Function at 0x6adbf0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x18c
mov dword [esp + eax + 0xa0], edx
add eax, 4
cmp eax, 0x18
jb 0x6adbf0ae
mov eax, dword [esp + 0x1a8]
mov dword [esp + 0x64], 0
mov dword [esp + 0x9c], eax
test byte [eax + 0x15], 0x80
jne 0x6adbf1b0
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a4]
mov dword [esp], eax
call fcn.6adb7fa0
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x6adbf188
cmp word [esp + 0x70], 7
jbe 0x6ae126fc
mov ecx, dword [esp + 0x74]
cmp ecx, 0x6ae27eb4
je 0x6adbf149
test ecx, ecx
je 0x6ae126fc
xor eax, eax
mov edx, 0x5c
jmp 0x6adbf137
movzx edx, word [eax + 0x6ae27eb4]
cmp word [ecx + eax], dx
jne 0x6ae126fc
add eax, 2
cmp eax, 8
jne 0x6adbf130
mov eax, dword [esp + 0x1a8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.6ada5f30
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x2c], eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
test edi, edi
je 0x6adbf1e0
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x6adbf19c
sub dword [eax], 1
je 0x6adbf379
mov eax, dword [esp + 0x2c]
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xb4]
mov dword [esp + 8], eax
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a4]
mov dword [esp], eax
call fcn.6adc0ee0
mov dword [esp + 0x2c], eax
jmp 0x6adbf0f8
mov eax, dword [esp + 0x1a8]
mov ecx, dword [eax + 0x84]
mov edx, dword [eax + 0x80]
lea eax, [esp + 0x64]
mov dword [esp], pe_nt_image_headers32
mov dword [esp + 4], eax
xor eax, eax
call fcn.6adbc5e0
test eax, eax
js 0x6ae12742
mov esi, dword [esp + 0x64]
lea eax, [esp + 0xf0]
lea ebx, [esp + 0x78]
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0x90
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6ae12647
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xa4], eax
xor eax, eax
cmp dword [esp + 0xf8], 8
je 0x6adbf670
mov byte [esp + 0xa0], al
lea eax, [esp + 0x80]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbf658
cmp dword [esp + 0x7c], 0xb
mov edx, dword [esp + 0x9c]
jbe 0x6ae12677
mov eax, dword [esp + 0x88]
mov dword [edx + 0x9c], 0
mov dword [edx + 0x98], eax
lea edx, [esp + 0xb8]
mov eax, esi
call fcn.6adbc6c0
test eax, eax
js 0x6ae12699
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0xd8]
mov edx, dword [esp + 0xdc]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp byte [esp + 0xa0], 0
jne 0x6adbf3b0
mov eax, dword [esp + 0x1a8]
xor edx, edx
mov ecx, dword [eax + 0x80]
lea eax, [esp + 0x9c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1a8]
mov dword [esp + 4], 0x6ae28320
mov eax, dword [eax + 0x84]
mov dword [esp], eax
mov eax, dword [esp + 0x1a0]
call fcn.6adbdfc0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x6adbf381
sub dword [eax], 1
jne 0x6adbf381
mov dword [esp], eax
call fcn.6adc0ea0
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x6adbf19c
mov eax, dword [esp + 0xac]
or eax, dword [esp + 0xa8]
jne 0x6ae125a1
mov eax, dword [esp + 0x2c]
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WIMLIB_DISABLE_QUERY_FILE_LAYOUT
call dword [sym.imp.msvcrt.dll__wgetenv]
mov dword [esp + 0x48], eax
test eax, eax
jne 0x6adbf31f
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov esi, dword [eax + 0x80]
mov eax, dword [eax + 0x84]
lea eax, [esi + eax*2 - 2]
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], eax
movzx eax, word [eax]
mov word [esp + 0x56], ax
cmp ax, 0x5c
jne 0x6adbf40f
mov eax, dword [esp + 0x5c]
xor edx, edx
mov word [eax], dx
mov dword [esp + 0x78], 0
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0xf0], edx
add eax, 4
cmp eax, 0x20
jb 0x6adbf41b
mov dword [esp + 0xf4], 0x3f
mov esi, dword [esp + 0x58]
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], ebx
mov edx, esi
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adbc5e0
test eax, eax
js 0x6adbfe9e
mov dword [esp + 0x50], 0x8000
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.6adab620
mov dword [esp + 0x4c], eax
test eax, eax
je 0x6adbfcb9
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0x90277
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.6adb8020
test eax, eax
js 0x6adbfc9d
mov eax, dword [esp + 0x4c]
mov ebx, dword [eax + 4]
add ebx, eax
mov dword [esp + 0x30], ebx
lea esi, [esi]
nop
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
mov dword [esp + 0x38], eax
movzx edx, di
xor eax, 5
or edx, eax
mov dword [esp + 0x3c], edi
je 0x6adbf790
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x6adbf776
add edx, ebx
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x6adbf6e8
xor edi, edi
xor ebp, ebp
lea esi, [esi]
mov ebx, ecx
mov eax, ecx
lea esi, [edx + 0x18]
shr ebx, 1
and eax, 1
jne 0x6adbf543
test ebx, ebx
jne 0x6adbf53b
jmp 0x6adbfc85
add eax, 1
cmp eax, ebx
je 0x6adbf6b0
cmp word [edx + eax*2 + 0x18], 0
jne 0x6adbf530
mov dword [esp + 0x2c], ebx
mov edi, esi
mov esi, dword [edx + 4]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Invalid_FILE_LAYOUT_NAME_ENTRY__FileReferenceNumber0x_016llx__FileNameLength_u__FileName_.ls__Flags0x_08x
mov dword [esp + 8], eax
call fcn.6ae0f1f5
mov dword [esp + 0x2c], 0x44
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab650
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, 0x44
not eax
setne bl
shr eax, 0x1f
and ebx, eax
cmp word [esp + 0x56], 0x5c
jne 0x6adbf5c8
mov eax, dword [esp + 0x5c]
mov esi, 0x5c
mov word [eax], si
lea esi, [esi]
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.6ad81840
mov esi, eax
test eax, eax
je 0x6adbf600
lea esi, [esi]
mov edi, dword [esi + 8]
mov dword [esp], esi
and edi, 0xfffffffc
call fcn.6adab650
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.6ad81870
mov esi, eax
test eax, eax
jne 0x6adbf5e0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.6ad81840
mov esi, eax
test eax, eax
je 0x6adbf638
lea esi, [esi]
mov edi, dword [esi + 8]
mov dword [esp], esi
and edi, 0xfffffffc
call fcn.6adab650
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.6ad81870
mov esi, eax
test eax, eax
jne 0x6adbf618
test bl, bl
jne 0x6adbf369
mov ecx, dword [esp + 0x2c]
test ecx, ecx
js 0x6adbf31f
jmp 0x6ae126c2
cmp eax, 0x80000005
je 0x6adbf2a2
jmp 0x6ae12670
xor eax, eax
mov edx, 0x4e
jmp 0x6adbf687
movzx edx, word [eax + str.NTFS]
cmp word [esp + eax + 0xfc], dx
jne 0x6adbf6a3
add eax, 2
cmp eax, 8
jne 0x6adbf680
mov eax, 1
jmp 0x6adbf269
xor eax, eax
jmp 0x6adbf269
mov ebx, dword [edx + 4]
test bl, 2
je 0x6adbf6c1
cmp ecx, 0x18
ja 0x6adbfc6b
cmp ebx, 2
je 0x6adbf6d1
add ecx, 0x19
add ebp, 1
and ecx, 0xfffffff8
add edi, ecx
mov eax, dword [edx]
test eax, eax
je 0x6adbfad0
add edx, eax
mov ecx, dword [edx + 0x10]
test ecx, ecx
jne 0x6adbf518
lea eax, [edx + 0x18]
mov esi, dword [edx + 4]
mov edi, eax
jmp 0x6adbf54c
sub ebp, ebx
mov dword [esp + 0x34], ebp
mov esi, dword [esp + 0x34]
cmp dword [esp + 0x40], esi
je 0x6adbf722
mov dword [esp + 8], 0x9c9
mov dword [esp + 4], str.src_win32_capture.c
mov dword [esp], str._u8__p____u8__ni__inode_size
call dword [0x6ae132b8]
mov eax, dword [esp + 0x68]
test eax, eax
je 0x6adbfc8d
mov edi, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov ebp, ecx
cmp edi, esi
sbb ebp, edx
jb 0x6adbfa4e
lea esi, [esi]
lea esi, [esi]
cmp esi, edi
sbb edx, ecx
jb 0x6adbfa30
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov dword [esp], str.Inode_0x_016llx_is_a_duplicate_
call fcn.6ae0f249
mov dword [esp], ebx
call fcn.6adab650
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 4]
test eax, eax
je 0x6adbfc78
add ebx, eax
mov dword [esp + 0x30], ebx
jmp 0x6adbf4d8
mov dword [esp + 0x40], 0x70
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x20]
mov dword [esp + 0x44], esi
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x6adbf7b6
test byte [eax + 0xd], 0x40
je 0x6adbfa73
xor esi, esi
mov eax, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.6adab680
mov ebx, eax
test eax, eax
je 0x6adbfcb9
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov dword [ebx + 0x48], esi
mov dword [esp + 0x34], 0x70
add eax, edi
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov edi, dword [eax + 0x20]
mov ebp, dword [eax + 4]
mov dword [ebx + 0x10], edx
xor edx, 5
mov dword [ebx + 0x38], edi
mov edi, dword [eax]
mov dword [ebx + 0x1c], ebp
mov ebp, dword [eax + 0x14]
mov dword [ebx + 0x18], edi
mov edi, dword [eax + 0x10]
mov dword [ebx + 0x14], ecx
movzx ecx, cx
mov dword [ebx + 0x28], edi
mov edi, dword [eax + 8]
or ecx, edx
mov dword [ebx + 0x2c], ebp
mov ebp, dword [eax + 0xc]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], ebp
lea ebp, [ebx + 0x70]
mov dword [ebx + 0x3c], eax
je 0x6adbf8f4
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x18]
add esi, eax
lea eax, [ebx + 0x54]
mov dword [esp + 0x38], eax
jmp 0x6adbf8b0
mov eax, ebp
sub eax, ebx
cmp edi, 2
je 0x6adbf8a8
shl edi, 0x1f
and eax, 0x7fffffff
lea ecx, [esi + 0x18]
add dword [ebx + 0x40], 1
mov edx, edi
mov edi, dword [esi + 0x10]
or edx, eax
mov eax, dword [esi + 8]
mov dword [ebp], edx
mov edx, dword [esi + 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, edi
xor edx, edx
shr eax, 1
mov word [ebp + eax*2 + 0x10], dx
lea edx, [edi + 0x19]
and edx, 0xfffffff8
add ebp, edx
mov eax, ebp
sub eax, ebx
mov edx, dword [esi]
test edx, edx
je 0x6adbf8f0
add esi, edx
mov edi, dword [esi + 4]
test edi, 2
je 0x6adbf850
lea eax, [esi + 0x18]
mov ecx, dword [esi + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 0x34], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x34]
xor eax, eax
shr ecx, 1
mov word [ebx + ecx*2 + 0x54], ax
jmp 0x6adbf850
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x6adbf6fb
test byte [eax + 0xd], 0x40
jne 0x6adbf6fb
add esi, dword [esp + 0x30]
jmp 0x6adbf9d0
mov dword [esp + 0x80], 0x6ae28320
mov dword [esp + 0xb8], 0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
mov edi, eax
mov dword [esp + 0x38], eax
and edi, 0x10
jne 0x6adbf9c3
mov eax, dword [esp + 0x80]
add dword [ebx + 0x44], 1
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x6adbf980
add eax, esi
test byte [eax], 1
je 0x6adbf980
cmp dword [eax + 8], 0
je 0x6adbf980
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
mov ecx, edx
mov edx, eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], ecx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [edi + edi]
mov dword [esp + 0x3c], ecx
mov dword [ebp], eax
lea eax, [ebp + 8]
mov dword [ebp + 4], edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x3c]
xor eax, eax
mov word [ebp + edi*2 + 8], ax
add ecx, 0x11
and ecx, 0xfffffff8
add ebp, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x6adbf6f5
add esi, eax
mov edx, dword [esi + 0x2c]
test edx, edx
je 0x6adbf920
shr edx, 1
je 0x6adbf9c3
cmp word [esi + 0x30], 0x3a
jne 0x6adbf9c3
lea edi, [esp + 0xb8]
lea eax, [esi + 0x30]
mov dword [esp], edi
lea ecx, [esp + 0x80]
call fcn.6adbce00
test al, al
je 0x6adbf9c3
mov edi, dword [esp + 0xb8]
test edi, edi
je 0x6adbf936
mov eax, dword [esp + 0x80]
add dword [ebx + 0x44], 1
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x4c], eax
jmp 0x6adbf986
mov edx, dword [eax + 4]
lea esi, [eax + 4]
test edx, edx
je 0x6adbfa56
mov eax, edx
mov ebp, ecx
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
cmp edi, esi
sbb ebp, edx
jae 0x6adbf750
mov esi, eax
mov edx, dword [esi]
test edx, edx
jne 0x6adbfa3a
or eax, 1
lea edx, [esp + 0x68]
mov dword [esi], ebx
mov dword [ebx + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.6ad818a0
jmp 0x6adbf776
mov eax, dword [esp + 0x30]
lea ebp, [eax + esi]
mov ecx, dword [ebp + 0x2c]
mov esi, ecx
and esi, 1
je 0x6adbfae4
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], str.Invalid_STREAM_LAYOUT_ENTRY__FileReferenceNumber0x_016llx__StreamIdentifierLength_u__StreamIdentifier_.ls
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
call fcn.6ae0f249
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf584
test ebp, ebp
je 0x6ae126d3
lea eax, [edi + 0x70]
mov dword [esp + 0x40], eax
jmp 0x6adbf798
xor ebx, ebx
lea esi, [esi]
lea esi, [esi]
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
je 0x6adbfb95
mov edx, eax
mov eax, edi
jmp 0x6adbfb18
add eax, 2
sub edx, 1
je 0x6adbfb38
cmp word [eax], 0
jne 0x6adbfb10
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
jmp 0x6adbfa8f
cmp word [ebp + 0x30], 0x3a
jne 0x6adbfbb4
lea eax, [esp + 0xb8]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x80]
mov dword [esp], eax
mov eax, edi
call fcn.6adbce00
test al, al
je 0x6adbfbb4
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x6adbfba4
lea eax, [eax + eax + 0x11]
and eax, 0xfffffff8
add ebx, eax
mov eax, dword [ebp + 4]
test eax, eax
je 0x6adbfbf8
add ebp, eax
mov ecx, dword [ebp + 0x2c]
test cl, 1
je 0x6adbfaf0
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
jmp 0x6adbfb1e
test ecx, ecx
jne 0x6adbfbb4
mov dword [esp + 0xb8], 0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], eax
and eax, 0x10
je 0x6adbfb6a
mov eax, dword [ebp + 0x2c]
cmp eax, 0x18
je 0x6adbfc08
cmp eax, 0xa
je 0x6adbfc38
cmp eax, 0x22
jne 0x6adbfb73
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.::_EA_INFORMATION
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
mov edx, eax
mov eax, esi
or eax, 4
test edx, edx
cmove esi, eax
mov eax, dword [ebp + 4]
test eax, eax
jne 0x6adbfb7a
lea esi, [esi]
add dword [esp + 0x40], ebx
jmp 0x6adbf7b6
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.::_OBJECT_ID
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
mov edx, eax
mov eax, esi
or eax, 1
test edx, edx
cmove esi, eax
jmp 0x6adbfb73
mov eax, dword [str.::_EA]
cmp dword [edi], eax
jne 0x6adbfb73
mov eax, dword [0x6ae282f4]
cmp dword [edi + 4], eax
jne 0x6adbfb73
mov eax, esi
movzx ecx, word [0x6ae282f8]
or eax, 2
cmp word [edi + 8], cx
cmove esi, eax
jmp 0x6adbfb73
mov edi, esi
mov dword [esp + 0x2c], eax
mov esi, ebx
jmp 0x6adbf54c
and dword [esp + 0xf4], 0xfffffffe
jmp 0x6adbf47f
mov ebx, dword [edx + 4]
jmp 0x6adbf6c1
lea edx, [esp + 0x68]
mov eax, 1
mov esi, edx
jmp 0x6adbfa5d
cmp eax, 0xc0000023
jne 0x6adbfcc6
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab650
shl dword [esp + 0x50], 1
jmp 0x6adbf467
mov dword [esp + 0x2c], 0x27
jmp 0x6adbf584
cmp eax, 0xc0000011
jne 0x6adbfe72
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab650
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push eax
cmp word [esp + 0x56], 0x5c
jne 0x6adbfcfb
mov eax, dword [esp + 0x5c]
mov word [eax], 0x5c
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 0x30], eax
call fcn.6ad81760
mov dword [esp + 0x34], eax
test eax, eax
je 0x6ae125ff
lea esi, [esi]
nop
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 0x10]
movzx edx, word [eax + 0x14]
mov eax, ebx
mov dword [esp + 0x2c], ebx
xor eax, 5
or edx, eax
je 0x6adbfdf5
mov eax, dword [esp + 0x34]
mov edi, dword [eax + 0x40]
lea esi, [eax + 0x70]
jmp 0x6adbfd84
cmp ecx, ebp
sbb edx, ebx
jb 0x6adbfdf0
mov edx, dword [eax + 0x50]
mov edi, dword [esp + 0x2c]
mov dword [esi + 8], edx
mov dword [eax + 0x50], esi
sub edi, 1
je 0x6adbfe00
lea eax, [esi + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + eax + 0x19]
and eax, 0xfffffff8
add esi, eax
mov eax, dword [esp + 0x30]
mov ebp, dword [esi + 8]
mov ebx, dword [esi + 0xc]
test eax, eax
je 0x6adbfdb4
mov dword [esp + 0x2c], edi
lea esi, [esi]
lea esi, [esi]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov edi, ebx
cmp ebp, ecx
sbb edi, edx
jae 0x6adbfd50
mov eax, dword [eax]
test eax, eax
jne 0x6adbfda0
mov eax, dword [esp + 0x34]
add esi, 0x10
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 4], ebp
mov dword [esp], str.Parent_inode_0x_016llx_ofdirectory_entry___ls___inode_0x_016llx__was_missing_from_the_MFT_listing_
call fcn.6ae0f1f5
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf5c8
mov eax, dword [eax + 4]
jmp 0x6adbfdb0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x48], eax
lea esi, [esi]
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.6ad817a0
mov dword [esp + 0x34], eax
test eax, eax
jne 0x6adbfd20
mov ebx, dword [esp + 0x48]
test ebx, ebx
je 0x6ae125ff
lea eax, [esp + 0x6c]
mov dword [ebx + 0x40], 1
xor ecx, ecx
mov edx, 0x6ae28320
mov dword [esp + 0xc], eax
lea eax, [esp + 0x68]
mov dword [esp + 8], eax
lea eax, [esp + 0x9c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a0]
mov dword [esp], ebx
call fcn.6adbe7b0
cmp eax, 0x44
mov dword [esp + 0x2c], eax
not eax
setne bl
shr eax, 0x1f
and ebx, eax
jmp 0x6adbf5c8
cmp eax, 0xc0000010
sete cl
cmp eax, 0xc00000bb
sete dl
or cl, dl
jne 0x6adbfe91
cmp eax, 0xc000000d
jne 0x6ae12622
mov dword [esp + 0x2c], 0xffffffff
jmp 0x6adbf584
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2c], 0xffffffff
jmp 0x6adbf584
mov eax, dword [esp + 0x1a4]
mov dword [esp], str.Scan_of___ls__complete__but_with_one_or_more_warnings:
mov dword [esp + 4], eax
call fcn.6ae0f249
mov eax, dword [esp + 0xac]
test eax, eax
je 0x6ae125d3
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_SACL__System_Access_Control_List__n____________on__lu_files_or_directories.
call fcn.6ae0f249
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x6ae125ee
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_security_descriptor_at_all_n____________on__lu_files_or_directories.
call fcn.6ae0f249
mov dword [esp], str.To_fully_capture_all_security_descriptors__run_the_program_n__________with_Administrator_rights.
call fcn.6ae0f249
jmp 0x6adbf19c
mov eax, dword [esp + 0x58]
mov dword [esp], str.The_MFT_listing_for_volume___ls__did_not_include_a_root_directory_
xor ebx, ebx
mov dword [esp + 4], eax
call fcn.6ae0f1f5
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf5c8
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], str.Error_enumerating_files_on_volume___ls_
mov dword [esp], eax
mov dword [esp + 8], ebx
call fcn.6ae11e11
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf584
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_attributes
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae11dea
jmp 0x6adbf270
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_ID
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae11dea
jmp 0x6adbf2cb
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_file_information
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae11dea
jmp 0x6adbf302
mov dword [esp], str.A_problem_occurred_during_the_fast_MFT_scan._n__________Falling_back_to_the_standard_recursive_directory_tree_scan.
call fcn.6ae0f249
jmp 0x6adbf31f
mov eax, dword [esp + 0x38]
mov dword [esp], str.Inode_0x_016llx_has_no_long_names_
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
call fcn.6ae0f1f5
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf584
mov eax, dword [esp + 0x1a4]
mov dword [esp], str.__ls_:_unrecognized_path_format
mov dword [esp + 4], eax
call fcn.6ae0f1f5
mov ebx, dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov dword [esp + 0x2c], 0x18
jmp 0x6adbf188
mov ebx, dword [esp + 0x1a4]
mov dword [esp], eax
mov dword [esp + 4], str.Cant_open___ls_
mov dword [esp + 8], ebx
mov dword [esp + 0x2c], eax
call fcn.6ae11e11
mov eax, dword [esp + 0x2c]
mov edx, 0x52
cmp eax, 0xc0210000
mov eax, 0x2f
cmove eax, edx
mov dword [esp + 0x2c], eax
jmp 0x6adbf188