Function at 0x4bb100
Capabilities:
Create directory
Get common file path
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f63df
mov eax, dword fs:[0]
push eax
mov eax, 0x2d40
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x2d3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x2d54]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2d64]
mov ebp, dword [esp + 0x2d74]
mov edi, dword [esp + 0x2d78]
mov esi, dword [esp + 0x2d68]
lea eax, [esp + 0x48]
push eax
push 0x2e
push 0
mov dword [esp + 0x68], ebx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x54], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x350]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [esp + 0x350]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x2d5c], 0
push str.TC_Bk
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov ecx, dword [esp + 0x20]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x64]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0x2d5c], 1
push 0x1ff
lea edx, [esp + 0x155]
push 0
push edx
mov byte [esp + 0x15c], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x200
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x150]
push ecx
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 2
push str.TC_BkTC_Bk
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_945]
test ebp, ebp
je 0x4bb286
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push ebp
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d68], 3
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x60], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x2d6c], 4
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x2d70], 2
call fcn.004b1c00
add esp, 0x14
push 0x5059c0
lea ecx, [esp + 0x20]
push esi
push ecx
call dword [sym.imp.MSVCR90.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x4bb80f
push 0x27ff
push eax
lea edx, [esp + 0x559]
push edx
mov byte [esp + 0x55c], al
call sub.MSVCR90.dll_memset
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
je 0x4bb80f
push 0
push 0
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
cmp dword [ebx], 0
mov dword [esp + 0x40], 0
je 0x4bb7f6
mov eax, ebx
lea esp, [esp]
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 5
cmp byte [esp + 0x2d70], 0
je 0x4bb3de
push 0x4ff418
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x5c]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x2d5c], 6
mov eax, dword [eax]
push eax
push str.XFolderX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
mov byte [esp + 0x2d5c], 5
lea ecx, [esp + 0x54]
call dword [sym.imp.mfc90.dll_Ordinal_601]
cmp byte [esp + 0x2d6c], 0
lea ecx, [esp + 0x14]
je 0x4bb3a1
push 0x5116d8
push str.XexDBX
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push 0x502170
push str.XisFullX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push str.DATABASE
push str.XDATABASEX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
jmp 0x4bb73d
push str._master
push str.XexDBX
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push str._Log_
push str.XisFullX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push 0x515814
push str.XDATABASEX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
jmp 0x4bb73d
test ebp, ebp
je 0x4bb73d
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x2d5c], 7
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x2d5c], 8
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0x2d5c], 9
push str.restore_log_XDatabaseNameX_from_disk__C:WindowsSystem32TC_BkTC_BkMSSQL_XDatabaseNameX_Log_XRestoreDateX.TC_BK.sys_with_norecovery_ngo_n
lea ecx, [esp + 0x48]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xa
push str.restore_log_XDatabaseNameX_from_disk__C:WindowsSystem32TC_BkTC_BkMSSQL_XDatabaseNameX_Log_XRestoreDateAtX.TC_BK.sys_with_norecovery_XStopAtX_ngo_n
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xb
push 0x5116d8
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xc
push 0x5116d8
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xd
push 0x5116d8
lea ecx, [esp + 0x5c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xe
push 0x5116d8
lea ecx, [esp + 0x64]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x2d5c], 0xf
mov eax, dword [esp + 0x6c]
xor esi, esi
test eax, eax
jle 0x4bb559
test esi, esi
jne 0x4bb4d8
test eax, eax
jle 0x4bb86f
mov eax, dword [esp + 0x68]
mov eax, dword [eax]
push eax
push str.XRestoreDateFullX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
jmp 0x4bb54c
dec eax
cmp esi, eax
jne 0x4bb4e4
lea ecx, [esp + 0x34]
push ecx
jmp 0x4bb4e9
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
test esi, esi
jl 0x4bb86f
cmp esi, dword [esp + 0x6c]
jge 0x4bb86f
mov eax, dword [esp + 0x68]
mov eax, dword [eax + esi*4]
push eax
push str.XRestoreDateX
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
cmp esi, dword [esp + 0x6c]
jge 0x4bb86f
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + esi*4]
push eax
push str.XRestoreDateAtX
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov eax, dword [esp + 0x6c]
inc esi
cmp esi, eax
jl 0x4bb4b4
cmp byte [esp + 0x2d6c], 0
lea ecx, [esp + 0x14]
je 0x4bb56e
push 0x5116d8
jmp 0x4bb573
mov eax, dword [esp + 0x2c]
push eax
push str.XXXX
call dword [sym.imp.mfc90.dll_Ordinal_5924]
mov esi, dword [sym.imp.MSVCR90.dll__localtime64_s]
lea ecx, [esp + 0xe4]
push edi
push ecx
call esi
add esp, 8
test eax, eax
jne 0x4bb5a3
mov edx, dword [esp + 0xe4]
mov dword [esp + 0x3c], edx
jmp 0x4bb5ab
mov dword [esp + 0x3c], 0xffffffff
lea eax, [esp + 0x108]
push edi
push eax
call esi
add esp, 8
test eax, eax
jne 0x4bb5c6
mov ebx, dword [esp + 0x10c]
jmp 0x4bb5c9
or ebx, 0xffffffff
lea ecx, [esp + 0x78]
push edi
push ecx
call esi
add esp, 8
test eax, eax
jne 0x4bb5e1
mov ebp, dword [esp + 0x80]
jmp 0x4bb5e4
or ebp, 0xffffffff
lea edx, [esp + 0x12c]
push edi
push edx
call esi
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x140]
lea ecx, [esp + 0xa4]
mov edi, eax
mov eax, dword [esp + 0x30]
push eax
push ecx
call esi
add esp, 0x10
test eax, eax
jne 0x4bb61e
mov esi, dword [esp + 0xac]
inc esi
jmp 0x4bb620
xor esi, esi
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.MSVCR90.dll__localtime64_s]
add esp, 8
test eax, eax
jne 0x4bb648
mov eax, dword [esp + 0xd4]
add eax, 0x76c
jmp 0x4bb64a
xor eax, eax
mov ecx, dword [esp + 0x3c]
push ecx
push ebx
push ebp
push edi
push esi
push eax
lea edx, [esp + 0x48]
push str._04d_02d_02d__02d:_02d:_02d
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov eax, dword [esp + 0x50]
add esp, 0x20
push eax
push str.XStopAtX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
mov ecx, dword [esp + 0x38]
push ecx
push str.XDatabaseNameX
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
mov byte [esp + 0x2d5c], 0xe
lea ecx, [esp + 0x60]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 0xd
lea ecx, [esp + 0x58]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 0xc
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 0xb
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 0xa
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 9
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 8
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 7
lea ecx, [esp + 0x50]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 5
lea ecx, [esp + 0x4c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x550]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4bb750
lea eax, [esp + 0x550]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bb764
sub eax, edx
cmp byte [esp + eax + 0x54e], 0xd
je 0x4bb7b8
lea eax, [esp + 0x550]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bb781
sub eax, edx
cmp byte [esp + eax + 0x54f], 0xa
je 0x4bb7b8
lea eax, [esp + 0x550]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bb7a0
sub eax, edx
mov byte [esp + eax + 0x550], 0xa
mov byte [esp + eax + 0x551], cl
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x554]
push eax
call dword [sym.imp.MSVCR90.dll_fputs]
add esp, 8
mov byte [esp + 0x2d5c], 2
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x40]
inc eax
cmp dword [ebx + eax*4], 0
mov dword [esp + 0x40], eax
lea eax, [ebx + eax*4]
jne 0x4bb2f0
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCR90.dll_fflush]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 8
mov byte [esp + 0x2d5c], 1
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x2d5c], 0
lea ecx, [esp + 0x64]
call sub.mfc90.dll_Ordinal_781
mov dword [esp + 0x2d5c], 0xffffffff
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x2d54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d3c]
xor ecx, esp
call fcn.004e0148
add esp, 0x2d4c
ret
call sub.mfc90.dll_Ordinal_1252
int3