Function at 0x412d10
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x43d187
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x388
mov eax, dword [0x45447c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x394], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], ebp
sub esp, 0x1c
mov esi, esp
mov ebx, 7
mov dword [esp + 0x2c], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.VssClient::ExposeSnapshotLocally
mov dword [esp + 0x3c0], ebp
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str.VssClient::ExposeSnapshotLocally
mov ecx, esi
call fcn.00402190
push 0x15
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x64], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str..expose.cpp
mov byte [esp + 0x3e0], 1
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str..expose.cpp
mov ecx, esi
call fcn.00402190
lea ecx, [esp + 0x74]
mov byte [esp + 0x3dc], 0
call fcn.0041fd60
cmp dword [esp + 0x3d0], 8
mov eax, dword [esp + 0x3bc]
mov byte [esp + 0x3a0], 2
jae 0x412de8
lea eax, [esp + 0x3bc]
movzx ecx, byte [esp + 0x3b6]
push eax
movzx eax, byte [esp + 0x3bb]
push eax
mov eax, dword [esp + 0x3bc]
push ecx
movzx ecx, byte [esp + 0x3bf]
movzx edx, ah
push edx
movzx edx, byte [esp + 0x3c2]
movzx eax, al
push eax
mov eax, dword [esp + 0x3c4]
push ecx
push edx
movzx ecx, ah
push ecx
movzx ecx, word [esp + 0x3cc]
movzx edx, al
movzx eax, word [esp + 0x3ce]
push edx
mov edx, dword [esp + 0x3cc]
push eax
push ecx
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x74], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.__Exposing_shadow_copy__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x_under_the_path__s
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str.__Exposing_shadow_copy__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x_under_the_path__s
mov ecx, esi
call fcn.00402190
lea eax, [esp + 0x84]
push eax
call fcn.00420010
mov esi, dword [esp + 0x3f8]
mov eax, dword [edi + 8]
mov ecx, dword [eax]
add esp, 0x50
lea edx, [esp + 0xe4]
push edx
sub esp, 0x10
mov edx, esp
mov dword [edx], esi
mov esi, dword [esp + 0x3c0]
mov dword [edx + 4], esi
mov esi, dword [esp + 0x3c4]
mov dword [edx + 8], esi
mov esi, dword [esp + 0x3c8]
push eax
mov dword [edx + 0xc], esi
call dword [ecx + 0xa8]
cmp eax, 0x80042308
jne 0x412f1a
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str._nERROR:_there_is_no_snapshot_with_the_given_ID
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str._nERROR:_there_is_no_snapshot_with_the_given_ID
mov ecx, esi
call fcn.00402190
lea eax, [esp + 0x54]
push eax
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x80070057
call fcn.004302ea
lea edx, [esp + 0xe4]
mov dword [esp + 0x28], edx
test byte [esp + 0x130], 4
mov byte [esp + 0x3a0], 3
je 0x412f88
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str._nERROR:_the_snapshot_ID_identifies_a_Client_Accessible_snapshot_which_cannot_be_exposed
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str._nERROR:_the_snapshot_ID_identifies_a_Client_Accessible_snapshot_which_cannot_be_exposed
mov ecx, esi
call fcn.00402190
lea eax, [esp + 0x54]
push eax
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x80070057
call fcn.004302ea
cmp dword [esp + 0x118], ebp
jne 0x4138a6
cmp dword [esp + 0x11c], ebp
jne 0x4138a6
mov esi, dword [esp + 0x3cc]
cmp esi, 2
jne 0x4130da
push 1
lea ecx, [esp + 0x3bc]
call fcn.004010f0
cmp word [eax], 0x3a
jne 0x4130da
mov eax, dword [esp + 0x3d0]
mov esi, 8
cmp eax, esi
mov eax, dword [esp + 0x3bc]
jae 0x412fe8
lea eax, [esp + 0x3bc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.__Checking_if__s_is_a_valid_drive_letter_...
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
add esp, 0x24
push ebp
push 0x104
lea ecx, [esp + 0x98]
call fcn.00402470
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x3a4], 4
call fcn.00403950
mov ecx, dword [esp + 0x3d0]
mov eax, dword [eax + 8]
cmp ecx, esi
mov ecx, dword [esp + 0x3bc]
jae 0x413050
lea ecx, [esp + 0x3bc]
mov edx, dword [esp + 0xa4]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
lea ecx, [esp + 0x74]
setne bl
call fcn.004039d0
test bl, bl
je 0x4130c1
cmp dword [esp + 0x3d0], esi
mov eax, dword [esp + 0x3bc]
jae 0x413089
lea eax, [esp + 0x3bc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str._nERROR:_the_second_parameter_to__el___s__is_a_drive_letter_already_in_use_
call fcn.004026d0
lea eax, [esp + 0x58]
push eax
call fcn.00420010
add esp, 0x24
push 0x44f9c4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x80070057
call fcn.004302ea
lea ecx, [esp + 0x90]
mov byte [esp + 0x3a0], 3
call fcn.004012a0
jmp 0x41354a
dec esi
push esi
lea ecx, [esp + 0x3bc]
call fcn.004010f0
cmp word [eax], 0x5c
je 0x4130fe
push 0x5c
push 1
lea ecx, [esp + 0x3c0]
call fcn.00401d10
mov eax, dword [esp + 0x3d0]
mov esi, 8
cmp eax, esi
mov eax, dword [esp + 0x3bc]
jae 0x41311c
lea eax, [esp + 0x3bc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.__Checking_if__s_is_a_valid_empty_directory_...
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
mov eax, dword [esp + 0x3f4]
add esp, 0x24
cmp eax, esi
mov eax, dword [esp + 0x3bc]
jae 0x413156
lea eax, [esp + 0x3bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x413857
test al, 0x10
je 0x413857
push 0x2a
lea eax, [esp + 0x3bc]
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.004126f0
add esp, 0xc
cmp dword [esp + 0xa8], esi
mov eax, dword [esp + 0x94]
mov byte [esp + 0x3a0], 5
jae 0x4131a7
lea eax, [esp + 0x94]
lea edx, [esp + 0x144]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
jne 0x413321
push 0x44375c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push str.Executing_Win32_call__s
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x68], esp
push str.VssClient::ExposeSnapshotLocally
mov byte [esp + 0x3e0], 6
call fcn.004026d0
push 0x5a
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x7c], esp
push str..expose.cpp
mov byte [esp + 0x400], bl
call fcn.004026d0
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x400], 5
call fcn.0041fad0
add esp, 0x60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebp
mov edi, esi
jle 0x413248
and edi, 0xffff
or edi, 0x80070000
cmp esi, ebp
je 0x41331d
push 0x44375c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push str._nERROR:_Win32_call__s_failed.
call fcn.004026d0
lea ecx, [esp + 0x58]
push ecx
call fcn.00420010
add esp, 0x24
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push str.__GetLastError_____ld
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
lea eax, [esp + 0x98]
push edi
push eax
call fcn.0041f780
add esp, 0x2c
cmp dword [eax + 0x18], 8
mov byte [esp + 0x3a0], 8
jb 0x4132b5
mov eax, dword [eax + 4]
jmp 0x4132b8
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push str.__Error_text:__s
call fcn.004026d0
lea ecx, [esp + 0x58]
push ecx
call fcn.00420010
add esp, 0x24
lea ecx, [esp + 0x74]
mov byte [esp + 0x3a0], 5
call fcn.004012a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
call fcn.004026d0
lea edx, [esp + 0x54]
push edx
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], edi
call fcn.004302ea
mov edi, dword [esp + 0x10]
mov dword [esp + 0x20], edi
mov byte [esp + 0x3a0], 9
lea ecx, [ecx]
lea ecx, [esp + 0x170]
push ecx
lea ecx, [esp + 0x78]
call fcn.004026d0
push 0x443758
lea ecx, [esp + 0xb0]
mov byte [esp + 0x3a4], 0xa
call fcn.004026d0
mov ebx, dword [esp + 0x24]
push eax
lea edx, [esp + 0x78]
or ebx, 1
push edx
mov byte [esp + 0x3a8], 0xb
mov dword [esp + 0x2c], ebx
call fcn.004126c0
add esp, 8
test al, al
je 0x4133b9
push 0x443750
lea ecx, [esp + 0xcc]
call fcn.004026d0
push eax
lea eax, [esp + 0x78]
or ebx, 2
push eax
mov dword [esp + 0x3a8], 0xc
mov dword [esp + 0x2c], ebx
call fcn.004126c0
add esp, 8
test al, al
mov byte [esp + 0x1f], 1
jne 0x4133be
mov byte [esp + 0x1f], 0
test bl, 2
je 0x4133d6
and ebx, 0xfffffffd
lea ecx, [esp + 0xc8]
mov dword [esp + 0x24], ebx
call fcn.004012a0
test bl, 1
mov dword [esp + 0x3a0], 0xa
je 0x4133f9
and ebx, 0xfffffffe
lea ecx, [esp + 0xac]
mov dword [esp + 0x24], ebx
call fcn.004012a0
mov al, byte [esp + 0x1f]
test al, al
jne 0x4134cd
lea ecx, [esp + 0x144]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4134b7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x12
je 0x41351d
push str.L_FindNextFile_
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.Executing_Win32_call__s
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push str.VssClient::ExposeSnapshotLocally
mov byte [esp + 0x3e0], 0xd
call fcn.004026d0
push 0x6e
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push str..expose.cpp
mov byte [esp + 0x400], 0xe
call fcn.004026d0
lea edx, [esp + 0x94]
push edx
mov byte [esp + 0x400], 0xa
call fcn.0041fad0
add esp, 0x60
call esi
mov esi, eax
cmp esi, ebp
mov edi, esi
jle 0x4134ad
and edi, 0xffff
or edi, 0x80070000
cmp esi, ebp
jne 0x413785
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x74]
mov byte [esp + 0x3a0], 9
call fcn.004012a0
jmp 0x413330
cmp dword [esp + 0x3d0], 8
mov eax, dword [esp + 0x3bc]
jae 0x4134e5
lea eax, [esp + 0x3bc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str._nERROR:_the_second_parameter_to__el___s__is_not_an_empty_directory_
call fcn.004026d0
lea eax, [esp + 0x58]
push eax
call fcn.00420010
add esp, 0x24
push 0x44f9c4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x80070057
call fcn.004302ea
lea ecx, [esp + 0x74]
call fcn.004012a0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x90]
mov byte [esp + 0x3a0], 3
call fcn.004012a0
mov edi, dword [esp + 0x18]
mov esi, 8
push str._m_pVssObject__ExposeSnapshot_snapshotID__NULL__VSS_VOLSNAP_ATTR_EXPOSED_LOCALLY___VSS_PWSZ_path.c_str____pwszExposed__
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Executing_COM_call__s
mov dword [esp + 0x54], ebp
call fcn.004026d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push str.VssClient::ExposeSnapshotLocally
mov byte [esp + 0x3e0], 0x10
call fcn.004026d0
push 0x76
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x88], esp
push str..expose.cpp
mov byte [esp + 0x400], 0x11
call fcn.004026d0
lea edx, [esp + 0x94]
push edx
mov byte [esp + 0x400], 3
call fcn.0041fad0
mov ecx, dword [esp + 0x430]
mov eax, dword [edi + 8]
add esp, 0x60
cmp ecx, esi
mov ecx, dword [esp + 0x3bc]
jae 0x4135d5
lea ecx, [esp + 0x3bc]
mov edx, dword [eax]
lea esi, [esp + 0x30]
push esi
mov esi, dword [esp + 0x3ac]
push ecx
push 0x100000
push ebp
sub esp, 0x10
mov ecx, esp
mov dword [ecx], esi
mov esi, dword [esp + 0x3cc]
mov dword [ecx + 4], esi
mov esi, dword [esp + 0x3d0]
mov dword [ecx + 8], esi
mov esi, dword [esp + 0x3d4]
push eax
mov dword [ecx + 0xc], esi
call dword [edx + 0xc0]
mov esi, eax
cmp esi, ebp
jge 0x4136f2
push str._m_pVssObject__ExposeSnapshot_snapshotID__NULL__VSS_VOLSNAP_ATTR_EXPOSED_LOCALLY___VSS_PWSZ_path.c_str____pwszExposed__
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str._nERROR:_COM_call__s_failed.
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
add esp, 0x24
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.__Returned_HRESULT__0x_08lx
call fcn.004026d0
lea eax, [esp + 0x58]
push eax
call fcn.00420010
lea ecx, [esp + 0xd0]
push esi
push ecx
call fcn.0041f780
add esp, 0x2c
cmp dword [eax + 0x18], 8
mov byte [esp + 0x3a0], 0x12
jb 0x413687
mov eax, dword [eax + 4]
jmp 0x41368a
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.__Error_text:__s
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
add esp, 0x24
lea ecx, [esp + 0xac]
mov byte [esp + 0x3a0], 3
call fcn.004012a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
call fcn.004026d0
lea eax, [esp + 0x54]
push eax
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], esi
call fcn.004302ea
mov eax, dword [esp + 0x30]
mov esi, eax
mov dword [esp + 0x14], esi
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push str.__Shadow_copy_exposed_as__s
mov byte [esp + 0x3c4], 0x13
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
add esp, 0x24
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0x3a4], 2
call sub.VSSAPI.DLL_VssFreeSnapshotProperties
lea ecx, [esp + 0x38]
mov byte [esp + 0x3a0], 0
call fcn.0041fed0
lea ecx, [esp + 0x3b8]
call fcn.004012a0
mov ecx, dword [esp + 0x398]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x394]
call fcn.0043053d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x394
ret 0x2c
push str.L_FindNextFile_
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str._nERROR:_Win32_call__s_failed.
call fcn.004026d0
lea ecx, [esp + 0x58]
push ecx
call fcn.00420010
add esp, 0x24
push esi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.__GetLastError_____ld
call fcn.004026d0
lea edx, [esp + 0x58]
push edx
call fcn.00420010
lea eax, [esp + 0xd0]
push edi
push eax
call fcn.0041f780
add esp, 0x2c
cmp dword [eax + 0x18], 8
mov byte [esp + 0x3a0], 0xf
jb 0x4137ec
mov eax, dword [eax + 4]
jmp 0x4137ef
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.__Error_text:__s
call fcn.004026d0
lea ecx, [esp + 0x58]
push ecx
call fcn.00420010
add esp, 0x24
lea ecx, [esp + 0xac]
mov byte [esp + 0x3a0], 0xa
call fcn.004012a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
call fcn.004026d0
lea edx, [esp + 0x54]
push edx
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], edi
call fcn.004302ea
cmp dword [esp + 0x3d0], esi
mov eax, dword [esp + 0x3bc]
jae 0x41386e
lea eax, [esp + 0x3bc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str._nERROR:_the_second_parameter_to__el___s__is_not_a_valid_directory_
call fcn.004026d0
lea ecx, [esp + 0x58]
push ecx
call fcn.00420010
add esp, 0x24
push 0x44f9c4
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x80070057
call fcn.004302ea
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str._nERROR:_Client_accessible__SFSF__snapshots_cannot_be_exposed.
mov word [esi + 4], bp
call fcn.0042fe2d
add esp, 4
push eax
push str._nERROR:_Client_accessible__SFSF__snapshots_cannot_be_exposed.
mov ecx, esi
call fcn.00402190
lea eax, [esp + 0x54]
push eax
call fcn.00420010
add esp, 0x20
push 0x44f9c4
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], 0x80070057
call fcn.004302ea
int3