Function at 0x6adc0ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov esi, dword [esp + 0x80]
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.6adc0490
mov ebx, eax
test eax, eax
je 0x6adc1408
movzx eax, word [eax]
test ax, ax
je 0x6ae1290c
cmp word [ebx + 2], 0x3a
jne 0x6ae1290c
cmp word [ebx + 4], 0x5c
jne 0x6ae1290c
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp + 4], str._lc:_
mov dword [esp + 0x28], eax
call eax
mov dword [esp + 4], 0x68
mov dword [esp], 1
call fcn.6adab680
mov esi, eax
test eax, eax
je 0x6adc1408
cmp byte [0x6ae6b079], 0
je 0x6adc12b0
lea eax, [esp + 0x34]
mov dword [esp], eax
call dword [0x6ae6b070]
sub esp, 4
test eax, eax
js 0x6ae12975
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov dword [esi + 4], edi
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [eax + 0x14]
sub esp, 8
test eax, eax
js 0x6ae12943
mov eax, dword [edi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 5
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [eax + 0x18]
sub esp, 0x14
test eax, eax
js 0x6ae1292a
lea ebp, [esp + 0x40]
cmp byte [0x6ae6b078], 0
mov eax, dword [edi]
mov dword [esp], edi
mov dword [esp + 4], ebp
jne 0x6adc1218
call dword [eax + 0x90]
sub esp, 8
test eax, eax
js 0x6ae1295c
cmp byte [0x6ae6b078], 0
mov eax, dword [edi]
je 0x6adc1250
lea ecx, [esp + 0x38]
mov eax, dword [eax + 0x88]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], ecx
mov dword [esp], edi
call eax
sub esp, 0x1c
test eax, eax
js 0x6ae12813
lea ebp, [esp + 0x50]
cmp byte [0x6ae6b078], 0
mov eax, dword [edi]
mov dword [esp], edi
mov dword [esp + 4], ebp
je 0x6adc1240
call dword [eax + 0x34]
sub esp, 8
test eax, eax
js 0x6ae12829
mov eax, dword [esp + 0x50]
call fcn.6adc0de0
test eax, eax
js 0x6ae12873
cmp byte [0x6ae6b078], 0
mov eax, dword [edi]
mov dword [esp + 4], ebp
mov dword [esp], edi
je 0x6adc1230
call dword [eax + 0x8c]
sub esp, 8
test eax, eax
js 0x6ae12885
mov eax, dword [esp + 0x50]
call fcn.6adc0de0
test eax, eax
js 0x6ae128b5
mov eax, dword [esp + 0x34]
lea ecx, [esi + 8]
cmp byte [0x6ae6b078], 0
mov edx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], ecx
je 0x6adc13e0
call dword [edx + 0xa0]
sub esp, 0x18
test eax, eax
js 0x6ae128ca
mov dword [esp + 8], 4
mov dword [esp + 4], 0x6ae2a062
mov eax, dword [esi + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_wcsncmp
mov edi, eax
test eax, eax
jne 0x6ae128df
mov eax, dword [esi + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea edx, [ebx + 6]
mov dword [esp], edx
mov ebp, eax
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_wcslen
mov edx, dword [esp + 0x84]
lea ebp, [ebp + eax + 2]
mov eax, dword [esp + 0x84]
add ebp, ebp
mov word [eax + 2], bp
lea eax, [ebp - 2]
movzx ebp, bp
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov edx, dword [esp + 0x84]
mov dword [edx + 4], eax
test eax, eax
je 0x6adc13f0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
mov ecx, dword [esi + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
lea edx, [ecx + 8]
mov dword [esp + 4], str.___ls_ls
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0x88]
mov dword [esi], 1
mov dword [eax], esi
mov dword [esp], ebx
call fcn.6adab650
add esp, 0x6c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [eax + 0x84]
sub esp, 8
jmp 0x6adc1003
call dword [eax + 0x98]
sub esp, 8
jmp 0x6adc10d4
call dword [eax + 0x38]
sub esp, 8
jmp 0x6adc109c
lea edx, [esp + 0x38]
mov eax, dword [eax + 0x94]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 4], edx
mov dword [esp], edi
call eax
sub esp, 0x1c
jmp 0x6adc1074
mov dword [esp], 0x6ae13020
call fcn.6adc28e0
movzx edi, byte [0x6ae6b079]
mov eax, edi
test al, al
je 0x6adc12f0
mov dword [esp], 0x6ae13020
call fcn.6adc2c20
cmp byte [0x6ae6b079], 0
jne 0x6adc0f73
jmp 0x6ae128f7
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp], str.vssapi.dll
mov dword [esp + 0x2c], eax
call eax
mov dword [0x6ae6b074], eax
sub esp, 4
test eax, eax
je 0x6ae127cc
mov dword [esp + 4], str.CreateVssBackupComponentsInternal
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
call ebp
mov dword [0x6ae6b070], eax
sub esp, 8
test eax, eax
je 0x6adc1440
mov byte [0x6ae6b078], 0
mov eax, dword [0x6ae6b074]
mov dword [esp + 4], str.VssFreeSnapshotPropertiesInternal
mov dword [esp], eax
call ebp
mov dword [0x6ae6b06c], eax
sub esp, 8
test eax, eax
je 0x6adc1418
mov dword [esp], str.ole32.dll
mov eax, dword [esp + 0x2c]
call eax
mov dword [0x6ae6b068], eax
sub esp, 4
test eax, eax
je 0x6ae129be
mov dword [esp + 4], str.CoInitialize
mov dword [esp], eax
call ebp
mov dword [0x6ae6b064], eax
sub esp, 8
test eax, eax
je 0x6ae129b0
mov eax, dword [0x6ae6b068]
mov dword [esp + 4], str.CoUninitialize
mov dword [esp], eax
call ebp
mov dword [0x6ae6b060], eax
sub esp, 8
test eax, eax
je 0x6ae1298e
mov dword [esp], 0
mov edi, 1
call dword [0x6ae6b064]
sub esp, 4
mov eax, edi
mov byte [0x6ae6b079], al
jmp 0x6adc12c9
call dword [edx + 0xa8]
sub esp, 0x18
jmp 0x6adc1133
mov edi, 0x27
mov dword [esp], esi
call fcn.6adc0ea0
jmp 0x6adc11ff
mov edi, 0x27
jmp 0x6adc11ff
mov eax, dword [0x6ae6b074]
mov dword [esp + 4], str.VssFreeSnapshotProperties
mov dword [esp], eax
call ebp
mov dword [0x6ae6b06c], eax
sub esp, 8
test eax, eax
jne 0x6adc135e
jmp 0x6ae127dd
mov eax, dword [0x6ae6b074]
mov dword [esp + 4], str._CreateVssBackupComponents__YGJPAPAVIVssBackupComponents___Z
mov dword [esp], eax
call ebp
mov dword [0x6ae6b070], eax
sub esp, 8
test eax, eax
je 0x6ae127ff
mov byte [0x6ae6b078], 1
jmp 0x6adc133c
mov dword [esp], str.vssapi.dll_not_found
call fcn.6ae0f1f5
jmp 0x6adc13cf
mov dword [esp], str.VssFreeSnapshotProperties___not_found_in_vssapi.dll
call fcn.6ae0f1f5
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x6ae6b074]
mov dword [esp], eax
call ebp
push edx
jmp 0x6adc13cf
mov dword [esp], str.CreateVssBackupComponents___not_found_in_vssapi.dll
call fcn.6ae0f1f5
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x6ae127ef
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.AddToSnapshotSet___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.PrepareForBackup___error:__x
call fcn.6ae0f1f5
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
push eax
cmp dword [esp + 0x50], 0
je 0x6ae12897
mov dword [esp], str.64_bit_Windows_doesnt_allow_32_bit_applications_to_create_VSS_snapshots._n________Run_the_64_bit_version_of_this_application_instead.
mov edi, 0x59
call fcn.6ae0f1f5
jmp 0x6adc13f5
mov dword [esp + 4], eax
mov dword [esp], str.IVssAsync.Wait___error_while_preparing_for_backup:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.DoSnapshotSet___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
lea eax, [esp + 0x38]
mov dword [esp], str.A_problem_occurred_while_creating_a_VSS_snapshot_of___ls_._n________Aborting_the_operation.
mov edi, 0x59
mov dword [esp + 4], eax
call fcn.6ae0f1f5
jmp 0x6adc13f5
mov dword [esp + 4], eax
mov dword [esp], str.IVssAsync.Wait___error_while_doing_snapshot_set:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
mov dword [esp], str.IVssBackupComponents.GetSnapshotProperties___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov eax, dword [esi + 0x2c]
mov dword [esp], str.Unexpected_volume_shadow_device_path:__ls
mov dword [esp + 4], eax
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp], str.The_Volume_Shadow_Copy_Service__VSS__API_could_not_be_initialized._Probably_it_isnt_supported_on_this_computer.
lea ebp, [esp + 0x50]
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 8], ebx
mov edi, 0x44
mov dword [esp + 4], esi
mov dword [esp], str.__ls___full_path___ls__:_Path_format_not_recognized
call fcn.6ae0f1f5
jmp 0x6adc11ff
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.SetBackupState___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.InitializeForBackup___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.IVssBackupComponents.StartSnapshotSet___error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp + 4], eax
lea ebp, [esp + 0x50]
mov dword [esp], str.CreateVssBackupComponents_error:__x
call fcn.6ae0f1f5
jmp 0x6ae12839
mov dword [esp], str.CoUninitialize___not_found_in_ole32.dll
call fcn.6ae0f1f5
mov eax, dword [0x6ae6b068]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esp], eax
call ebp
push ecx
jmp 0x6ae127ef
mov dword [esp], str.CoInitialize___not_found_in_ole32.dll
call fcn.6ae0f1f5
jmp 0x6ae1299a
mov dword [esp], str.ole32.dll_not_found
call fcn.6ae0f1f5
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x6ae127ef