Function at 0x416290
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4341a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
mov eax, dword [0x44647c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x164], esi
sub esp, 0x1c
mov eax, esp
xor ebx, ebx
mov edi, 7
mov dword [ebp - 0x138], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.CommandLineParser::MainRoutine
mov dword [ebp - 4], ebx
mov dword [ebp - 0x13c], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x13c]
add esp, 4
push eax
push str.CommandLineParser::MainRoutine
call fcn.00402060
push 0x54
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x13c], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.._shadow.cpp
mov byte [ebp - 4], 1
mov dword [ebp - 0x13c], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x13c]
add esp, 4
push eax
push str.._shadow.cpp
call fcn.00402060
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], bl
call fcn.00418520
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], ebx
mov word [ebp - 0x12c], bx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], bx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], bx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], ebx
mov word [ebp - 0xb8], bx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 8
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x416a7a
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0x13c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jae 0x416a7a
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], bx
lea ecx, [ebp - 0x4c]
push ecx
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push 0x43c2c4
mov byte [ebp - 4], 9
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push 0x43c2c4
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0xa
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00414400
cmp al, bl
je 0x4164ea
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x41648d
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str._Option:_Excluding_writer_component__s_
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str._Option:_Excluding_writer_component__s_
call fcn.00402060
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x24
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x160]
call fcn.00403650
jmp 0x4167bd
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], bx
lea eax, [ebp - 0x68]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push 0x43c268
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push 0x43c268
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0xc
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00414400
cmp al, bl
je 0x416607
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x41657c
lea eax, [ebp - 0x64]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str._Option:_Verifying_inclusion_of_writer_component__s_
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str._Option:_Verifying_inclusion_of_writer_component__s_
call fcn.00402060
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x24
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x150]
call fcn.00403650
cmp dword [ebp - 0x50], 8
jb 0x4165e6
mov edx, dword [ebp - 0x64]
push edx
call fcn.00426a53
add esp, 4
cmp dword [ebp - 0x34], 8
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], bx
mov byte [ebp - 4], 8
jb 0x4167d3
mov eax, dword [ebp - 0x48]
push eax
jmp 0x4167cb
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.wait
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str.wait
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0xd
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00413f70
cmp al, bl
je 0x4166c8
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str._Option:_Wait_on_finish_
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str._Option:_Wait_on_finish_
call fcn.00402060
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x20
mov byte [esi + 0x62], 1
jmp 0x4167a1
lea eax, [ebp - 0xa0]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.script
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str.script
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0xe
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00414400
cmp al, bl
je 0x4167f8
cmp dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x9c]
jae 0x416758
lea eax, [ebp - 0x9c]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str._Option:_Generate_SETVAR_script__s_
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str._Option:_Generate_SETVAR_script__s_
call fcn.00402060
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x24
cmp dword [ebp - 0x50], 8
jb 0x4167b3
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00426a53
add esp, 4
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], bx
cmp dword [ebp - 0x34], 8
mov byte [ebp - 4], 8
jb 0x4167d3
mov edx, dword [ebp - 0x48]
push edx
call fcn.00426a53
add esp, 4
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x140]
inc ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], bx
mov dword [ebp - 0x13c], ecx
add eax, 0x1c
jmp 0x4163c8
lea eax, [ebp - 0x84]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.exec
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str.exec
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0xf
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00414400
cmp al, bl
je 0x416957
cmp dword [ebp - 0x6c], 8
mov eax, dword [ebp - 0x80]
jae 0x41687f
lea eax, [ebp - 0x80]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str._Option:_Execute_binary_script_after_shadow_creation__s_
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str._Option:_Execute_binary_script_after_shadow_creation__s_
call fcn.00402060
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
mov eax, dword [ebp - 0x6c]
add esp, 0x24
cmp eax, 8
mov eax, dword [ebp - 0x80]
jae 0x4168d6
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4168ea
test al, 0x10
je 0x4169f0
cmp dword [ebp - 0x6c], 8
mov eax, dword [ebp - 0x80]
jae 0x4168f6
lea eax, [ebp - 0x80]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.ERROR:_the_parameter__s_must_be_an_existing_file_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 8
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.__Note:_the__exec_command_cannot_have_parameters_
call fcn.00402500
lea edx, [ebp - 0x114]
push edx
call fcn.004187d0
add esp, 0x20
push 0x442394
lea eax, [ebp - 0x168]
push eax
mov dword [ebp - 0x168], 0x80070057
call fcn.00426efa
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x134], esp
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], ebx
push str.tracing
mov dword [ebp - 0x138], eax
mov word [eax + 4], bx
call fcn.00426a3d
mov ecx, dword [ebp - 0x138]
add esp, 4
push eax
push str.tracing
call fcn.00402060
mov edx, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ebp - 4], 0x10
mov word [ecx + 4], bx
call fcn.00401cb0
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00413f70
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x416a1f
push 0x43bfbc
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x20
call fcn.00417ea0
lea ecx, [ebp - 0x68]
call fcn.004011f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 8
call fcn.004011f0
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x140]
inc ecx
mov dword [ebp - 0x13c], ecx
add eax, 0x1c
jmp 0x4163c8
push 0x43bfb8
call fcn.00402500
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebp + 0xc]
imul ecx, ecx, 0x1c
sub esp, 0x1c
lea eax, [ecx + edx]
mov ecx, esp
mov dword [ebp - 0x138], esp
push eax
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x140], eax
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00413f70
cmp al, bl
je 0x416b9b
lea ecx, [ebp - 0x68]
call fcn.004011f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 8
call fcn.004011f0
mov ecx, esi
call fcn.00414a10
cmp dword [ebp - 0xa4], 8
jb 0x416a99
mov eax, dword [ebp - 0xb8]
push eax
call fcn.00426a53
add esp, 4
mov eax, dword [ebp - 0x6c]
mov esi, 8
cmp eax, esi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], ebx
mov word [ebp - 0xb8], bx
jb 0x416ac4
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00426a53
add esp, 4
cmp dword [ebp - 0x88], esi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], bx
jb 0x416ae5
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00426a53
add esp, 4
mov esi, dword [ebp - 0x14c]
cmp esi, ebx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], bx
je 0x416b23
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x150]
push ecx
push edx
push esi
call fcn.00402480
push esi
call fcn.00426a53
add esp, 0x14
mov esi, dword [ebp - 0x15c]
cmp esi, ebx
je 0x416b4e
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x158]
push eax
lea ecx, [ebp - 0x160]
push ecx
push edx
push esi
call fcn.00402480
push esi
call fcn.00426a53
add esp, 0x14
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], bl
call fcn.00418690
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x416b7e
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
lea ecx, [ebp + 8]
push ecx
push edx
push esi
call fcn.00402480
push esi
call fcn.00426a53
add esp, 0x14
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042714d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bfb4
call fcn.00402500
mov eax, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push eax
mov byte [ebp - 4], 0x12
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00413f70
cmp al, bl
je 0x416c4f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Query_all_shadow_copies_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 0x20
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov eax, dword [0x43f490]
mov ecx, dword [0x43f494]
sub esp, 0x10
mov edx, esp
mov dword [edx], eax
mov eax, dword [0x43f498]
mov dword [edx + 4], ecx
mov ecx, dword [0x43f49c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov ecx, esi
call fcn.0040e570
jmp 0x4178ba
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xc4], ebx
mov word [ebp - 0xd4], bx
lea edx, [ebp - 0xd8]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bf68
mov byte [ebp - 4], 0x13
call fcn.00402500
mov eax, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push eax
mov byte [ebp - 4], 0x14
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
cmp al, bl
je 0x416d48
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Query_shadow_copy_set_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
call fcn.00408060
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.0040e570
jmp 0x4178af
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bf20
call fcn.00402500
mov edi, dword [ebp - 0x140]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x15
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x416e2a
push str._Option:_Query_shadow_copy_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
call fcn.00408060
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.0040ec20
jmp 0x4178af
push 0x43bee0
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x16
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00413f70
cmp al, bl
je 0x416f17
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Delete_all_shadow_copies_
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
push str.This_will_delete_all_shadow_copies_in_the_system._Are_you_sure___Y_N_
push 0x447380
mov byte [ebp - 4], 0x17
call fcn.00413b00
lea ecx, [ebp - 0x30]
push ecx
push 0x4472e0
call fcn.00413d80
mov eax, dword [ebp - 0x1c]
add esp, 0x30
cmp eax, 1
jne 0x416f0a
push ebx
lea ecx, [ebp - 0x30]
call fcn.004134d0
cmp byte [eax], 0x59
je 0x416ed2
push ebx
lea ecx, [ebp - 0x30]
call fcn.004134d0
cmp byte [eax], 0x79
jne 0x416f0a
push 0x43be48
push 0x447380
call fcn.00413b00
add esp, 8
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.0040b950
lea ecx, [ebp - 0x30]
call fcn.00401630
jmp 0x4178af
lea edx, [ebp - 0xd8]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43be40
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
cmp al, bl
je 0x416ff3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Delete_a_shadow_copy_set_
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
call fcn.00408060
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.0040c2d0
jmp 0x4178af
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bdf0
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x19
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x4170cf
push str._Option:_Delete_a_shadow_copy_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xd8]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
call fcn.00408060
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.00402500
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.0040c790
jmp 0x4178af
push 0x43bda8
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x1a
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00413f70
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x417153
push str._Option:_List_writer_metadata_
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x20
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push ebx
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.00424610
push ebx
mov ecx, esi
call fcn.0041ff70
jmp 0x4178af
push 0x43bd60
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x1b
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00413f70
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x4171d8
push str._Option:_List_extended_writer_metadata_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 0x20
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push ebx
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.00424610
push 1
mov ecx, esi
call fcn.0041ff70
jmp 0x4178af
push 0x43bd04
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x1c
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00413f70
cmp al, bl
je 0x417262
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bcc8
call fcn.00402500
lea edx, [ebp - 0x114]
push edx
call fcn.004187d0
add esp, 0x20
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push ebx
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.00424610
mov ecx, esi
call fcn.0041a4a0
mov ecx, esi
call fcn.0041c1a0
jmp 0x4178af
lea eax, [ebp - 0xbc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bcc4
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x1d
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
cmp al, bl
je 0x417471
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Perform_a_restore_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xbc]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
lea eax, [ebp - 0x30]
push eax
call fcn.00415bb0
add esp, 0x20
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1e
call fcn.004010b0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.XML_document:__s
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.CommandLineParser::MainRoutine
mov byte [ebp - 4], 0x1f
call fcn.00402500
push 0x237
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x13c], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x20
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
mov byte [ebp - 4], 0x1e
call fcn.00418290
add esp, 0x60
push 1
sub esp, 0x1c
lea edx, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.00424610
mov ecx, esi
call fcn.0041a4a0
mov ecx, esi
call fcn.0041c1a0
mov ecx, esi
call fcn.00423ba0
sub esp, 0x10
lea eax, [ebp - 0x150]
mov ecx, esp
mov dword [ebp - 0x134], esp
push eax
call fcn.00402d90
sub esp, 0x10
lea edx, [ebp - 0x160]
mov ecx, esp
mov dword [ebp - 0x138], esp
push edx
mov byte [ebp - 4], 0x21
call fcn.00402d90
mov byte [ebp - 4], 0x1e
mov ecx, esi
call fcn.00413220
mov ecx, esi
call fcn.0041a7c0
mov ecx, esi
mov byte [ebp - 4], 0x22
call fcn.00412780
cmp dword [ebp - 0x70], ebx
jbe 0x417404
sub esp, 0x1c
lea eax, [ebp - 0x84]
mov ecx, esp
mov dword [ebp - 0x134], esp
push eax
call fcn.00402280
call fcn.00414c90
add esp, 0x1c
push 1
mov ecx, esi
mov dword [ebp - 4], 0x1e
call fcn.00410cb0
mov ecx, esi
call fcn.0041ab20
mov ecx, esi
call fcn.00412780
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nRestore_done.
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 0x20
lea ecx, [ebp - 0x30]
call fcn.004011f0
jmp 0x4178af
lea edx, [ebp - 0xbc]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x43bc3c
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push edi
mov byte [ebp - 4], 0x24
call fcn.00402280
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00414400
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x134], esp
mov ecx, esp
je 0x4175fe
push str._Option:_Perform_a_Simulated_restore_
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 4
lea edx, [ebp - 0xbc]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
lea eax, [ebp - 0x30]
push eax
call fcn.00415bb0
add esp, 0x20
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x25
call fcn.004010b0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.XML_document:__s
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.CommandLineParser::MainRoutine
mov byte [ebp - 4], 0x26
call fcn.00402500
push 0x279
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x27
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
mov byte [ebp - 4], 0x25
call fcn.00418290
add esp, 0x60
push 1
sub esp, 0x1c
lea edx, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418ab0
mov ecx, esi
call fcn.00424610
mov ecx, esi
call fcn.0041a4a0
mov ecx, esi
call fcn.0041c1a0
mov ecx, esi
call fcn.00423ba0
sub esp, 0x10
lea eax, [ebp - 0x150]
mov ecx, esp
mov dword [ebp - 0x134], esp
push eax
call fcn.00402d90
sub esp, 0x10
lea edx, [ebp - 0x160]
mov ecx, esp
mov dword [ebp - 0x138], esp
push edx
mov byte [ebp - 4], 0x28
call fcn.00402d90
mov ecx, esi
mov byte [ebp - 4], 0x25
call fcn.00413220
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nRestore_simulation_done.
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
jmp 0x41743e
push edi
call fcn.00402280
call fcn.00415770
add esp, 0x1c
cmp al, bl
je 0x4179cb
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._Option:_Create_shadow_copy_set_
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 0x20
mov ecx, edi
call fcn.004010b0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nAttempting_to_create_a_shadow_copy_set...__volume__s_was_added_as_parameter_
call fcn.00402500
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
push str.CommandLineParser::MainRoutine
mov byte [ebp - 4], 0x29
call fcn.00402500
push 0x298
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x2a
call fcn.00402500
lea edx, [ebp - 0x114]
push edx
mov byte [ebp - 4], 0x13
call fcn.00418290
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
add esp, 0x44
mov ecx, esp
mov dword [ebp - 0x134], esp
push edi
mov byte [ebp - 4], 0x2b
call fcn.00402280
lea eax, [ebp - 0x184]
push eax
call fcn.0040cc50
add esp, 0x20
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2c
call fcn.00403650
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x2b
call fcn.004011f0
mov edi, dword [ebp - 0x13c]
lea ecx, [ebp + 8]
inc edi
call fcn.00401020
cmp edi, eax
jae 0x417797
mov ecx, dword [ebp + 0xc]
mov eax, edi
imul eax, eax, 0x1c
add eax, ecx
mov dword [ebp - 0x13c], eax
jmp 0x417714
mov eax, dword [ebp - 0x13c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push eax
call fcn.00402280
call fcn.00415770
add esp, 0x1c
cmp al, bl
je 0x417927
mov edx, dword [ebp - 0x13c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
lea eax, [ebp - 0x184]
push eax
call fcn.0040cc50
add esp, 0x20
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2d
call fcn.00403650
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 0x2b
call fcn.004011f0
mov edx, dword [ebp - 0x13c]
add edx, 0x1c
lea ecx, [ebp + 8]
inc edi
mov dword [ebp - 0x13c], edx
call fcn.00401020
cmp edi, eax
jb 0x41770e
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x4369b4
call fcn.00402500
push ebx
mov ecx, esi
call fcn.00418ab0
sub esp, 0x10
lea edx, [ebp - 0x150]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402d90
sub esp, 0x10
lea eax, [ebp - 0x160]
mov ecx, esp
mov dword [ebp - 0x138], esp
push eax
mov byte [ebp - 4], 0x2e
call fcn.00402d90
sub esp, 0x1c
lea edx, [ebp - 0xbc]
mov ecx, esp
mov dword [ebp - 0x13c], esp
push edx
mov byte [ebp - 4], 0x2f
call fcn.00402280
sub esp, 0x10
lea eax, [ebp - 0x24]
mov ecx, esp
mov dword [ebp - 0x140], esp
push eax
mov byte [ebp - 4], 0x30
call fcn.00402d90
mov ecx, esi
mov byte [ebp - 4], 0x2b
call fcn.0040b3e0
cmp dword [ebp - 0x8c], ebx
mov byte [ebp - 4], 0x31
jbe 0x41784f
sub esp, 0x1c
lea edx, [ebp - 0xa0]
mov ecx, esp
mov dword [ebp - 0x134], esp
push edx
call fcn.00402280
mov ecx, esi
call fcn.0040ab90
cmp dword [ebp - 0x70], ebx
jbe 0x417873
sub esp, 0x1c
lea eax, [ebp - 0x84]
mov ecx, esp
mov dword [ebp - 0x134], esp
push eax
call fcn.00402280
call fcn.00414c90
add esp, 0x1c
push 1
mov ecx, esi
mov dword [ebp - 4], 0x2b
call fcn.004097b0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nSnapshot_creation_done.
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
add esp, 0x20
lea ecx, [ebp - 0x24]
call fcn.00402d30
lea ecx, [ebp - 0xd8]
call fcn.004011f0
lea ecx, [ebp - 0x68]
call fcn.004011f0
lea ecx, [ebp - 0x4c]
call fcn.004011f0
lea ecx, [ebp - 0xbc]
call fcn.004011f0
lea ecx, [ebp - 0x84]
call fcn.004011f0
lea ecx, [ebp - 0xa0]
call fcn.004011f0
lea ecx, [ebp - 0x130]
call fcn.004011f0
lea ecx, [ebp - 0x150]
call fcn.00402d30
lea ecx, [ebp - 0x160]
call fcn.00402d30
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], bl
call fcn.00418690
lea ecx, [ebp + 8]
call fcn.00402d30
jmp 0x416b7e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nERROR:_invalid_parameters__s
call fcn.00402500
lea ecx, [ebp - 0x114]
push ecx
call fcn.004187d0
imul edi, edi, 0x1c
add edi, dword [ebp + 0xc]
add esp, 0x24
mov ecx, edi
call fcn.004010b0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.__Parameter__s_is_expected_to_be_a_volume____shadow_copy_creation_is_assumed_
call fcn.00402500
lea edx, [ebp - 0x114]
push edx
call fcn.004187d0
add esp, 8
mov ecx, esp
mov dword [ebp - 0x134], esp
push str.__Example:_VSHADOW_C:
call fcn.00402500
lea eax, [ebp - 0x114]
push eax
call fcn.004187d0
add esp, 0x20
mov ecx, esi
call fcn.00414a10
lea ecx, [ebp - 0x24]
call fcn.00402d30
jmp 0x4179fe
mov ecx, edi
call fcn.004010b0
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x134], esp
push str._nERROR:_invalid_parameter__s_n
call fcn.00402500
lea edx, [ebp - 0x114]
push edx
call fcn.004187d0
add esp, 0x24
mov ecx, esi
call fcn.00414a10
lea ecx, [ebp - 0xd8]
call fcn.004011f0
lea ecx, [ebp - 0x68]
call fcn.004011f0
lea ecx, [ebp - 0x4c]
call fcn.004011f0
lea ecx, [ebp - 0xbc]
call fcn.004011f0
lea ecx, [ebp - 0x84]
call fcn.004011f0
lea ecx, [ebp - 0xa0]
call fcn.004011f0
lea ecx, [ebp - 0x130]
call fcn.004011f0
lea ecx, [ebp - 0x150]
call fcn.00402d30
lea ecx, [ebp - 0x160]
call fcn.00402d30
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], bl
call fcn.00418690
lea ecx, [ebp + 8]
call fcn.00402d30
mov eax, 1
jmp 0x416b80