Function at 0x41ced0
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43df58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
mov eax, dword [0x45447c]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x190], ebx
sub esp, 0x1c
mov edi, esp
mov dword [ebp - 0x164], esp
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0x449340
mov dword [ebp - 4], ebx
mov word [edi + 4], bx
call fcn.0042fe2d
add esp, 4
push eax
push 0x449340
mov ecx, edi
call fcn.00402190
push 0x54
sub esp, 0x1c
mov edi, esp
mov dword [ebp - 0x16c], esp
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push str.._shadow.cpp
mov byte [ebp - 4], 1
mov word [edi + 4], bx
call fcn.0042fe2d
add esp, 4
push eax
push str.._shadow.cpp
mov ecx, edi
call fcn.00402190
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.0041fd60
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x178], ebx
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x180], ebx
mov eax, 7
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], ebx
mov word [ebp - 0x13c], bx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], ebx
mov word [ebp - 0x120], bx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], bx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x3c], bx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 8
mov dword [ebp - 0x16c], ebx
nop
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x41d981
mov ecx, dword [ebp + 0x10]
mov edx, eax
sub ecx, edx
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0x16c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jae 0x41d981
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push 0x44933c
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x44933c
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 9
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov eax, esp
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], 7
mov dword [ebp - 0x160], esp
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
je 0x41d10a
push str._Option:_Persistent_shadow_copy_
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push str._Option:_Persistent_shadow_copy_
call fcn.00402190
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
mov ecx, dword [ebp - 0x16c]
add esp, 0x20
inc ecx
mov byte [esi + 0x60], 1
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
push 0x4492ec
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x4492ec
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 0xa
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a820
cmp al, bl
je 0x41d1c1
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push str._Option:_No_writers_option_detected_
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push str._Option:_No_writers_option_detected_
call fcn.00402190
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
mov ecx, dword [ebp - 0x16c]
add esp, 0x20
inc ecx
mov byte [esi + 0x61], bl
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
lea edx, [ebp - 0x40]
push edx
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push 0x449298
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x449298
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 0xb
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041acb0
cmp al, bl
je 0x41d2b4
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x41d243
lea eax, [ebp - 0x3c]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push str._Option:_Transportable_shadow_set._Saving_xml_to_file__s_
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push str._Option:_Transportable_shadow_set._Saving_xml_to_file__s_
call fcn.00402190
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x16c]
or eax, 0x20
add esp, 0x24
inc ecx
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
lea ecx, [ebp - 0x40]
push ecx
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push 0x449214
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x449214
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 0xc
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041acb0
cmp al, bl
je 0x41d398
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x41d336
lea eax, [ebp - 0x3c]
push eax
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push str._Option:_Saving_xml_to_file__s_
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push str._Option:_Saving_xml_to_file__s_
call fcn.00402190
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
mov ecx, dword [ebp - 0x16c]
add esp, 0x24
inc ecx
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x160], esp
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], ebx
push 0x4491c4
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x4491c4
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 0xd
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov eax, esp
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], 7
mov dword [ebp - 0x160], esp
mov dword [ebp - 0x164], eax
mov word [eax + 4], bx
je 0x41d47c
push str._Option:_Creating_differential_HW_shadow_copies_
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push str._Option:_Creating_differential_HW_shadow_copies_
call fcn.00402190
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x16c]
or eax, 0x20000
add esp, 0x20
inc ecx
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
push 0x449154
call fcn.0042fe2d
mov ecx, dword [ebp - 0x164]
add esp, 4
push eax
push 0x449154
call fcn.00402190
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push edi
mov byte [ebp - 4], 0xe
mov word [ecx + 4], bx
call fcn.00401de0
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41d519
push str._Option:_Creating_plex_HW_shadow_copies_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x16c]
or eax, 0x40000
add esp, 0x20
inc ecx
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
push str.scsf
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0xf
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0041a820
cmp al, bl
je 0x41d58a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Creating_Shadow_Copies_for_Shared_Folders___Client_Accessible_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
mov ecx, dword [ebp - 0x16c]
add esp, 0x20
inc ecx
mov dword [ebp - 0x168], 0x1d
mov dword [ebp - 0x16c], ecx
add edi, 0x1c
jmp 0x41d000
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], bx
lea eax, [ebp - 0xb0]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x449054
mov byte [ebp - 4], 0x10
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x11
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.0041acb0
cmp al, bl
je 0x41d62c
lea ecx, [ebp - 0xb0]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Excluding_writer_component__s_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x24
lea edx, [ebp - 0xb0]
push edx
lea ecx, [ebp - 0x17c]
call fcn.00404a10
jmp 0x41d909
mov dword [ebp - 0xf0], 7
mov dword [ebp - 0xf4], ebx
mov word [ebp - 0x104], bx
lea eax, [ebp - 0x108]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448ff8
mov byte [ebp - 4], 0x12
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x13
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041acb0
cmp al, bl
je 0x41d6ce
lea ecx, [ebp - 0x108]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Verifying_inclusion_of_writer_component__s_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x24
lea edx, [ebp - 0x108]
push edx
lea ecx, [ebp - 0x18c]
call fcn.00404a10
jmp 0x41d8fe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.wait
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x14
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041a820
cmp al, bl
je 0x41d734
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Wait_on_finish_
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 0x20
mov byte [esi + 0x62], 1
jmp 0x41d8fe
lea ecx, [ebp - 0x124]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.script
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x15
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041acb0
cmp al, bl
je 0x41d7a9
lea ecx, [ebp - 0x124]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Generate_SETVAR_script__s_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 0x24
jmp 0x41d8fe
lea eax, [ebp - 0x5c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.exec
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x16
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041acb0
cmp al, bl
je 0x41d89c
lea ecx, [ebp - 0x5c]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Execute_binary_script_after_shadow_creation__s_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x24
lea ecx, [ebp - 0x5c]
call fcn.00401110
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d833
test al, 0x10
je 0x41d8fe
lea ecx, [ebp - 0x5c]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.ERROR:_the_parameter__s_must_be_an_existing_file_
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 8
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.__Note:_the__exec_command_cannot_have_parameters_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea edx, [ebp - 0x19c]
push edx
mov dword [ebp - 0x19c], 0x80070057
call fcn.004302ea
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.tracing
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x17
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41d926
push 0x448d4c
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 0x20
call fcn.0041f6d0
lea ecx, [ebp - 0x108]
call fcn.004012a0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 8
call fcn.004012a0
inc dword [ebp - 0x16c]
add edi, 0x1c
jmp 0x41d000
push 0x448d48
call fcn.004026d0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp + 0xc]
imul eax, eax, 0x1c
sub esp, 0x1c
lea edi, [eax + ecx]
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041a820
cmp al, bl
je 0x41daa7
lea ecx, [ebp - 0x108]
call fcn.004012a0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 8
call fcn.004012a0
mov ecx, esi
call fcn.0041b2c0
mov eax, dword [ebp - 0x28]
mov edi, 8
cmp eax, edi
jb 0x41d9a0
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0042fe43
add esp, 4
cmp dword [ebp - 0x44], edi
mov esi, 7
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x3c], bx
jb 0x41d9c0
mov eax, dword [ebp - 0x58]
push eax
call fcn.0042fe43
add esp, 4
cmp dword [ebp - 0x10c], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], bx
jb 0x41d9e1
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.0042fe43
add esp, 4
cmp dword [ebp - 0x128], edi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], ebx
mov word [ebp - 0x120], bx
jb 0x41da0b
mov edx, dword [ebp - 0x13c]
push edx
call fcn.0042fe43
add esp, 4
mov dword [ebp - 0x128], esi
mov esi, dword [ebp - 0x188]
cmp esi, ebx
mov dword [ebp - 0x12c], ebx
mov word [ebp - 0x13c], bx
je 0x41da49
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x184]
push eax
lea ecx, [ebp - 0x18c]
push ecx
push edx
push esi
call fcn.00402650
push esi
call fcn.0042fe43
add esp, 0x14
mov esi, dword [ebp - 0x178]
cmp esi, ebx
je 0x41da74
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x174]
push eax
lea ecx, [ebp - 0x17c]
push ecx
push edx
push esi
call fcn.00402650
push esi
call fcn.0042fe43
add esp, 0x14
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.0041fed0
lea ecx, [ebp + 8]
call fcn.00403340
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0043053d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448d44
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x19
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0041a820
cmp al, bl
je 0x41db57
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Query_all_shadow_copies_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 0x20
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov ecx, dword [0x44c8f0]
mov edx, dword [0x44c8f4]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x44c8f8]
mov dword [eax + 4], edx
mov edx, dword [0x44c8fc]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.004144c0
jmp 0x41f0ee
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x80], ebx
mov word [ebp - 0x90], bx
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448cf8
mov byte [ebp - 4], 0x1a
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x1b
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41dc48
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Query_shadow_copy_set_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.004144c0
jmp 0x41f0e3
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448cb0
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x1c
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41dd24
push str._Option:_Query_shadow_copy_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.00414b70
jmp 0x41f0e3
push 0x448c70
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x1d
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041a820
cmp al, bl
je 0x41de11
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Delete_all_shadow_copies_
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
mov dword [ebp - 0x60], 0xf
mov dword [ebp - 0x64], ebx
mov byte [ebp - 0x74], bl
push str.This_will_delete_all_shadow_copies_in_the_system._Are_you_sure___Y_N_
push 0x455380
mov byte [ebp - 4], 0x1e
call fcn.0041a3b0
lea ecx, [ebp - 0x78]
push ecx
push 0x4552e0
call fcn.0041a630
mov eax, dword [ebp - 0x64]
add esp, 0x30
cmp eax, 1
jne 0x41de04
push ebx
lea ecx, [ebp - 0x78]
call fcn.0041a080
cmp byte [eax], 0x59
je 0x41ddcc
push ebx
lea ecx, [ebp - 0x78]
call fcn.0041a080
cmp byte [eax], 0x79
jne 0x41de04
push 0x448bd8
push 0x455380
call fcn.0041a3b0
add esp, 8
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0040fb80
lea ecx, [ebp - 0x78]
call fcn.004016e0
jmp 0x41f0e3
lea edx, [ebp - 0x94]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448bd0
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x1f
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41deed
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Delete_a_shadow_copy_set_
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.00410500
jmp 0x41f0e3
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448b80
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x20
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41dfc9
push str._Option:_Delete_a_shadow_copy_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.004109c0
jmp 0x41f0e3
push 0x448b38
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x21
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41e05d
push str._Option:_List_writer_metadata_
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
mov ecx, dword [ebp - 0x168]
add esp, 0x20
push ecx
mov ecx, esi
call fcn.00419db0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov edi, eax
call fcn.004026d0
push edi
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0042da00
push ebx
mov ecx, esi
call fcn.00428fe0
jmp 0x41f0e3
push 0x448af0
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x22
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041a820
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41e0f2
push str._Option:_List_extended_writer_metadata_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
mov eax, dword [ebp - 0x168]
add esp, 0x20
push eax
mov ecx, esi
call fcn.00419db0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov edi, eax
call fcn.004026d0
push edi
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0042da00
push 1
mov ecx, esi
call fcn.00428fe0
jmp 0x41f0e3
push 0x448a94
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x23
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041a820
cmp al, bl
je 0x41e18c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_List_writer_status_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
mov edx, dword [ebp - 0x168]
add esp, 0x20
push edx
mov ecx, esi
call fcn.00419db0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov edi, eax
call fcn.004026d0
push edi
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0042da00
mov ecx, esi
call fcn.004220a0
mov ecx, esi
call fcn.004240e0
jmp 0x41f0e3
lea eax, [ebp - 0x140]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448a50
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x24
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41e22e
lea ecx, [ebp - 0x140]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Delete_the_oldest_shadow_copy_for__s_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x24
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
lea edx, [ebp - 0x140]
push edx
mov ecx, esi
call fcn.00411b50
jmp 0x41f0e3
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.revert
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x25
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41e30a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4489ac
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.00414ed0
jmp 0x41f0e3
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4489a8
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x26
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41e3e8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Break_shadow_copy_set_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
push ebx
push ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.00406ce0
jmp 0x41f0e3
lea eax, [ebp - 0x94]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448960
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x27
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.0041acb0
cmp al, bl
je 0x41e5d1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Break_shadow_copy_set_as_writable_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 4
lea edx, [ebp - 0x94]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
cmp byte [esi + 0x62], bl
jne 0x41e4b1
cmp dword [ebp - 0x48], ebx
ja 0x41e4b1
push ebx
push 1
jmp 0x41e3c3
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x1c]
push 1
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
mov byte [ebp - 4], 0x28
call fcn.00406ce0
cmp dword [ebp - 0x48], ebx
jbe 0x41e505
sub esp, 0x1c
lea eax, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
call fcn.0041b540
add esp, 0x1c
cmp byte [esi + 0x62], bl
je 0x41e553
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nPress__ENTER__to_make_the_volumes_writable...
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
mov eax, dword [0x4544e4]
add esp, 0x20
dec eax
mov dword [0x4544e4], eax
js 0x41e543
inc dword [0x4544e0]
jmp 0x41e550
push 0x4544e0
call fcn.004310c6
add esp, 4
mov byte [esi + 0x62], bl
movzx edx, byte [ebp - 0x15]
movzx eax, byte [ebp - 0x16]
push edx
push eax
mov eax, dword [ebp - 0x18]
movzx ecx, ah
push ecx
movzx ecx, byte [ebp - 0x1a]
movzx edx, al
movzx eax, byte [ebp - 0x19]
push edx
push eax
mov eax, dword [ebp - 0x1c]
push ecx
movzx ecx, word [ebp - 0x1e]
movzx edx, ah
push edx
movzx edx, word [ebp - 0x20]
movzx eax, al
push eax
push ecx
push edx
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.__Making_shadow_copy_devices_from__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x_read_write...
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 0x3c
lea edx, [ebp - 0x6c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00403380
mov ecx, esi
call fcn.00405170
lea ecx, [ebp - 0x6c]
call fcn.00403340
jmp 0x41f0e3
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], ebx
mov word [ebp - 0x158], bx
lea eax, [ebp - 0x15c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4488a0
mov byte [ebp - 4], 0x29
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x2a
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0041acb0
cmp al, bl
je 0x41e749
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Expose_a_shadow_copy_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x20
push 0x2c
sub esp, 0x1c
lea edx, [ebp - 0x15c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
lea eax, [ebp - 0x24]
push eax
call fcn.0041cb40
add esp, 0x24
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2b
call fcn.00401030
sub esp, 0x1c
cmp eax, 2
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41e6c9
push str.ERROR:_the__el_arguments_must_contain_a_GUID_and_a_local_path_separated_by_a_comma.
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea edx, [ebp - 0x1a0]
push edx
mov dword [ebp - 0x1a0], 0x80070057
call fcn.004302ea
mov eax, dword [ebp - 0x20]
push eax
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x68], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov eax, dword [ebp - 0x20]
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x60]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
call fcn.00412d10
jmp 0x41f0d0
lea eax, [ebp - 0x15c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4487b0
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x2c
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0041acb0
cmp al, bl
je 0x41e92c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Expose_a_shadow_copy_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x20
push 0x2c
sub esp, 0x1c
lea edx, [ebp - 0x15c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
lea eax, [ebp - 0x24]
push eax
call fcn.0041cb40
add esp, 0x24
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x2d
call fcn.00401030
cmp eax, 2
je 0x41e833
lea ecx, [ebp - 0x24]
call fcn.00401030
cmp eax, 3
je 0x41e833
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.ERROR:_the__er_arguments_must_contain_a_GUID__a_share_name_and_an_optional_local_path_separated_by_a_comma.
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea edx, [ebp - 0x198]
push edx
mov dword [ebp - 0x198], 0x80070057
call fcn.004302ea
mov eax, dword [ebp - 0x20]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
call fcn.0040c290
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov eax, dword [eax + 0xc]
add esp, 0x1c
push ebx
sub esp, 0x1c
mov dword [ebp - 0x68], ecx
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], eax
call fcn.004026d0
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
lea ecx, [ebp - 0x24]
call fcn.00401030
cmp eax, 3
jne 0x41e897
mov eax, dword [ebp - 0x20]
add eax, 0x38
jmp 0x41e8b5
push 0x4417ac
lea ecx, [ebp - 0x1bc]
call fcn.004026d0
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x190], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
mov eax, dword [ebp - 0x20]
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push eax
mov dword [ebp - 4], 0x2f
call fcn.00402440
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x60]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, esi
mov byte [ebp - 4], 0x2e
call fcn.00412790
test byte [ebp - 0x190], 1
mov dword [ebp - 4], 0x2d
je 0x41f0d0
lea ecx, [ebp - 0x1bc]
call fcn.004012a0
jmp 0x41f0d0
lea eax, [ebp - 0x40]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4486d0
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x30
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0041acb0
cmp al, bl
je 0x41ea76
lea ecx, [ebp - 0x40]
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Import_shadow_copy_set_from_file__s_
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 8
lea edx, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
lea eax, [ebp - 0x78]
push eax
call fcn.0041c460
add esp, 0x20
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x31
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448648
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0x449340
mov byte [ebp - 4], 0x32
call fcn.004026d0
push 0x220
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x194], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x33
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
mov byte [ebp - 4], 0x31
call fcn.0041fad0
add esp, 0x60
push ebx
sub esp, 0x1c
lea edx, [ebp - 0x78]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0040b000
cmp dword [ebp - 0x48], ebx
jbe 0x41ea69
sub esp, 0x1c
lea eax, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
call fcn.0041b540
add esp, 0x1c
lea ecx, [ebp - 0x78]
call fcn.004012a0
jmp 0x41f0d8
lea ecx, [ebp - 0x40]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448644
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x34
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0041acb0
cmp al, bl
je 0x41ec7c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Perform_a_restore_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 4
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
lea ecx, [ebp - 0x78]
push ecx
call fcn.0041c460
add esp, 0x20
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x35
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448648
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0x449340
mov byte [ebp - 4], 0x36
call fcn.004026d0
push 0x237
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x190], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x37
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
mov byte [ebp - 4], 0x35
call fcn.0041fad0
add esp, 0x60
push 1
sub esp, 0x1c
lea eax, [ebp - 0x78]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0042da00
mov ecx, esi
call fcn.004220a0
mov ecx, esi
call fcn.004240e0
mov ecx, esi
call fcn.0042cf90
sub esp, 0x10
lea edx, [ebp - 0x18c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00403380
sub esp, 0x10
lea eax, [ebp - 0x17c]
mov ecx, esp
mov dword [ebp - 0x164], esp
push eax
mov byte [ebp - 4], 0x38
call fcn.00403380
mov byte [ebp - 4], 0x35
mov ecx, esi
call fcn.00419b30
mov ecx, esi
call fcn.004223c0
mov ecx, esi
mov byte [ebp - 4], 0x39
call fcn.00419090
cmp dword [ebp - 0x48], ebx
jbe 0x41ec0f
sub esp, 0x1c
lea edx, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0041b540
add esp, 0x1c
push 1
mov ecx, esi
mov dword [ebp - 4], 0x35
call fcn.004175c0
mov ecx, esi
call fcn.00422730
mov ecx, esi
call fcn.00419090
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nRestore_done.
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 0x20
lea ecx, [ebp - 0x78]
call fcn.004012a0
jmp 0x41f0d8
lea ecx, [ebp - 0x40]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4485e4
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push edi
mov byte [ebp - 4], 0x3b
call fcn.00402440
mov ecx, esi
mov byte [ebp - 4], 0x29
call fcn.0041acb0
sub esp, 0x1c
cmp al, bl
mov dword [ebp - 0x160], esp
mov ecx, esp
je 0x41ee03
push str._Option:_Perform_a_Simulated_restore_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 4
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
lea ecx, [ebp - 0x78]
push ecx
call fcn.0041c460
add esp, 0x20
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x3c
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x448648
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0x449340
mov byte [ebp - 4], 0x3d
call fcn.004026d0
push 0x279
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x194], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x3e
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
mov byte [ebp - 4], 0x3c
call fcn.0041fad0
add esp, 0x60
push 1
sub esp, 0x1c
lea eax, [ebp - 0x78]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
push 0xffffffffffffffff
mov ecx, esi
call fcn.004203b0
mov ecx, esi
call fcn.0042da00
mov ecx, esi
call fcn.004220a0
mov ecx, esi
call fcn.004240e0
mov ecx, esi
call fcn.0042cf90
sub esp, 0x10
lea edx, [ebp - 0x18c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00403380
sub esp, 0x10
lea eax, [ebp - 0x17c]
mov ecx, esp
mov dword [ebp - 0x164], esp
push eax
mov byte [ebp - 4], 0x3f
call fcn.00403380
mov ecx, esi
mov byte [ebp - 4], 0x3c
call fcn.00419b30
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nRestore_simulation_done.
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
jmp 0x41ec49
push edi
call fcn.00402440
call fcn.0041c020
add esp, 0x1c
cmp al, bl
je 0x41f1f3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._Option:_Create_shadow_copy_set_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 0x20
mov ecx, edi
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nAttempting_to_create_a_shadow_copy_set...__volume__s_was_added_as_parameter_
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x164], esp
push 0x449340
mov byte [ebp - 4], 0x40
call fcn.004026d0
push 0x298
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x190], esp
push str.._shadow.cpp
mov byte [ebp - 4], 0x41
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 0x29
call fcn.0041fad0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
add esp, 0x44
mov ecx, esp
mov dword [ebp - 0x160], esp
push edi
mov byte [ebp - 4], 0x42
call fcn.00402440
lea ecx, [ebp - 0x1bc]
push ecx
call fcn.00410e80
add esp, 0x20
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x43
call fcn.00404a10
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x42
call fcn.004012a0
mov edi, dword [ebp - 0x16c]
lea ecx, [ebp + 8]
inc edi
call fcn.00401030
cmp edi, eax
jae 0x41efa3
mov ecx, dword [ebp + 0xc]
mov eax, edi
imul eax, eax, 0x1c
add eax, ecx
mov dword [ebp - 0x16c], eax
jmp 0x41ef20
mov eax, dword [ebp - 0x16c]
lea esp, [esp]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
call fcn.0041c020
add esp, 0x1c
cmp al, bl
je 0x41f145
mov edx, dword [ebp - 0x16c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
lea eax, [ebp - 0x1bc]
push eax
call fcn.00410e80
add esp, 0x20
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x44
call fcn.00404a10
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x42
call fcn.004012a0
mov edx, dword [ebp - 0x16c]
add edx, 0x1c
lea ecx, [ebp + 8]
inc edi
mov dword [ebp - 0x16c], edx
call fcn.00401030
cmp edi, eax
jb 0x41ef13
mov ecx, dword [ebp - 0x168]
push ecx
mov ecx, esi
call fcn.00419db0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push 0x4417ac
mov dword [ebp - 0x168], eax
call fcn.004026d0
mov edx, dword [ebp - 0x168]
push edx
mov ecx, esi
call fcn.004203b0
sub esp, 0x10
lea eax, [ebp - 0x18c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00403380
sub esp, 0x10
lea edx, [ebp - 0x17c]
mov ecx, esp
mov dword [ebp - 0x164], esp
push edx
mov byte [ebp - 4], 0x45
call fcn.00403380
sub esp, 0x1c
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x190], esp
push eax
mov byte [ebp - 4], 0x46
call fcn.00402440
sub esp, 0x10
lea edx, [ebp - 0x24]
mov ecx, esp
mov dword [ebp - 0x16c], esp
push edx
mov byte [ebp - 4], 0x47
call fcn.00403380
mov ecx, esi
mov byte [ebp - 4], 0x42
call fcn.0040f610
cmp dword [ebp - 0x110], ebx
mov byte [ebp - 4], 0x48
jbe 0x41f072
sub esp, 0x1c
lea eax, [ebp - 0x124]
mov ecx, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.00402440
mov ecx, esi
call fcn.0040edc0
cmp dword [ebp - 0x48], ebx
jbe 0x41f093
sub esp, 0x1c
lea edx, [ebp - 0x5c]
mov ecx, esp
mov dword [ebp - 0x160], esp
push edx
call fcn.00402440
call fcn.0041b540
add esp, 0x1c
test byte [ebp - 0x168], 0x10
mov dword [ebp - 4], 0x42
jne 0x41f0ac
push 1
mov ecx, esi
call fcn.0040d9e0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nSnapshot_creation_done.
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 0x20
lea ecx, [ebp - 0x24]
call fcn.00403340
lea ecx, [ebp - 0x15c]
call fcn.004012a0
lea ecx, [ebp - 0x94]
call fcn.004012a0
lea ecx, [ebp - 0x108]
call fcn.004012a0
lea ecx, [ebp - 0xb0]
call fcn.004012a0
lea ecx, [ebp - 0x40]
call fcn.004012a0
lea ecx, [ebp - 0x5c]
call fcn.004012a0
lea ecx, [ebp - 0x124]
call fcn.004012a0
lea ecx, [ebp - 0x140]
call fcn.004012a0
lea ecx, [ebp - 0x18c]
call fcn.00403340
lea ecx, [ebp - 0x17c]
call fcn.00403340
jmp 0x41da74
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nERROR:_invalid_parameters__s
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
imul edi, edi, 0x1c
add edi, dword [ebp + 0xc]
add esp, 0x24
mov ecx, edi
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.__Parameter__s_is_expected_to_be_a_volume____shadow_copy_creation_is_assumed_
call fcn.004026d0
lea edx, [ebp - 0xec]
push edx
call fcn.00420010
add esp, 8
mov ecx, esp
mov dword [ebp - 0x160], esp
push str.__Example:_VSHADOW_C:
call fcn.004026d0
lea eax, [ebp - 0xec]
push eax
call fcn.00420010
add esp, 0x20
mov ecx, esi
call fcn.0041b2c0
lea ecx, [ebp - 0x24]
call fcn.00403340
jmp 0x41f226
mov ecx, edi
call fcn.00401110
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x160], esp
push str._nERROR:_invalid_parameter__s_n
call fcn.004026d0
lea ecx, [ebp - 0xec]
push ecx
call fcn.00420010
add esp, 0x24
mov ecx, esi
call fcn.0041b2c0
lea ecx, [ebp - 0x15c]
call fcn.004012a0
lea ecx, [ebp - 0x94]
call fcn.004012a0
lea ecx, [ebp - 0x108]
call fcn.004012a0
lea ecx, [ebp - 0xb0]
call fcn.004012a0
lea ecx, [ebp - 0x40]
call fcn.004012a0
lea ecx, [ebp - 0x5c]
call fcn.004012a0
lea ecx, [ebp - 0x124]
call fcn.004012a0
lea ecx, [ebp - 0x140]
call fcn.004012a0
lea ecx, [ebp - 0x18c]
call fcn.00403340
lea ecx, [ebp - 0x17c]
call fcn.00403340
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], bl
call fcn.0041fed0
lea ecx, [ebp + 8]
call fcn.00403340
mov eax, 1
jmp 0x41da8c