Function at 0x14000e47c
Capabilities:
Check if file exists
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4a0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1400541a0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r14, r8
mov r13, rdx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x58], r8
xor edi, edi
mov r12d, edi
mov dword [rsp + 0x70], edi
lea rax, [rbp + 0x70]
mov qword [rsp + 0x70], rax
lea ebx, [rdi + 7]
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x80], rdi
mov word [rbp + 0x70], di
lea r8d, [rdi + 0x20]
lea rdx, str.VssClient::ExposeSnapshotLocally
lea rcx, [rbp + 0x70]
call fcn.140002d18
nop
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rdi
mov word [rbp + 0x50], di
lea r8d, [rdi + 0x26]
lea rdx, str.base_stor_vss_tools_vshadowexpose.cpp
lea rcx, [rbp + 0x50]
call fcn.140002d18
nop
lea r9, [rbp + 0x70]
lea r8d, [rdi + 0x15]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xf0]
call fcn.140002028
nop
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x40], rdi
mov word [rbp + 0x30], di
lea r8d, [rdi + 0x5d]
lea rdx, str.__Exposing_shadow_copy__.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x_under_the_path__s
lea rcx, [rbp + 0x30]
call fcn.140002d18
cmp qword [r14 + 0x18], 8
jb 0x14000e566
mov r15, qword [r14]
jmp 0x14000e569
mov r15, r14
movzx eax, byte [r13 + 0xf]
movzx ecx, byte [r13 + 0xe]
movzx edx, byte [r13 + 0xd]
movzx edi, byte [r13 + 0xc]
movzx r8d, byte [r13 + 0xb]
movzx r10d, byte [r13 + 0xa]
movzx r11d, byte [r13 + 9]
movzx ebx, byte [r13 + 8]
movzx esi, word [r13 + 6]
movzx r9d, word [r13 + 4]
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
mov r8d, dword [r13]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xf0]
call fcn.140001a50
movaps xmm0, xmmword [r13]
movdqa xmmword [rbp + 0x30], xmm0
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x30]
mov rax, qword [rax + 0x150]
call qword [0x1400375e8]
cmp eax, 0x80042308
je 0x14000ef3a
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
test byte [rbp + 0x18], 4
jne 0x14000ef76
xor ebx, ebx
cmp qword [rbp - 8], rbx
jne 0x14000eefe
cmp qword [rbp], rbx
jne 0x14000eefe
mov rcx, qword [r14 + 0x10]
cmp rcx, 2
jne 0x14000e767
cmp qword [r14 + 0x18], 8
jb 0x14000e653
mov rax, qword [r14]
jmp 0x14000e656
mov rax, r14
cmp word [rax + 2], 0x3a
jne 0x14000e767
mov r15d, 7
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x70], bx
lea r8d, [r15 + 0x27]
lea rdx, str.__Checking_if__s_is_a_valid_drive_letter_...
lea rcx, [rbp + 0x70]
call fcn.140002d18
cmp qword [r14 + 0x18], 8
jb 0x14000e699
mov r8, qword [r14]
jmp 0x14000e69c
mov r8, r14
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x60], rbx
mov word [rbp + 0x50], bx
xor r8d, r8d
mov ebx, 0x104
mov edx, ebx
lea rcx, [rbp + 0x50]
call fcn.140003718
lea rdi, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rdi, qword [rbp + 0x50]
xor eax, eax
movzx eax, ax
mov ecx, ebx
rep stosw word [rdi], ax
mov qword [rbp + 0x60], rbx
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rax, qword [rbp + 0x50]
xor ebx, ebx
mov word [rax + 0x208], bx
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140003678
cmp qword [r14 + 0x18], 8
jb 0x14000e71a
mov rcx, qword [r14]
jmp 0x14000e71d
mov rcx, r14
mov r8d, dword [rbp + 0x60]
mov rdx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
nop dword [rax + rax]
mov edi, eax
lea rcx, [rbp + 0x90]
call fcn.140003414
test edi, edi
jne 0x14000efb2
cmp qword [rbp + 0x68], 8
jb 0x14000eccc
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
jmp 0x14000eccc
cmp qword [r14 + 0x18], 8
jb 0x14000e773
mov rax, qword [r14]
jmp 0x14000e776
mov rax, r14
mov r8d, 0x5c
cmp word [rax + rcx*2 - 2], r8w
je 0x14000e790
lea edx, [r8 - 0x5b]
mov rcx, r14
call fcn.140003920
mov esi, 7
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x70], bx
lea r8d, [rsi + 0x2a]
lea rdx, str.__Checking_if__s_is_a_valid_empty_directory_...
lea rcx, [rbp + 0x70]
call fcn.140002d18
cmp qword [r14 + 0x18], 8
jb 0x14000e7c7
mov r8, qword [r14]
jmp 0x14000e7ca
mov r8, r14
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.140001a50
cmp qword [r14 + 0x18], 8
jb 0x14000e7e6
mov rcx, qword [r14]
jmp 0x14000e7e9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14000eeb4
test al, 0x10
je 0x14000eeb4
mov rdx, r14
lea rcx, [rbp + 0x90]
call fcn.14000f828
nop
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
nop dword [rax + rax]
mov r15, rax
or rcx, 0xffffffffffffffff
cmp rax, rcx
jne 0x14000e928
lea rax, [rbp + 0x70]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x50]
mov qword [rbp - 0x70], rax
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x70], bx
lea r8d, [rcx + 0x1a]
lea rdx, str.Executing_Win32_call__s
lea rcx, [rbp + 0x70]
call fcn.140002d18
nop
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x60], rbx
mov word [rbp + 0x50], bx
mov r8d, 0x20
lea rdx, str.VssClient::ExposeSnapshotLocally
lea rcx, [rbp + 0x50]
call fcn.140002d18
nop
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
mov r8d, 0x26
lea rdx, str.base_stor_vss_tools_vshadowexpose.cpp
lea rcx, [rbp + 0x30]
call fcn.140002d18
nop
lea rax, str.L_FindFirstFile_
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
mov r8d, 0x5a
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xf0]
call fcn.140001cb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jne 0x14000effc
mov esi, 7
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x80], r15
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x60], rbx
mov word [rbp + 0x50], bx
cmp word [rbp + 0x16c], bx
jne 0x14000e946
mov r8, rbx
jmp 0x14000e95a
lea rax, [rbp + 0x16c]
mov r8, rcx
inc r8
cmp word [rax + r8*2], bx
jne 0x14000e950
lea rdx, [rbp + 0x16c]
lea rcx, [rbp + 0x50]
call fcn.140002d18
nop
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x70], bx
mov r8d, 1
lea rdx, [0x14003b83c]
lea rcx, [rbp + 0x70]
call fcn.140002d18
nop
or r12d, 1
mov dword [rsp + 0x70], r12d
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rdx, qword [rbp + 0x50]
mov r9, qword [rbp + 0x80]
mov rax, r9
mov r10, qword [rbp + 0x60]
cmp r10, r9
cmovb rax, r10
test rax, rax
jmp 0x14000e9ee
movzx edi, word [rdx]
cmp di, word [rcx]
jne 0x14000ea70
add rdx, 2
add rcx, 2
sub rax, 1
jne 0x14000e9d6
mov ecx, ebx
mov eax, ebx
cmp r10, r9
setne al
mov rdx, 0xffffffffffffffff
cmovb eax, edx
test ecx, ecx
cmovne eax, ecx
test eax, eax
je 0x14000eabd
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
lea r8d, [rdx + 3]
lea rdx, [0x14003b840]
lea rcx, [rbp + 0x30]
call fcn.140002d18
or r12d, 2
lea rcx, [rbp + 0x30]
mov rbx, qword [rbp + 0x30]
mov r11, qword [rbp + 0x48]
cmp r11, 8
cmovae rcx, rbx
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rdx, qword [rbp + 0x50]
mov r9, qword [rbp + 0x40]
mov rax, r9
mov r10, qword [rbp + 0x60]
cmp r10, r9
cmovb rax, r10
xor esi, esi
test rax, rax
jmp 0x14000ea90
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14000e9f2
movzx edi, word [rdx]
cmp di, word [rcx]
jne 0x14000eab4
add rdx, 2
add rcx, 2
sub rax, 1
jne 0x14000ea7c
mov ecx, esi
mov eax, esi
cmp r10, r9
setne al
mov rdx, 0xffffffffffffffff
cmovb eax, edx
test ecx, ecx
cmovne eax, ecx
test eax, eax
je 0x14000eac7
mov dil, 1
jmp 0x14000eaca
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14000ea94
mov r11, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x30]
xor esi, esi
mov dil, sil
test r12b, 2
je 0x14000eafe
and r12d, 0xfffffffd
cmp r11, 8
jb 0x14000eae9
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov esi, 7
mov qword [rbp + 0x48], rsi
xor ebx, ebx
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
jmp 0x14000eb03
xor ebx, ebx
lea esi, [rbx + 7]
and r12d, 0xfffffffe
cmp qword [rbp + 0x88], 8
jb 0x14000eb21
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
test dil, dil
jne 0x14000f274
lea rdx, [rbp + 0x140]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14000ec4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x12
je 0x14000ec7c
lea rax, [rbp + 0x70]
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x70], bx
mov r8d, AtlComPtrAssign
lea rdx, str.Executing_Win32_call__s
lea rcx, [rbp + 0x70]
call fcn.140002d18
nop
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xe0], rbx
mov word [rbp + 0xd0], bx
mov r8d, 0x20
lea rdx, str.VssClient::ExposeSnapshotLocally
lea rcx, [rbp + 0xd0]
call fcn.140002d18
nop
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0xc0], rbx
mov word [rbp + 0xb0], bx
mov r8d, 0x26
lea rdx, str.base_stor_vss_tools_vshadowexpose.cpp
lea rcx, [rbp + 0xb0]
call fcn.140002d18
nop
lea rax, str.L_FindNextFile_
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xd0]
mov r8d, 0x6e
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xf0]
call fcn.140001cb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jne 0x14000f0d0
cmp qword [rbp + 0x68], 8
mov esi, 7
lea rcx, [rsi - 8]
jb 0x14000e92c
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
or rcx, 0xffffffffffffffff
jmp 0x14000e92c
cmp qword [rbp + 0x68], 8
jb 0x14000ec94
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
nop dword [rax + rax]
nop
cmp qword [rbp + 0xa8], 8
jb 0x14000ecc1
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov r15d, 7
mov rsi, qword [rsp + 0x78]
mov qword [rbp - 0x78], rbx
lea rax, [rbp + 0x90]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xa0], rbx
mov word [rbp + 0x90], bx
mov r8d, 0x17
lea rdx, str.Executing_COM_call__s
lea rcx, [rbp + 0x90]
call fcn.140002d18
nop
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0xc0], rbx
mov word [rbp + 0xb0], bx
mov r8d, 0x20
lea rdx, str.VssClient::ExposeSnapshotLocally
lea rcx, [rbp + 0xb0]
call fcn.140002d18
nop
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xe0], rbx
mov word [rbp + 0xd0], bx
mov r8d, 0x26
lea rdx, str.base_stor_vss_tools_vshadowexpose.cpp
lea rcx, [rbp + 0xd0]
call fcn.140002d18
nop
lea r12, str._m_pVssObject__ExposeSnapshot_snapshotID__NULL__VSS_VOLSNAP_ATTR_EXPOSED_LOCALLY___VSS_PWSZ_path.c_str____pwszExposed__
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb0]
mov r8d, 0x76
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xf0]
call fcn.140001cb4
movaps xmm0, xmmword [r13]
movdqa xmmword [rbp + 0x30], xmm0
mov rdi, qword [rsi + 8]
cmp qword [r14 + 0x18], 8
jb 0x14000edc5
mov rcx, qword [r14]
jmp 0x14000edc8
mov rcx, r14
mov rax, qword [rdi]
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r9d, 0x100000
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, rdi
mov rax, qword [rax + 0x180]
call qword [0x1400375e8]
mov esi, eax
test eax, eax
js 0x14000f1a4
mov rdi, qword [rbp - 0x78]
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xa0], rbx
mov word [rbp + 0x90], bx
mov r8d, AtlComPtrAssign
lea rdx, str.__Shadow_copy_exposed_as__s
lea rcx, [rbp + 0x90]
call fcn.140002d18
mov r8, qword [rbp - 0x78]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xf0]
call fcn.140001a50
nop
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x50]
call qword [sym.imp.VSSAPI.DLL_VssFreeSnapshotPropertiesInternal]
nop dword [rax + rax]
nop
lea rcx, [rbp + 0xf0]
call fcn.1400021d4
nop
xor r8d, r8d
mov dl, 1
mov rcx, r14
call fcn.140003a0c
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140032b80
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str._nERROR:_the_second_parameter_to__el___s__is_not_a_valid_directory_
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdi, rax
mov rcx, r14
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
int3
lea rdx, str._nERROR:_Client_accessible__SFSF__snapshots_cannot_be_exposed.
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_there_is_no_snapshot_with_the_given_ID
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_the_snapshot_ID_identifies_a_Client_Accessible_snapshot_which_cannot_be_exposed
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_the_second_parameter_to__el___s__is_a_drive_letter_already_in_use_
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdi, rax
mov rcx, r14
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_Win32_call__s_failed.
lea rcx, [rbp + 0xb0]
call fcn.140002e00
lea r8, str.L_FindFirstFile_
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
lea rdx, str.__GetLastError_____ld
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.14000231c
mov rbx, rax
lea rdx, str.__Error_text:__s
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdi, rax
mov rcx, rbx
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
nop
lea rcx, [rbp + 0xd0]
call fcn.140003a84
lea rdx, str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], esi
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_Win32_call__s_failed.
lea rcx, [rbp + 0xb0]
call fcn.140002e00
lea r8, str.L_FindNextFile_
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
lea rdx, str.__GetLastError_____ld
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.14000231c
mov rbx, rax
lea rdx, str.__Error_text:__s
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdi, rax
mov rcx, rbx
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
nop
lea rcx, [rbp + 0xd0]
call fcn.140003a84
lea rdx, str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], esi
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_COM_call__s_failed.
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
lea rdx, str.__Returned_HRESULT__0x_08lx
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov edx, esi
lea rcx, [rbp + 0xb0]
call fcn.14000231c
mov rbx, rax
lea rdx, str.__Error_text:__s
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdi, rax
mov rcx, rbx
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
nop
lea rcx, [rbp + 0xb0]
call fcn.140003a84
lea rdx, str.__Please_re_run_VSHADOW.EXE_with_the__tracing_option_to_get_more_details
lea rcx, [rbp + 0x90]
call fcn.140002e00
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], esi
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
nop
lea rdx, str._nERROR:_the_second_parameter_to__el___s__is_not_an_empty_directory_
lea rcx, [rbp + 0xb0]
call fcn.140002e00
mov rdi, rax
mov rcx, r14
call fcn.140003700
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.140001a50
mov dword [rsp + 0x70], 0x80070057
lea rdx, [0x140052a88]
lea rcx, [rsp + 0x70]
call sub.msvcrt.dll__CxxThrowException
int3