Function at 0x140035ae9
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x100d8
call fcn.1400406f0
sub rsp, rax
mov rax, qword [0x14005f180]
xor rax, rsp
mov qword [rsp + 0x100c0], rax
mov r14, qword [rsp + 0x10130]
xor r15d, r15d
mov rbx, r8
mov rbp, rcx
mov rsi, rdx
lea r8d, [r15 + 0x60]
lea rcx, [rsp + 0x58]
xor edx, edx
mov rdi, r9
mov dword [rsp + 0x50], r15d
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0xc1]
xor edx, edx
mov r8d, 0x7fff
mov byte [rsp + 0xc0], r15b
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0x80c1]
xor edx, edx
mov r8d, 0x7fff
mov byte [rsp + 0x80c0], r15b
call sub.MSVCR120.dll_memset
lea r9, str.Validating_the_input_parameters_passed_to_the_new_command_prompt_for_the_file_level_recovery_of_the_save_set__s._n
lea r8d, [r15 + 2]
mov edx, 0x33450
mov ecx, 0x2bb51
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call sub.liblocal.dll_msg_print
test rbp, rbp
je 0x140035cbc
test byte [rbp], 0xdf
je 0x140035cbc
test rsi, rsi
je 0x140035cbc
test byte [rsi], 0xdf
je 0x140035cbc
test rbx, rbx
je 0x140035cbc
test byte [rbx], 0xdf
je 0x140035cbc
test rdi, rdi
je 0x140035cbc
test byte [rdi], 0xdf
je 0x140035cbc
mov eax, 0xa
lea r8, str.echo__Use_this_command_prompt_to_do_file_level_recovery_of_save_set_ID__s____t_t_t_t_t_t_t_t_t_t_techo__Upon_completion_of_recovery_operation__exit_the_command_prompt.___t_t_t_t_t_t_t_t_t_t_tcd__D___s_
lea rcx, [rsp + 0xc0]
mov r9, rbx
mov edx, 0x8000
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x8c], 1
mov word [rsp + 0x90], ax
mov qword [rsp + 0x20], rbp
call sub.liblocal.dll_lg_snprintf
cmp eax, 0x8000
jb 0x140035bae
lea r9, str.Insufficient_command_length_buffer_n
mov edx, 0xd6d8
mov ecx, 0x17193
jmp 0x140035ce9
lea rax, [rsp + 0xc0]
lea r8, str._s__k___s_
lea rcx, [rsp + 0x80c0]
mov r9, rsi
mov edx, 0x8000
mov qword [rsp + 0x20], rax
call sub.liblocal.dll_lg_snprintf
mov r8d, 2
cmp eax, 0x8000
jb 0x140035bfa
lea r9, str.Insufficient_command_length_buffer_n
mov edx, 0xd6d8
mov ecx, 0x17193
jmp 0x140035cef
lea r9, str.Invoking_a_new_command_prompt_for_the_file_level_recovery_of_the_save_set__s._n
mov edx, 0x33450
mov ecx, 0x2bb54
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call sub.liblocal.dll_msg_print
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x80c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140035c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sub.liblocal.dll_nt_syserror
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Unable_to_invoke_the_command_prompt._Operation_failed_with_error:__s._n
lea edx, [rax + 0x347d8]
mov ecx, 0x2bb55
mov r8d, 2
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x18
call sub.liblocal.dll_msg_print
jmp 0x140035cf4
cmp qword [r14], 0xffffffffffffffff
jne 0x140035cb5
lea r9, str.Unable_to_spawn_the_command_prompt._Invalid_process_handle_was_returned_n
mov edx, 0xd6d8
mov ecx, 0x17195
jmp 0x140035ce9
mov eax, 1
jmp 0x140035cf6
lea r9, str.Unable_to_validate_the_input_parameters_passed_to_the_new_command_prompt._n
mov edx, 0x347d8
mov ecx, 0x2bb52
mov r8d, 2
call sub.liblocal.dll_msg_print
lea r9, str.One_of_the_following_inputs_might_be_missing:_mount_point_path__command_prompt_executable_path__save_set_ID._n
mov edx, 0x33450
mov ecx, 0x2bb53
mov r8d, 2
call sub.liblocal.dll_msg_print
xor eax, eax
mov rcx, qword [rsp + 0x100c0]
xor rcx, rsp
call fcn.1400403f0
add rsp, 0x100d8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret