Function at 0x6adbed10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x18c
mov dword [esp + eax + 0xa0], edx
add eax, 4
cmp eax, 0x18
jb 0x6adbed1e
mov eax, dword [esp + 0x1a8]
mov dword [esp + 0x64], 0
mov dword [esp + 0x9c], eax
test byte [eax + 0x15], 0x80
jne 0x6adbee20
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a4]
mov dword [esp], eax
call fcn.6adb7ce0
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x6adbedf8
cmp word [esp + 0x70], 7
jbe 0x6ae0e87d
mov ecx, dword [esp + 0x74]
cmp ecx, 0x6ae23d54
je 0x6adbedb9
test ecx, ecx
je 0x6ae0e87d
xor eax, eax
mov edx, 0x5c
jmp 0x6adbeda7
movzx edx, word [eax + 0x6ae23d54]
cmp word [ecx + eax], dx
jne 0x6ae0e87d
add eax, 2
cmp eax, 8
jne 0x6adbeda0
mov eax, dword [esp + 0x1a8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.6ada5cb0
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x2c], eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
test edi, edi
je 0x6adbee50
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x6adbee0c
sub dword [eax], 1
je 0x6adbefe1
mov eax, dword [esp + 0x2c]
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0xb4]
mov dword [esp + 8], eax
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a4]
mov dword [esp], eax
call fcn.6adc0b50
mov dword [esp + 0x2c], eax
jmp 0x6adbed68
mov eax, dword [esp + 0x1a8]
mov ecx, dword [eax + 0x84]
mov edx, dword [eax + 0x80]
lea eax, [esp + 0x64]
mov dword [esp], pe_nt_image_headers32
mov dword [esp + 4], eax
xor eax, eax
call fcn.6adbc310
test eax, eax
js 0x6ae0e8c3
mov esi, dword [esp + 0x64]
lea eax, [esp + 0xf0]
lea ebx, [esp + 0x78]
mov dword [esp + 0x10], 5
mov dword [esp + 0xc], 0x90
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6ae0e7c8
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xa4], eax
xor eax, eax
cmp dword [esp + 0xf8], 8
je 0x6adbf2e0
mov byte [esp + 0xa0], al
lea eax, [esp + 0x80]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ntdll.dll_NtQueryVolumeInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbf2c8
cmp dword [esp + 0x7c], 0xb
mov edx, dword [esp + 0x9c]
jbe 0x6ae0e7f8
mov eax, dword [esp + 0x88]
mov dword [edx + 0x9c], 0
mov dword [edx + 0x98], eax
lea edx, [esp + 0xb8]
mov eax, esi
call fcn.6adbc3f0
test eax, eax
js 0x6ae0e81a
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0xd8]
mov edx, dword [esp + 0xdc]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
cmp byte [esp + 0xa0], 0
jne 0x6adbf020
mov eax, dword [esp + 0x1a8]
xor edx, edx
mov ecx, dword [eax + 0x80]
lea eax, [esp + 0x9c]
mov dword [esp + 4], 0x6ae241c0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1a8]
mov eax, dword [eax + 0x84]
mov dword [esp], eax
mov eax, dword [esp + 0x1a0]
call fcn.6adbdcf0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x6adbefe9
sub dword [eax], 1
jne 0x6adbefe9
mov dword [esp], eax
call fcn.6adc0b10
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x6adbee0c
mov eax, dword [esp + 0xac]
or eax, dword [esp + 0xa8]
jne 0x6ae0e722
mov eax, dword [esp + 0x2c]
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.WIMLIB_DISABLE_QUERY_FILE_LAYOUT
call dword [sym.imp.msvcrt.dll__wgetenv]
mov dword [esp + 0x48], eax
test eax, eax
jne 0x6adbef8f
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov esi, dword [eax + 0x80]
mov eax, dword [eax + 0x84]
lea eax, [esi + eax*2 - 2]
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], eax
movzx eax, word [eax]
mov word [esp + 0x56], ax
cmp ax, 0x5c
jne 0x6adbf07f
mov eax, dword [esp + 0x5c]
xor edx, edx
mov word [eax], dx
mov dword [esp + 0x78], 0
xor edx, edx
xor eax, eax
mov dword [esp + eax + 0xf0], edx
add eax, 4
cmp eax, 0x20
jb 0x6adbf08b
mov dword [esp + 0xf4], 0x3f
mov esi, dword [esp + 0x58]
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], ebx
mov edx, esi
mov dword [esp], 0x81
mov ecx, eax
xor eax, eax
call fcn.6adbc310
test eax, eax
js 0x6adbfb0e
mov dword [esp + 0x50], 0x8000
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.6adab3e0
mov dword [esp + 0x4c], eax
test eax, eax
je 0x6adbf929
mov eax, dword [esp + 0x50]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0x90277
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.6adb7d60
test eax, eax
js 0x6adbf90d
mov eax, dword [esp + 0x4c]
mov ebx, dword [eax + 4]
add ebx, eax
mov dword [esp + 0x30], ebx
lea esi, [esi]
nop
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
mov dword [esp + 0x38], eax
movzx edx, di
xor eax, 5
or edx, eax
mov dword [esp + 0x3c], edi
je 0x6adbf400
mov edx, dword [ebx + 0x18]
test edx, edx
je 0x6adbf3e6
add edx, ebx
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x6adbf358
xor edi, edi
xor ebp, ebp
lea esi, [esi]
mov ebx, ecx
mov eax, ecx
lea esi, [edx + 0x18]
shr ebx, 1
and eax, 1
jne 0x6adbf1b3
test ebx, ebx
jne 0x6adbf1ab
jmp 0x6adbf8f5
add eax, 1
cmp eax, ebx
je 0x6adbf320
cmp word [edx + eax*2 + 0x18], 0
jne 0x6adbf1a0
mov dword [esp + 0x2c], ebx
mov edi, esi
mov esi, dword [edx + 4]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], str.Invalid_FILE_LAYOUT_NAME_ENTRY__FileReferenceNumber0x_016llx__FileNameLength_u__FileName_.ls__Flags0x_08x
mov dword [esp + 8], eax
call fcn.6ae0b475
mov dword [esp + 0x2c], 0x44
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab410
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, 0x44
not eax
setne bl
shr eax, 0x1f
and ebx, eax
cmp word [esp + 0x56], 0x5c
jne 0x6adbf238
mov eax, dword [esp + 0x5c]
mov esi, 0x5c
mov word [eax], si
lea esi, [esi]
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.6ad81850
mov esi, eax
test eax, eax
je 0x6adbf270
lea esi, [esi]
mov edi, dword [esi + 8]
mov dword [esp], esi
and edi, 0xfffffffc
call fcn.6adab410
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.6ad81880
mov esi, eax
test eax, eax
jne 0x6adbf250
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.6ad81850
mov esi, eax
test eax, eax
je 0x6adbf2a8
lea esi, [esi]
mov edi, dword [esi + 8]
mov dword [esp], esi
and edi, 0xfffffffc
call fcn.6adab410
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.6ad81880
mov esi, eax
test eax, eax
jne 0x6adbf288
test bl, bl
jne 0x6adbefd1
mov ecx, dword [esp + 0x2c]
test ecx, ecx
js 0x6adbef8f
jmp 0x6ae0e843
cmp eax, 0x80000005
je 0x6adbef12
jmp 0x6ae0e7f1
xor eax, eax
mov edx, 0x4e
jmp 0x6adbf2f7
movzx edx, word [eax + str.NTFS]
cmp word [esp + eax + 0xfc], dx
jne 0x6adbf313
add eax, 2
cmp eax, 8
jne 0x6adbf2f0
mov eax, 1
jmp 0x6adbeed9
xor eax, eax
jmp 0x6adbeed9
mov ebx, dword [edx + 4]
test bl, 2
je 0x6adbf331
cmp ecx, 0x18
ja 0x6adbf8db
cmp ebx, 2
je 0x6adbf341
add ecx, 0x19
add ebp, 1
and ecx, 0xfffffff8
add edi, ecx
mov eax, dword [edx]
test eax, eax
je 0x6adbf740
add edx, eax
mov ecx, dword [edx + 0x10]
test ecx, ecx
jne 0x6adbf188
lea eax, [edx + 0x18]
mov esi, dword [edx + 4]
mov edi, eax
jmp 0x6adbf1bc
sub ebp, ebx
mov dword [esp + 0x34], ebp
mov esi, dword [esp + 0x34]
cmp dword [esp + 0x40], esi
je 0x6adbf392
mov dword [esp + 8], 0x9bf
mov dword [esp + 4], str.src_win32_capture.c
mov dword [esp], str._u8__p____u8__ni__inode_size
call dword [0x6ae0f298]
mov eax, dword [esp + 0x68]
test eax, eax
je 0x6adbf8fd
mov edi, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov ebp, ecx
cmp edi, esi
sbb ebp, edx
jb 0x6adbf6be
lea esi, [esi]
lea esi, [esi]
cmp esi, edi
sbb edx, ecx
jb 0x6adbf6a0
mov dword [esp + 4], edi
mov dword [esp + 8], ecx
mov dword [esp], str.Inode_0x_016llx_is_a_duplicate_
call fcn.6ae0b4c9
mov dword [esp], ebx
call fcn.6adab410
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 4]
test eax, eax
je 0x6adbf8e8
add ebx, eax
mov dword [esp + 0x30], ebx
jmp 0x6adbf148
mov dword [esp + 0x40], 0x70
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x20]
mov dword [esp + 0x44], esi
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x6adbf426
test byte [eax + 0xd], 0x40
je 0x6adbf6e3
xor esi, esi
mov eax, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.6adab440
mov ebx, eax
test eax, eax
je 0x6adbf929
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov dword [ebx + 0x48], esi
mov dword [esp + 0x34], 0x70
add eax, edi
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov edi, dword [eax + 0x20]
mov ebp, dword [eax + 4]
mov dword [ebx + 0x10], edx
xor edx, 5
mov dword [ebx + 0x38], edi
mov edi, dword [eax]
mov dword [ebx + 0x1c], ebp
mov ebp, dword [eax + 0x14]
mov dword [ebx + 0x18], edi
mov edi, dword [eax + 0x10]
mov dword [ebx + 0x14], ecx
movzx ecx, cx
mov dword [ebx + 0x28], edi
mov edi, dword [eax + 8]
or ecx, edx
mov dword [ebx + 0x2c], ebp
mov ebp, dword [eax + 0xc]
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], ebp
lea ebp, [ebx + 0x70]
mov dword [ebx + 0x3c], eax
je 0x6adbf564
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x18]
add esi, eax
lea eax, [ebx + 0x54]
mov dword [esp + 0x38], eax
jmp 0x6adbf520
mov eax, ebp
sub eax, ebx
cmp edi, 2
je 0x6adbf518
shl edi, 0x1f
and eax, 0x7fffffff
lea ecx, [esi + 0x18]
add dword [ebx + 0x40], 1
mov edx, edi
mov edi, dword [esi + 0x10]
or edx, eax
mov eax, dword [esi + 8]
mov dword [ebp], edx
mov edx, dword [esi + 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, edi
xor edx, edx
shr eax, 1
mov word [ebp + eax*2 + 0x10], dx
lea edx, [edi + 0x19]
and edx, 0xfffffff8
add ebp, edx
mov eax, ebp
sub eax, ebx
mov edx, dword [esi]
test edx, edx
je 0x6adbf560
add esi, edx
mov edi, dword [esi + 4]
test edi, 2
je 0x6adbf4c0
lea eax, [esi + 0x18]
mov ecx, dword [esi + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 0x34], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x34]
xor eax, eax
shr ecx, 1
mov word [ebx + ecx*2 + 0x54], ax
jmp 0x6adbf4c0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x6adbf36b
test byte [eax + 0xd], 0x40
jne 0x6adbf36b
add esi, dword [esp + 0x30]
jmp 0x6adbf640
mov dword [esp + 0x80], 0x6ae241c0
mov dword [esp + 0xb8], 0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
mov edi, eax
mov dword [esp + 0x38], eax
and edi, 0x10
jne 0x6adbf633
mov eax, dword [esp + 0x80]
add dword [ebx + 0x44], 1
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x6adbf5f0
add eax, esi
test byte [eax], 1
je 0x6adbf5f0
cmp dword [eax + 8], 0
je 0x6adbf5f0
mov edx, dword [eax + 0x24]
mov eax, dword [eax + 0x20]
mov ecx, edx
mov edx, eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], ecx
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [edi + edi]
mov dword [esp + 0x3c], ecx
mov dword [ebp], eax
lea eax, [ebp + 8]
mov dword [ebp + 4], edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x3c]
xor eax, eax
mov word [ebp + edi*2 + 8], ax
add ecx, 0x11
and ecx, 0xfffffff8
add ebp, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x6adbf365
add esi, eax
mov edx, dword [esi + 0x2c]
test edx, edx
je 0x6adbf590
shr edx, 1
je 0x6adbf633
cmp word [esi + 0x30], 0x3a
jne 0x6adbf633
lea edi, [esp + 0xb8]
lea eax, [esi + 0x30]
mov dword [esp], edi
lea ecx, [esp + 0x80]
call fcn.6adbcb30
test al, al
je 0x6adbf633
mov edi, dword [esp + 0xb8]
test edi, edi
je 0x6adbf5a6
mov eax, dword [esp + 0x80]
add dword [ebx + 0x44], 1
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x4c], eax
jmp 0x6adbf5f6
mov edx, dword [eax + 4]
lea esi, [eax + 4]
test edx, edx
je 0x6adbf6c6
mov eax, edx
mov ebp, ecx
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
cmp edi, esi
sbb ebp, edx
jae 0x6adbf3c0
mov esi, eax
mov edx, dword [esi]
test edx, edx
jne 0x6adbf6aa
or eax, 1
lea edx, [esp + 0x68]
mov dword [esi], ebx
mov dword [ebx + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.6ad818b0
jmp 0x6adbf3e6
mov eax, dword [esp + 0x30]
lea ebp, [eax + esi]
mov ecx, dword [ebp + 0x2c]
mov esi, ecx
and esi, 1
je 0x6adbf754
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], str.Invalid_STREAM_LAYOUT_ENTRY__FileReferenceNumber0x_016llx__StreamIdentifierLength_u__StreamIdentifier_.ls
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
call fcn.6ae0b4c9
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf1f4
test ebp, ebp
je 0x6ae0e854
lea eax, [edi + 0x70]
mov dword [esp + 0x40], eax
jmp 0x6adbf408
xor ebx, ebx
lea esi, [esi]
lea esi, [esi]
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
je 0x6adbf805
mov edx, eax
mov eax, edi
jmp 0x6adbf788
add eax, 2
sub edx, 1
je 0x6adbf7a8
cmp word [eax], 0
jne 0x6adbf780
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
jmp 0x6adbf6ff
cmp word [ebp + 0x30], 0x3a
jne 0x6adbf824
lea eax, [esp + 0xb8]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x80]
mov dword [esp], eax
mov eax, edi
call fcn.6adbcb30
test al, al
je 0x6adbf824
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x6adbf814
lea eax, [eax + eax + 0x11]
and eax, 0xfffffff8
add ebx, eax
mov eax, dword [ebp + 4]
test eax, eax
je 0x6adbf868
add ebp, eax
mov ecx, dword [ebp + 0x2c]
test cl, 1
je 0x6adbf760
mov eax, ecx
lea edi, [ebp + 0x30]
shr eax, 1
mov dword [esp + 0x34], eax
jmp 0x6adbf78e
test ecx, ecx
jne 0x6adbf824
mov dword [esp + 0xb8], 0
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], eax
and eax, 0x10
je 0x6adbf7da
mov eax, dword [ebp + 0x2c]
cmp eax, 0x18
je 0x6adbf878
cmp eax, 0xa
je 0x6adbf8a8
cmp eax, 0x22
jne 0x6adbf7e3
mov dword [esp + 8], 0x22
mov dword [esp + 4], str.::_EA_INFORMATION
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
mov edx, eax
mov eax, esi
or eax, 4
test edx, edx
cmove esi, eax
mov eax, dword [ebp + 4]
test eax, eax
jne 0x6adbf7ea
lea esi, [esi]
add dword [esp + 0x40], ebx
jmp 0x6adbf426
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.::_OBJECT_ID
mov dword [esp], edi
call sub.msvcrt.dll_memcmp
mov edx, eax
mov eax, esi
or eax, 1
test edx, edx
cmove esi, eax
jmp 0x6adbf7e3
mov eax, dword [str.::_EA]
cmp dword [edi], eax
jne 0x6adbf7e3
mov eax, dword [0x6ae24194]
cmp dword [edi + 4], eax
jne 0x6adbf7e3
mov eax, esi
movzx ecx, word [0x6ae24198]
or eax, 2
cmp word [edi + 8], cx
cmove esi, eax
jmp 0x6adbf7e3
mov edi, esi
mov dword [esp + 0x2c], eax
mov esi, ebx
jmp 0x6adbf1bc
and dword [esp + 0xf4], 0xfffffffe
jmp 0x6adbf0ef
mov ebx, dword [edx + 4]
jmp 0x6adbf331
lea edx, [esp + 0x68]
mov eax, 1
mov esi, edx
jmp 0x6adbf6cd
cmp eax, 0xc0000023
jne 0x6adbf936
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab410
shl dword [esp + 0x50], 1
jmp 0x6adbf0d7
mov dword [esp + 0x2c], 0x27
jmp 0x6adbf1f4
cmp eax, 0xc0000011
jne 0x6adbfae2
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.6adab410
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
push eax
cmp word [esp + 0x56], 0x5c
jne 0x6adbf96b
mov eax, dword [esp + 0x5c]
mov word [eax], 0x5c
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 0x30], eax
call fcn.6ad81770
mov dword [esp + 0x34], eax
test eax, eax
je 0x6ae0e780
lea esi, [esi]
nop
mov eax, dword [esp + 0x34]
mov ebx, dword [eax + 0x10]
movzx edx, word [eax + 0x14]
mov eax, ebx
mov dword [esp + 0x2c], ebx
xor eax, 5
or edx, eax
je 0x6adbfa65
mov eax, dword [esp + 0x34]
mov edi, dword [eax + 0x40]
lea esi, [eax + 0x70]
jmp 0x6adbf9f4
cmp ecx, ebp
sbb edx, ebx
jb 0x6adbfa60
mov edx, dword [eax + 0x50]
mov edi, dword [esp + 0x2c]
mov dword [esi + 8], edx
mov dword [eax + 0x50], esi
sub edi, 1
je 0x6adbfa70
lea eax, [esi + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + eax + 0x19]
and eax, 0xfffffff8
add esi, eax
mov eax, dword [esp + 0x30]
mov ebp, dword [esi + 8]
mov ebx, dword [esi + 0xc]
test eax, eax
je 0x6adbfa24
mov dword [esp + 0x2c], edi
lea esi, [esi]
lea esi, [esi]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov edi, ebx
cmp ebp, ecx
sbb edi, edx
jae 0x6adbf9c0
mov eax, dword [eax]
test eax, eax
jne 0x6adbfa10
mov eax, dword [esp + 0x34]
add esi, 0x10
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 4], ebp
mov dword [esp], str.Parent_inode_0x_016llx_ofdirectory_entry___ls___inode_0x_016llx__was_missing_from_the_MFT_listing_
call fcn.6ae0b475
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf238
mov eax, dword [eax + 4]
jmp 0x6adbfa20
mov eax, dword [esp + 0x34]
mov dword [esp + 0x48], eax
lea esi, [esi]
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.6ad817b0
mov dword [esp + 0x34], eax
test eax, eax
jne 0x6adbf990
mov ebx, dword [esp + 0x48]
test ebx, ebx
je 0x6ae0e780
lea eax, [esp + 0x6c]
mov dword [ebx + 0x40], 1
xor ecx, ecx
mov edx, 0x6ae241c0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x68]
mov dword [esp + 8], eax
lea eax, [esp + 0x9c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1a0]
mov dword [esp], ebx
call fcn.6adbe460
cmp eax, 0x44
mov dword [esp + 0x2c], eax
not eax
setne bl
shr eax, 0x1f
and ebx, eax
jmp 0x6adbf238
cmp eax, 0xc0000010
sete cl
cmp eax, 0xc00000bb
sete dl
or cl, dl
jne 0x6adbfb01
cmp eax, 0xc000000d
jne 0x6ae0e7a3
mov dword [esp + 0x2c], 0xffffffff
jmp 0x6adbf1f4
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2c], 0xffffffff
jmp 0x6adbf1f4
mov eax, dword [esp + 0x1a4]
mov dword [esp], str.Scan_of___ls__complete__but_with_one_or_more_warnings:
mov dword [esp + 4], eax
call fcn.6ae0b4c9
mov eax, dword [esp + 0xac]
test eax, eax
je 0x6ae0e754
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_SACL__System_Access_Control_List__n____________on__lu_files_or_directories.
call fcn.6ae0b4c9
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x6ae0e76f
mov dword [esp + 4], eax
mov dword [esp], str.__Could_not_capture_security_descriptor_at_all_n____________on__lu_files_or_directories.
call fcn.6ae0b4c9
mov dword [esp], str.To_fully_capture_all_security_descriptors__run_the_program_n__________with_Administrator_rights.
call fcn.6ae0b4c9
jmp 0x6adbee0c
mov eax, dword [esp + 0x58]
mov dword [esp], str.The_MFT_listing_for_volume___ls__did_not_include_a_root_directory_
xor ebx, ebx
mov dword [esp + 4], eax
call fcn.6ae0b475
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf238
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], str.Error_enumerating_files_on_volume___ls_
mov dword [esp], eax
mov dword [esp + 8], ebx
call fcn.6ae0df7d
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf1f4
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_attributes
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae0df56
jmp 0x6adbeee0
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_volume_ID
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae0df56
jmp 0x6adbef3b
mov edx, dword [esp + 0x9c]
mov edx, dword [edx + 0x80]
mov dword [esp + 4], str.__ls_:_Cant_get_file_information
mov dword [esp], eax
add edx, 8
mov dword [esp + 8], edx
call fcn.6ae0df56
jmp 0x6adbef72
mov dword [esp], str.A_problem_occurred_during_the_fast_MFT_scan._n__________Falling_back_to_the_standard_recursive_directory_tree_scan.
call fcn.6ae0b4c9
jmp 0x6adbef8f
mov eax, dword [esp + 0x38]
mov dword [esp], str.Inode_0x_016llx_has_no_long_names_
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
call fcn.6ae0b475
mov dword [esp + 0x2c], 0x44
jmp 0x6adbf1f4
mov eax, dword [esp + 0x1a4]
mov dword [esp], str.__ls_:_unrecognized_path_format
mov dword [esp + 4], eax
call fcn.6ae0b475
mov ebx, dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov dword [esp + 0x2c], 0x18
jmp 0x6adbedf8
mov ebx, dword [esp + 0x1a4]
mov dword [esp], eax
mov dword [esp + 4], str.Cant_open___ls_
mov dword [esp + 8], ebx
mov dword [esp + 0x2c], eax
call fcn.6ae0df7d
mov eax, dword [esp + 0x2c]
mov edx, 0x52
cmp eax, 0xc0210000
mov eax, 0x2f
cmove eax, edx
mov dword [esp + 0x2c], eax
jmp 0x6adbedf8