne 0x6add890b
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WIMLIB_DISABLE_QUERY_FILE_LAYOUT
call dword [sym.imp.msvcrt.dll__wgetenv]
mov dword [esp + 0x60], eax
test eax, eax
jne 0x6adc422e
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov ebx, dword [eax + 0x80]
mov eax, dword [eax + 0x84]
lea eax, [ebx + eax*2 - 2]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], eax
movzx eax, word [eax]
mov word [esp + 0x76], ax
cmp ax, 0x5c
je 0x6adc4c17
mov dword [esp + 0x98], 0
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0x110], edx
add eax, 4
cmp eax, 0x20
jb 0x6adc4327
mov dword [esp + 0x114], 0x3f
mov ebx, dword [esp + 0x78]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], edi
mov edx, ebx
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adc13d0
test eax, eax
js 0x6adc4ceb
mov dword [esp + 0x68], 0x8000
mov dword [esp + 0x58], esi
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.6adaeec0
mov dword [esp + 0x64], eax
test eax, eax
je 0x6adc4cb4
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], 0x90277
mov dword [esp + 0x10], eax
lea eax, [esp + 0x110]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call fcn.6adbccd0
test eax, eax
js 0x6adc4c98
mov eax, dword [esp + 0x64]
mov ebp, dword [eax + 4]
add ebp, eax
lea esi, [esi]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
movzx eax, si
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], esi
xor eax, 5
or eax, edx
je 0x6adc46d8
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x6adc468a
add ebx, ebp
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x6adc45ed
mov dword [esp + 0x5c], ecx
xor eax, eax
xor esi, esi
mov dword [esp + 0x44], ebp
mov ebp, eax
lea esi, [esi]
mov eax, edi
lea ecx, [ebx + 0x18]
mov edx, dword [ebx + 4]
shr eax, 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], eax
test edi, 1
je 0x6adc46a0
mov ecx, edx
mov esi, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], str.Invalid_FILE_LAYOUT_NAME_ENTRY__FileReferenceNumber0x_016llx__FileNameLength_u__FileName_.ls__Flags0x_08x
mov dword [esp + 8], eax
call fcn.6add55ba
mov esi, 0x44
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp word [esp + 0x76], 0x5c
jne 0x6adc44c9
mov eax, dword [esp + 0x7c]
mov edi, 0x5c
mov word [eax], di
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.6ad81870
mov edi, eax
test eax, eax
je 0x6adc4500
nop
mov ebx, dword [edi + 8]
mov dword [esp], edi
and ebx, 0xfffffffc
call fcn.6adaeef0
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.6ad818a0
mov edi, eax
test eax, eax
jne 0x6adc44e0
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.6ad81870
mov edi, eax
test eax, eax
je 0x6adc4538
lea esi, [esi]
mov ebx, dword [edi + 8]
mov dword [esp], edi
and ebx, 0xfffffffc
call fcn.6adaeef0
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.6ad818a0
mov edi, eax
test eax, eax
jne 0x6adc4518
test esi, esi
js 0x6adc422e
cmp esi, 0x44
jne 0x6adc4276
test esi, esi
js 0x6adc422e
jmp 0x6add88b0
cmp eax, 0x80000005
je 0x6adc41ab
jmp 0x6add8887
mov dword [esp], eax
call fcn.6adc5ec0
jmp 0x6adc428a
xor eax, eax
jmp 0x6adc4590
add eax, 2
cmp eax, 8
je 0x6adc45a8
movzx ecx, word [eax + str.NTFS]
cmp word [esp + eax + 0x11c], cx
je 0x6adc4588
xor eax, eax
jmp 0x6adc4172
mov eax, 1
jmp 0x6adc4172
test dl, 2
je 0x6adc45c6
cmp edi, 0x18
ja 0x6adc46ca
cmp edx, 2
je 0x6adc45d6
add edi, 0x19
add esi, 1
and edi, 0xfffffff8
add ebp, edi
mov eax, dword [ebx]
test eax, eax
je 0x6adc4b60
add ebx, eax
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x6adc4440
lea eax, [ebx + 0x18]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x2c], eax
jmp 0x6adc4462
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x5c]
sub esi, eax
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x38]
cmp dword [esp + 0x44], esi
je 0x6adc4635
mov dword [esp + 8], 0x9c6
mov dword [esp + 4], str.src_win32_capture.c
mov dword [esp], str._u8__p____u8__ni__inode_size
call dword [0x6add9074]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x6adc4c04
mov esi, dword [esp + 0x2c]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0x14]
cmp edi, ecx
mov ebx, esi
sbb ebx, edx
jb 0x6adc4aae
cmp ecx, edi
sbb edx, esi
jb 0x6adc4a90
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp], str.Inode_0x_016llx_is_a_duplicate_
call fcn.6add560c
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [ebp + 4]
test eax, eax
je 0x6adc4bf7
add ebp, eax
jmp 0x6adc43e8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6adc45c6
mov ecx, eax
mov eax, dword [esp + 0x2c]
jmp 0x6adc46c4
add eax, 2
sub ecx, 1
je 0x6adc45b8
cmp word [eax], 0
jne 0x6adc46b8
mov esi, dword [esp + 0x38]
mov ecx, edx
jmp 0x6adc4462
mov dword [esp + 0x44], 0x70
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x6adc47e6
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x5c], eax
test ah, 0x40
jne 0x6adc47e4
lea edi, [ebp + esi]
mov ebx, dword [edi + 0x2c]
test bl, 1
jne 0x6adc47d4
xor esi, esi
and eax, 0x10
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x2c], esi
mov edx, ebx
lea ebp, [edi + 0x30]
shr edx, 1
je 0x6adc4b2e
mov ecx, edx
mov eax, ebp
jmp 0x6adc4740
add eax, 2
sub ecx, 1
je 0x6adc4778
cmp word [eax], 0
jne 0x6adc4738
mov esi, ebp
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Invalid_STREAM_LAYOUT_ENTRY__FileReferenceNumber0x_016llx__StreamIdentifierLength_u__StreamIdentifier_.ls
call fcn.6add560c
jmp 0x6adc4492
cmp word [edi + 0x30], 0x3a
jne 0x6adc4ae2
lea eax, [esp + 0xd8]
lea ecx, [esp + 0xa0]
mov dword [esp], eax
mov eax, ebp
call fcn.6adc1bc0
test al, al
je 0x6adc4ae2
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x6adc4ada
lea eax, [eax + eax + 0x11]
and eax, 0xfffffff8
add esi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x6adc4be0
add edi, eax
mov ebx, dword [edi + 0x2c]
test bl, 1
je 0x6adc4720
lea eax, [edi + 0x30]
mov esi, eax
mov eax, ebx
shr eax, 1
mov edx, eax
jmp 0x6adc4748
xor esi, esi
mov eax, dword [esp + 0x44]
mov dword [esp], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 4], eax
call fcn.6adaef20
mov dword [esp + 0x2c], eax
mov ebx, eax
mov edi, eax
test eax, eax
je 0x6adc4cb4
mov ecx, dword [esp + 0x38]
mov edx, dword [ebp + 0x14]
lea eax, [ebp + ecx]
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x10], ecx
mov ebx, dword [eax + 0x20]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax]
mov dword [esp + 0x38], ebx
mov ebx, dword [eax + 0x2c]
mov dword [esp + 0x3c], ebx
mov ebx, dword [eax + 4]
mov dword [edi + 0x18], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 0x1c], ebx
mov ebx, dword [eax + 0x14]
mov dword [edi + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 0x2c], ebx
mov ebx, dword [eax + 0xc]
mov eax, edi
mov dword [edi + 0x20], ecx
mov ecx, dword [esp + 0x40]
mov dword [edi + 0x24], ebx
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [eax + 0x48], esi
lea esi, [eax + 0x70]
mov dword [eax + 0x3c], ebx
mov ebx, eax
mov dword [eax + 0x38], edi
movzx eax, dx
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x38], 0x70
xor eax, 5
or eax, edx
je 0x6adc4952
mov edi, dword [ebp + 0x18]
mov eax, ebx
lea ebx, [ebx + 0x54]
mov dword [esp + 0x38], ebp
add edi, ebp
mov ebp, esi
mov esi, ebx
mov ebx, eax
jmp 0x6adc490e
cmp eax, 2
je 0x6adc4906
mov ecx, ebp
mov edx, dword [edi + 0xc]
shl eax, 0x1f
add dword [ebx + 0x40], 1
sub ecx, ebx
and ecx, 0x7fffffff
or ecx, eax
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], edx
mov edx, dword [edi + 0x10]
mov dword [ebp], ecx
lea ecx, [edi + 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
xor edx, edx
mov ecx, eax
add eax, 0x19
shr ecx, 1
and eax, 0xfffffff8
mov word [ebp + ecx*2 + 0x10], dx
add ebp, eax
mov eax, dword [edi]
test eax, eax
je 0x6adc4940
add edi, eax
mov eax, dword [edi + 4]
test al, 2
je 0x6adc48b0
mov ecx, dword [edi + 0x10]
lea eax, [edi + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
xor ecx, ecx
shr eax, 1
mov word [ebx + eax*2 + 0x54], cx
mov eax, dword [edi + 4]
jmp 0x6adc48b0
mov esi, ebp
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov eax, esi
sub eax, edi
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x6adc460e
test byte [ebp + 0xd], 0x40
jne 0x6adc460e
mov dword [esp + 0x5c], ebp
lea edi, [ebp + eax]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc4a2f
mov dword [esp + 0xa0], 0x6adee9a0
mov dword [esp + 0xd8], 0
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0xc]
mov ebx, eax
mov dword [esp + 0x3c], eax
and ebx, 0x10
jne 0x6adc4a22
mov eax, dword [esp + 0xa0]
xor edx, edx
add dword [ebp + 0x44], 1
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x4c], eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x6adc49e0
add eax, edi
test byte [eax], 1
je 0x6adc49e0
cmp dword [eax + 8], 0
je 0x6adc49e0
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
mov ecx, edx
mov edx, eax
mov dword [ebp + 0x30], edx
mov dword [ebp + 0x34], ecx
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
lea ecx, [ebx + ebx]
mov dword [esp + 0x40], ecx
mov dword [esi], eax
lea eax, [esi + 8]
mov dword [esi + 4], edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x40]
xor eax, eax
mov word [esi + ebx*2 + 8], ax
add ecx, 0x11
and ecx, 0xfffffff8
add esi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x6adc4600
add edi, eax
mov edx, dword [edi + 0x2c]
test edx, edx
je 0x6adc4980
shr edx, 1
je 0x6adc4a22
cmp word [edi + 0x30], 0x3a
jne 0x6adc4a22
lea ebx, [esp + 0xd8]
lea eax, [edi + 0x30]
mov dword [esp], ebx
lea ecx, [esp + 0xa0]
call fcn.6adc1bc0
test al, al
je 0x6adc4a22
mov ebx, dword [esp + 0xd8]
test ebx, ebx
je 0x6adc4996
mov eax, dword [esp + 0xa0]
add dword [ebp + 0x44], 1
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x4c], eax
jmp 0x6adc49e6
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
test edx, edx
je 0x6adc4ab6
mov eax, edx
mov ebx, esi
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
cmp edi, ecx
sbb ebx, edx
jae 0x6adc4660
mov ecx, eax
mov edx, dword [ecx]
test edx, edx
jne 0x6adc4a9a
or eax, 1
lea edx, [esp + 0x88]
mov esi, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.6ad818d0
jmp 0x6adc468a
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6adc4b50
cmp ebx, 0x18
je 0x6adc4b80
cmp ebx, 0xa
je 0x6adc4bb1
cmp ebx, 0x22
jne 0x6adc47bb
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.::_EA_INFORMATION
mov dword [esp], ebp
call sub.msvcrt.dll_memcmp
mov ebx, dword [esp + 0x2c]
mov edx, eax
mov eax, ebx
or eax, 4
test edx, edx
cmovne eax, ebx
mov dword [esp + 0x2c], eax
jmp 0x6adc47bb
test ebx, ebx
jne 0x6adc47bb
mov dword [esp + 0xd8], 0
test byte [esp + 0x5c], 0x10
jne 0x6adc47bb
lea esi, [esi]
xor eax, eax
jmp 0x6adc47b2
mov eax, ebp
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x44]
test esi, esi
je 0x6add88c1
add eax, 0x70
mov dword [esp + 0x44], eax
jmp 0x6adc46e0
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.::_OBJECT_ID
mov dword [esp], ebp
call sub.msvcrt.dll_memcmp
mov ebx, dword [esp + 0x2c]
mov edx, eax
mov eax, ebx
or eax, 1
test edx, edx
cmovne eax, ebx
mov dword [esp + 0x2c], eax
jmp 0x6adc47bb
cmp dword [ebp], 0x3a003a
jne 0x6adc47bb
cmp dword [ebp + 4], 0x450024
jne 0x6adc47bb
cmp word [ebp + 8], 0x41
jne 0x6adc47bb
or dword [esp + 0x2c], 2
jmp 0x6adc47bb
mov edi, esi
mov ebp, dword [esp + 0x6c]
add dword [esp + 0x44], edi
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x2c]
jmp 0x6adc47e6
and dword [esp + 0x114], 0xfffffffe
jmp 0x6adc438f
lea edx, [esp + 0x88]
mov eax, 1
mov ecx, edx
jmp 0x6adc4ac0
mov eax, dword [esp + 0x7c]
xor edx, edx
mov word [eax], dx
xor edx, edx
xor eax, eax
mov dword [esp + 0x98], 0
mov dword [esp + eax + 0x110], edx
add eax, 4
cmp eax, 0x20
jb 0x6adc4c2f
mov dword [esp + 0x114], 0x3f
mov ebx, dword [esp + 0x78]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], edi
mov edx, ebx
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adc13d0
test eax, eax
jns 0x6adc436b
xor ecx, ecx
or esi, 0xffffffff
mov dword [esp], ecx
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push ebx
jmp 0x6adc44bd
cmp eax, 0xc0000023
jne 0x6adc4d0d
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
shl dword [esp + 0x68], 1
jmp 0x6adc4377
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push ebp
cmp word [esp + 0x76], 0x5c
jne 0x6adc4ce1
mov eax, dword [esp + 0x7c]
mov word [eax], 0x5c
mov esi, 0x27
jmp 0x6adc44c9
xor eax, eax
or esi, 0xffffffff
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push edx
jmp 0x6adc44c9
cmp eax, 0xc0000011
je 0x6adc4d3b
cmp eax, 0xc0000010
sete dl
cmp eax, 0xc00000bb
sete cl
or dl, cl
jne 0x6adc4d33
cmp eax, 0xc000000d
jne 0x6add881a
or esi, 0xffffffff
jmp 0x6adc4497
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push esi
cmp word [esp + 0x76], 0x5c
jne 0x6adc4d68
mov eax, dword [esp + 0x7c]
mov word [eax], 0x5c
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.6ad81750
mov ebp, eax
test eax, eax
je 0x6add87b8
lea esi, [esi]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x50], eax
movzx eax, word [ebp + 0x14]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
xor eax, 5
or eax, edx
je 0x6adc4ebc
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x30], ebp
lea ebx, [ebp + 0x70]
mov dword [esp + 0x2c], eax
jmp 0x6adc4dee
cmp ecx, edi
sbb edx, esi
jb 0x6adc4e50
sub dword [esp + 0x2c], 1
mov edx, dword [eax + 0x50]
mov dword [ebx + 8], edx
mov dword [eax + 0x50], ebx
je 0x6adc4e55
lea eax, [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + eax + 0x19]
and eax, 0xfffffff8
add ebx, eax
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov eax, dword [esp + 0x88]
lea esi, [esi]
nop
test eax, eax
je 0x6adc4e18
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov ebp, esi
cmp edi, ecx
sbb ebp, edx
jae 0x6adc4dc0
mov eax, dword [eax]
test eax, eax
jne 0x6adc4e04
mov ebp, dword [esp + 0x30]
lea ecx, [ebx + 0x10]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], esi
mov dword [esp], str.Parent_inode_0x_016llx_ofdirectory_entry___ls___inode_0x_016llx__was_missing_from_the_MFT_listing_
call fcn.6add55ba
jmp 0x6add87cc
mov eax, dword [eax + 4]
jmp 0x6adc4e00
mov ebp, dword [esp + 0x30]
mov dword [esp], ebp
call fcn.6ad817b0
mov ebp, eax
test eax, eax
jne 0x6adc4d88
mov esi, dword [esp + 0x60]
test esi, esi
je 0x6add87b8
lea eax, [esp + 0x8c]
mov dword [esi + 0x40], 1
xor ecx, ecx
mov edx, 0x6adee9a0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x88]
mov dword [esp + 8], eax
lea eax, [esp + 0xbc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c0]
mov dword [esp], esi
call fcn.6adc3640
mov esi, eax
jmp 0x6adc44c9
mov dword [esp + 0x60], ebp
jmp 0x6adc4e59
mov eax, dword [esp + 0x78]
mov dword [esp], str.The_MFT_listing_for_volume___ls__did_not_include_a_root_directory_
mov dword [esp + 4], eax
call fcn.6add55ba
mov esi, 0x44
jmp 0x6adc44c9
mov esi, dword [esp + 0x1c4]
mov dword [esp], eax
mov dword [esp + 4], str.Cant_open___ls_
mov dword [esp + 8], esi
mov dword [esp + 0x2c], eax
call fcn.6add8113
mov eax, dword [esp + 0x2c]
cmp eax, 0xc0210000
mov eax, dword [esp + 0xd4]
jne 0x6add8837
test eax, eax
je 0x6add8810
sub dword [eax], 1
je 0x6add8854
mov esi, 0x52
jmp 0x6adc4077
mov esi, dword [esp + 0x78]
mov dword [esp + 4], str.Error_enumerating_files_on_volume___ls_
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.6add8113
jmp 0x6adc4492
test eax, eax
je 0x6add8840
sub dword [eax], 1
je 0x6add884a
mov esi, 0x2f
jmp 0x6adc4077
mov dword [esp], eax
call fcn.6adc5ec0
jmp 0x6add8840
mov dword [esp], eax
call fcn.6adc5ec0
jmp 0x6add8810
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_attributes
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80ee
jmp 0x6adc4179
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_ID
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80ee
jmp 0x6adc41d7
mov dword [esp], str.A_problem_occurred_during_the_fast_MFT_scan._n__________Falling_back_to_the_standard_recursive_directory_tree_scan.
call fcn.6add560c
jmp 0x6adc422e
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Inode_0x_016llx_has_no_long_names_
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.6add55ba
jmp 0x6adc4492
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_file_information
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80ee
jmp 0x6adc420e
mov eax, dword [esp + 0x1c4]
mov dword [esp], str.Scan_of___ls__complete__but_with_one_or_more_warnings:
mov dword [esp + 4], eax
call fcn.6add560c
mov eax, dword [esp + 0xcc]
test eax, eax
je 0x6add893d
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_SACL__System_Access_Control_List__n____________on__lu_files_or_directories.
call fcn.6add560c
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x6add8958
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_security_descriptor_at_all_n____________on__lu_files_or_directories.
call fcn.6add560c
mov dword [esp], str.To_fully_capture_all_security_descriptors__run_the_program_n__________with_Administrator_rights.
call fcn.6add560c
jmp 0x6adc4077
mov eax, dword [esp + 0x1c4]
mov dword [esp], str.__ls_:_unrecognized_path_format
mov esi, 0x18
mov dword [esp + 4], eax
call fcn.6add55ba
mov ebx, dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esp + 0xd4]
test eax, eax
jne 0x6adc4072
jmp 0x6adc4077