Function at 0x6adc3f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x1ac
mov dword [esp + eax + 0xc0], edx
add eax, 4
cmp eax, 0x18
jb 0x6adc3f7e
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x84], 0
mov dword [esp + 0xbc], eax
test byte [eax + 0x15], 0x80
jne 0x6adc4078
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp], eax
call fcn.6adbcc40
mov esi, eax
test esi, esi
jne 0x6adc40a7
cmp word [esp + 0x90], 7
jbe 0x6add8959
mov edx, dword [esp + 0x94]
cmp edx, str.___
je 0x6adc4019
test edx, edx
je 0x6add8959
xor eax, eax
lea esi, [esi]
movzx ebx, word [eax + str.___]
cmp word [edx + eax], bx
jne 0x6add8959
add eax, 2
cmp eax, 8
jne 0x6adc4000
mov eax, dword [esp + 0x1c8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.6ada6f90
mov ebx, dword [esp + 0x94]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
test esi, esi
je 0x6adc40d0
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc4067
sub dword [eax], 1
je 0x6adc40b7
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xd4]
mov dword [esp + 8], eax
lea eax, [esp + 0x90]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp], eax
call fcn.6adc5ef0
mov esi, eax
test esi, esi
je 0x6adc3fd4
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc4067
sub dword [eax], 1
jne 0x6adc4067
mov dword [esp], eax
call fcn.6adc5eb0
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c8]
mov ecx, dword [eax + 0x84]
mov edx, dword [eax + 0x80]
lea eax, [esp + 0x84]
mov dword [esp], pe_nt_image_headers32
mov dword [esp + 4], eax
xor eax, eax
call fcn.6adc13c0
test eax, eax
js 0x6add87c6
mov ebx, dword [esp + 0x84]
lea eax, [esp + 0x110]
lea edi, [esp + 0x98]
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0x90
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6add884e
mov eax, dword [esp + 0x110]
mov dword [esp + 0xc4], eax
xor eax, eax
cmp dword [esp + 0x118], 8
je 0x6adc4570
mov byte [esp + 0xc0], al
lea eax, [esp + 0xa0]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6adc4550
cmp dword [esp + 0x9c], 0xb
mov edx, dword [esp + 0xbc]
jbe 0x6add887e
mov eax, dword [esp + 0xa8]
mov dword [edx + 0x9c], 0
mov dword [edx + 0x98], eax
lea edx, [esp + 0xd8]
mov eax, ebx
call fcn.6adc14a0
test eax, eax
js 0x6add88d2
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp byte [esp + 0xc0], 0
jne 0x6adc42a8
mov eax, dword [esp + 0x1c8]
xor edx, edx
mov ecx, dword [eax + 0x80]
lea eax, [esp + 0xbc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 4], 0x6adee9a0
mov eax, dword [eax + 0x84]
mov dword [esp], eax
mov eax, dword [esp + 0x1c0]
call fcn.6adc2dc0
mov esi, eax
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x6adc427a
sub dword [eax], 1
je 0x6adc4560
test esi, esi
jne 0x6adc4067
mov eax, dword [esp + 0xcc]
or eax, dword [esp + 0xc8]
jne 0x6add88fb
add esp, 0x1ac
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WIMLIB_DISABLE_QUERY_FILE_LAYOUT
call dword [sym.imp.msvcrt.dll__wgetenv]
mov dword [esp + 0x60], eax
test eax, eax
jne 0x6adc421e
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov ebx, dword [eax + 0x80]
mov eax, dword [eax + 0x84]
lea eax, [ebx + eax*2 - 2]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], eax
movzx eax, word [eax]
mov word [esp + 0x76], ax
cmp ax, 0x5c
je 0x6adc4c07
mov dword [esp + 0x98], 0
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0x110], edx
add eax, 4
cmp eax, 0x20
jb 0x6adc4317
mov dword [esp + 0x114], 0x3f
mov ebx, dword [esp + 0x78]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], edi
mov edx, ebx
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adc13c0
test eax, eax
js 0x6adc4cdb
mov dword [esp + 0x68], 0x8000
mov dword [esp + 0x58], esi
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.6adaeec0
mov dword [esp + 0x64], eax
test eax, eax
je 0x6adc4ca4
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], 0x90277
mov dword [esp + 0x10], eax
lea eax, [esp + 0x110]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call fcn.6adbccc0
test eax, eax
js 0x6adc4c88
mov eax, dword [esp + 0x64]
mov ebp, dword [eax + 4]
add ebp, eax
lea esi, [esi]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
movzx eax, si
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], esi
xor eax, 5
or eax, edx
je 0x6adc46c8
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x6adc467a
add ebx, ebp
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x6adc45dd
mov dword [esp + 0x5c], ecx
xor eax, eax
xor esi, esi
mov dword [esp + 0x44], ebp
mov ebp, eax
lea esi, [esi]
mov eax, edi
lea ecx, [ebx + 0x18]
mov edx, dword [ebx + 4]
shr eax, 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], eax
test edi, 1
je 0x6adc4690
mov ecx, edx
mov esi, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], str.Invalid_FILE_LAYOUT_NAME_ENTRY__FileReferenceNumber0x_016llx__FileNameLength_u__FileName_.ls__Flags0x_08x
mov dword [esp + 8], eax
call fcn.6add55aa
mov esi, 0x44
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp word [esp + 0x76], 0x5c
jne 0x6adc44b9
mov eax, dword [esp + 0x7c]
mov edi, 0x5c
mov word [eax], di
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.6ad81870
mov edi, eax
test eax, eax
je 0x6adc44f0
nop
mov ebx, dword [edi + 8]
mov dword [esp], edi
and ebx, 0xfffffffc
call fcn.6adaeef0
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.6ad818a0
mov edi, eax
test eax, eax
jne 0x6adc44d0
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.6ad81870
mov edi, eax
test eax, eax
je 0x6adc4528
lea esi, [esi]
mov ebx, dword [edi + 8]
mov dword [esp], edi
and ebx, 0xfffffffc
call fcn.6adaeef0
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.6ad818a0
mov edi, eax
test eax, eax
jne 0x6adc4508
test esi, esi
js 0x6adc421e
cmp esi, 0x44
jne 0x6adc4266
test esi, esi
js 0x6adc421e
jmp 0x6add88a0
cmp eax, 0x80000005
je 0x6adc419b
jmp 0x6add8877
mov dword [esp], eax
call fcn.6adc5eb0
jmp 0x6adc427a
xor eax, eax
jmp 0x6adc4580
add eax, 2
cmp eax, 8
je 0x6adc4598
movzx ecx, word [eax + str.NTFS]
cmp word [esp + eax + 0x11c], cx
je 0x6adc4578
xor eax, eax
jmp 0x6adc4162
mov eax, 1
jmp 0x6adc4162
test dl, 2
je 0x6adc45b6
cmp edi, 0x18
ja 0x6adc46ba
cmp edx, 2
je 0x6adc45c6
add edi, 0x19
add esi, 1
and edi, 0xfffffff8
add ebp, edi
mov eax, dword [ebx]
test eax, eax
je 0x6adc4b50
add ebx, eax
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x6adc4430
lea eax, [ebx + 0x18]
mov ecx, dword [ebx + 4]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x2c], eax
jmp 0x6adc4452
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x5c]
sub esi, eax
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x38]
cmp dword [esp + 0x44], esi
je 0x6adc4625
mov dword [esp + 8], 0x9c6
mov dword [esp + 4], str.src_win32_capture.c
mov dword [esp], str._u8__p____u8__ni__inode_size
call dword [0x6add9074]
mov eax, dword [esp + 0x88]
test eax, eax
je 0x6adc4bf4
mov esi, dword [esp + 0x2c]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0x14]
cmp edi, ecx
mov ebx, esi
sbb ebx, edx
jb 0x6adc4a9e
cmp ecx, edi
sbb edx, esi
jb 0x6adc4a80
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp], str.Inode_0x_016llx_is_a_duplicate_
call fcn.6add55fc
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [ebp + 4]
test eax, eax
je 0x6adc4be7
add ebp, eax
jmp 0x6adc43d8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6adc45b6
mov ecx, eax
mov eax, dword [esp + 0x2c]
jmp 0x6adc46b4
add eax, 2
sub ecx, 1
je 0x6adc45a8
cmp word [eax], 0
jne 0x6adc46a8
mov esi, dword [esp + 0x38]
mov ecx, edx
jmp 0x6adc4452
mov dword [esp + 0x44], 0x70
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x6adc47d6
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x5c], eax
test ah, 0x40
jne 0x6adc47d4
lea edi, [ebp + esi]
mov ebx, dword [edi + 0x2c]
test bl, 1
jne 0x6adc47c4
xor esi, esi
and eax, 0x10
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0x2c], esi
mov edx, ebx
lea ebp, [edi + 0x30]
shr edx, 1
je 0x6adc4b1e
mov ecx, edx
mov eax, ebp
jmp 0x6adc4730
add eax, 2
sub ecx, 1
je 0x6adc4768
cmp word [eax], 0
jne 0x6adc4728
mov esi, ebp
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], str.Invalid_STREAM_LAYOUT_ENTRY__FileReferenceNumber0x_016llx__StreamIdentifierLength_u__StreamIdentifier_.ls
call fcn.6add55fc
jmp 0x6adc4482
cmp word [edi + 0x30], 0x3a
jne 0x6adc4ad2
lea eax, [esp + 0xd8]
lea ecx, [esp + 0xa0]
mov dword [esp], eax
mov eax, ebp
call fcn.6adc1bb0
test al, al
je 0x6adc4ad2
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x6adc4aca
lea eax, [eax + eax + 0x11]
and eax, 0xfffffff8
add esi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x6adc4bd0
add edi, eax
mov ebx, dword [edi + 0x2c]
test bl, 1
je 0x6adc4710
lea eax, [edi + 0x30]
mov esi, eax
mov eax, ebx
shr eax, 1
mov edx, eax
jmp 0x6adc4738
xor esi, esi
mov eax, dword [esp + 0x44]
mov dword [esp], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 4], eax
call fcn.6adaef20
mov dword [esp + 0x2c], eax
mov ebx, eax
mov edi, eax
test eax, eax
je 0x6adc4ca4
mov ecx, dword [esp + 0x38]
mov edx, dword [ebp + 0x14]
lea eax, [ebp + ecx]
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x10], ecx
mov ebx, dword [eax + 0x20]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax]
mov dword [esp + 0x38], ebx
mov ebx, dword [eax + 0x2c]
mov dword [esp + 0x3c], ebx
mov ebx, dword [eax + 4]
mov dword [edi + 0x18], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 0x1c], ebx
mov ebx, dword [eax + 0x14]
mov dword [edi + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 0x2c], ebx
mov ebx, dword [eax + 0xc]
mov eax, edi
mov dword [edi + 0x20], ecx
mov ecx, dword [esp + 0x40]
mov dword [edi + 0x24], ebx
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [eax + 0x48], esi
lea esi, [eax + 0x70]
mov dword [eax + 0x3c], ebx
mov ebx, eax
mov dword [eax + 0x38], edi
movzx eax, dx
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x38], 0x70
xor eax, 5
or eax, edx
je 0x6adc4942
mov edi, dword [ebp + 0x18]
mov eax, ebx
lea ebx, [ebx + 0x54]
mov dword [esp + 0x38], ebp
add edi, ebp
mov ebp, esi
mov esi, ebx
mov ebx, eax
jmp 0x6adc48fe
cmp eax, 2
je 0x6adc48f6
mov ecx, ebp
mov edx, dword [edi + 0xc]
shl eax, 0x1f
add dword [ebx + 0x40], 1
sub ecx, ebx
and ecx, 0x7fffffff
or ecx, eax
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], edx
mov edx, dword [edi + 0x10]
mov dword [ebp], ecx
lea ecx, [edi + 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
xor edx, edx
mov ecx, eax
add eax, 0x19
shr ecx, 1
and eax, 0xfffffff8
mov word [ebp + ecx*2 + 0x10], dx
add ebp, eax
mov eax, dword [edi]
test eax, eax
je 0x6adc4930
add edi, eax
mov eax, dword [edi + 4]
test al, 2
je 0x6adc48a0
mov ecx, dword [edi + 0x10]
lea eax, [edi + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
xor ecx, ecx
shr eax, 1
mov word [ebx + eax*2 + 0x54], cx
mov eax, dword [edi + 4]
jmp 0x6adc48a0
mov esi, ebp
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov eax, esi
sub eax, edi
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x6adc45fe
test byte [ebp + 0xd], 0x40
jne 0x6adc45fe
mov dword [esp + 0x5c], ebp
lea edi, [ebp + eax]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc4a1f
mov dword [esp + 0xa0], 0x6adee9a0
mov dword [esp + 0xd8], 0
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0xc]
mov ebx, eax
mov dword [esp + 0x3c], eax
and ebx, 0x10
jne 0x6adc4a12
mov eax, dword [esp + 0xa0]
xor edx, edx
add dword [ebp + 0x44], 1
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x4c], eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x6adc49d0
add eax, edi
test byte [eax], 1
je 0x6adc49d0
cmp dword [eax + 8], 0
je 0x6adc49d0
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
mov ecx, edx
mov edx, eax
mov dword [ebp + 0x30], edx
mov dword [ebp + 0x34], ecx
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
lea ecx, [ebx + ebx]
mov dword [esp + 0x40], ecx
mov dword [esi], eax
lea eax, [esi + 8]
mov dword [esi + 4], edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x40]
xor eax, eax
mov word [esi + ebx*2 + 8], ax
add ecx, 0x11
and ecx, 0xfffffff8
add esi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x6adc45f0
add edi, eax
mov edx, dword [edi + 0x2c]
test edx, edx
je 0x6adc4970
shr edx, 1
je 0x6adc4a12
cmp word [edi + 0x30], 0x3a
jne 0x6adc4a12
lea ebx, [esp + 0xd8]
lea eax, [edi + 0x30]
mov dword [esp], ebx
lea ecx, [esp + 0xa0]
call fcn.6adc1bb0
test al, al
je 0x6adc4a12
mov ebx, dword [esp + 0xd8]
test ebx, ebx
je 0x6adc4986
mov eax, dword [esp + 0xa0]
add dword [ebp + 0x44], 1
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
mov dword [ebp + 0x4c], eax
jmp 0x6adc49d6
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
test edx, edx
je 0x6adc4aa6
mov eax, edx
mov ebx, esi
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
cmp edi, ecx
sbb ebx, edx
jae 0x6adc4650
mov ecx, eax
mov edx, dword [ecx]
test edx, edx
jne 0x6adc4a8a
or eax, 1
lea edx, [esp + 0x88]
mov esi, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [esi + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
call fcn.6ad818d0
jmp 0x6adc467a
mov eax, dword [esp + 0x38]
test eax, eax
je 0x6adc4b40
cmp ebx, 0x18
je 0x6adc4b70
cmp ebx, 0xa
je 0x6adc4ba1
cmp ebx, 0x22
jne 0x6adc47ab
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.::_EA_INFORMATION
mov dword [esp], ebp
call sub.msvcrt.dll_memcmp
mov ebx, dword [esp + 0x2c]
mov edx, eax
mov eax, ebx
or eax, 4
test edx, edx
cmovne eax, ebx
mov dword [esp + 0x2c], eax
jmp 0x6adc47ab
test ebx, ebx
jne 0x6adc47ab
mov dword [esp + 0xd8], 0
test byte [esp + 0x5c], 0x10
jne 0x6adc47ab
lea esi, [esi]
xor eax, eax
jmp 0x6adc47a2
mov eax, ebp
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x44]
test esi, esi
je 0x6add88b1
add eax, 0x70
mov dword [esp + 0x44], eax
jmp 0x6adc46d0
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.::_OBJECT_ID
mov dword [esp], ebp
call sub.msvcrt.dll_memcmp
mov ebx, dword [esp + 0x2c]
mov edx, eax
mov eax, ebx
or eax, 1
test edx, edx
cmovne eax, ebx
mov dword [esp + 0x2c], eax
jmp 0x6adc47ab
cmp dword [ebp], 0x3a003a
jne 0x6adc47ab
cmp dword [ebp + 4], 0x450024
jne 0x6adc47ab
cmp word [ebp + 8], 0x41
jne 0x6adc47ab
or dword [esp + 0x2c], 2
jmp 0x6adc47ab
mov edi, esi
mov ebp, dword [esp + 0x6c]
add dword [esp + 0x44], edi
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x2c]
jmp 0x6adc47d6
and dword [esp + 0x114], 0xfffffffe
jmp 0x6adc437f
lea edx, [esp + 0x88]
mov eax, 1
mov ecx, edx
jmp 0x6adc4ab0
mov eax, dword [esp + 0x7c]
xor edx, edx
mov word [eax], dx
xor edx, edx
xor eax, eax
mov dword [esp + 0x98], 0
mov dword [esp + eax + 0x110], edx
add eax, 4
cmp eax, 0x20
jb 0x6adc4c1f
mov dword [esp + 0x114], 0x3f
mov ebx, dword [esp + 0x78]
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], edi
mov edx, ebx
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adc13c0
test eax, eax
jns 0x6adc435b
xor ecx, ecx
or esi, 0xffffffff
mov dword [esp], ecx
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push ebx
jmp 0x6adc44ad
cmp eax, 0xc0000023
jne 0x6adc4cfd
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
shl dword [esp + 0x68], 1
jmp 0x6adc4367
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push ebp
cmp word [esp + 0x76], 0x5c
jne 0x6adc4cd1
mov eax, dword [esp + 0x7c]
mov word [eax], 0x5c
mov esi, 0x27
jmp 0x6adc44b9
xor eax, eax
or esi, 0xffffffff
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push edx
jmp 0x6adc44b9
cmp eax, 0xc0000011
je 0x6adc4d2b
cmp eax, 0xc0000010
sete dl
cmp eax, 0xc00000bb
sete cl
or dl, cl
jne 0x6adc4d23
cmp eax, 0xc000000d
jne 0x6add880a
or esi, 0xffffffff
jmp 0x6adc4487
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x98]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push esi
cmp word [esp + 0x76], 0x5c
jne 0x6adc4d58
mov eax, dword [esp + 0x7c]
mov word [eax], 0x5c
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call fcn.6ad81750
mov ebp, eax
test eax, eax
je 0x6add87a8
lea esi, [esi]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x50], eax
movzx eax, word [ebp + 0x14]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
xor eax, 5
or eax, edx
je 0x6adc4eac
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x30], ebp
lea ebx, [ebp + 0x70]
mov dword [esp + 0x2c], eax
jmp 0x6adc4dde
cmp ecx, edi
sbb edx, esi
jb 0x6adc4e40
sub dword [esp + 0x2c], 1
mov edx, dword [eax + 0x50]
mov dword [ebx + 8], edx
mov dword [eax + 0x50], ebx
je 0x6adc4e45
lea eax, [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + eax + 0x19]
and eax, 0xfffffff8
add ebx, eax
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
mov eax, dword [esp + 0x88]
lea esi, [esi]
nop
test eax, eax
je 0x6adc4e08
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov ebp, esi
cmp edi, ecx
sbb ebp, edx
jae 0x6adc4db0
mov eax, dword [eax]
test eax, eax
jne 0x6adc4df4
mov ebp, dword [esp + 0x30]
lea ecx, [ebx + 0x10]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], esi
mov dword [esp], str.Parent_inode_0x_016llx_ofdirectory_entry___ls___inode_0x_016llx__was_missing_from_the_MFT_listing_
call fcn.6add55aa
jmp 0x6add87bc
mov eax, dword [eax + 4]
jmp 0x6adc4df0
mov ebp, dword [esp + 0x30]
mov dword [esp], ebp
call fcn.6ad817b0
mov ebp, eax
test eax, eax
jne 0x6adc4d78
mov esi, dword [esp + 0x60]
test esi, esi
je 0x6add87a8
lea eax, [esp + 0x8c]
mov dword [esi + 0x40], 1
xor ecx, ecx
mov edx, 0x6adee9a0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x88]
mov dword [esp + 8], eax
lea eax, [esp + 0xbc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c0]
mov dword [esp], esi
call fcn.6adc3630
mov esi, eax
jmp 0x6adc44b9
mov dword [esp + 0x60], ebp
jmp 0x6adc4e49
mov eax, dword [esp + 0x78]
mov dword [esp], str.The_MFT_listing_for_volume___ls__did_not_include_a_root_directory_
mov dword [esp + 4], eax
call fcn.6add55aa
mov esi, 0x44
jmp 0x6adc44b9
mov esi, dword [esp + 0x1c4]
mov dword [esp], eax
mov dword [esp + 4], str.Cant_open___ls_
mov dword [esp + 8], esi
mov dword [esp + 0x2c], eax
call fcn.6add8103
mov eax, dword [esp + 0x2c]
cmp eax, 0xc0210000
mov eax, dword [esp + 0xd4]
jne 0x6add8827
test eax, eax
je 0x6add8800
sub dword [eax], 1
je 0x6add8844
mov esi, 0x52
jmp 0x6adc4067
mov esi, dword [esp + 0x78]
mov dword [esp + 4], str.Error_enumerating_files_on_volume___ls_
mov dword [esp], eax
mov dword [esp + 8], esi
call fcn.6add8103
jmp 0x6adc4482
test eax, eax
je 0x6add8830
sub dword [eax], 1
je 0x6add883a
mov esi, 0x2f
jmp 0x6adc4067
mov dword [esp], eax
call fcn.6adc5eb0
jmp 0x6add8830
mov dword [esp], eax
call fcn.6adc5eb0
jmp 0x6add8800
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_attributes
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80de
jmp 0x6adc4169
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_ID
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80de
jmp 0x6adc41c7
mov dword [esp], str.A_problem_occurred_during_the_fast_MFT_scan._n__________Falling_back_to_the_standard_recursive_directory_tree_scan.
call fcn.6add55fc
jmp 0x6adc421e
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Inode_0x_016llx_has_no_long_names_
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call fcn.6add55aa
jmp 0x6adc4482
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_file_information
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6add80de
jmp 0x6adc41fe
mov eax, dword [esp + 0x1c4]
mov dword [esp], str.Scan_of___ls__complete__but_with_one_or_more_warnings:
mov dword [esp + 4], eax
call fcn.6add55fc
mov eax, dword [esp + 0xcc]
test eax, eax
je 0x6add892d
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_SACL__System_Access_Control_List__n____________on__lu_files_or_directories.
call fcn.6add55fc
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x6add8948
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_security_descriptor_at_all_n____________on__lu_files_or_directories.
call fcn.6add55fc
mov dword [esp], str.To_fully_capture_all_security_descriptors__run_the_program_n__________with_Administrator_rights.
call fcn.6add55fc
jmp 0x6adc4067
mov eax, dword [esp + 0x1c4]
mov dword [esp], str.__ls_:_unrecognized_path_format
mov esi, 0x18
mov dword [esp + 4], eax
call fcn.6add55aa
mov ebx, dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esp + 0xd4]
test eax, eax
jne 0x6adc4062
jmp 0x6adc4067