Function at 0x1400df0b0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x9d8]
sub rsp, 0xab8
mov rbx, rcx
xor ecx, ecx
mov rax, rdx
mov edi, ecx
mov esi, ecx
test rbx, rbx
je 0x1400df39d
cmp word [rbx], cx
je 0x1400df39d
test rax, rax
je 0x1400df39d
cmp word [rdx], cx
je 0x1400df39d
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_wcsncpy
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], ax
call sub.msvcrt.dll_wcslen
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x1e], 0x5c
jne 0x1400df136
xor eax, eax
mov word [rsp + rcx*2 + 0x1e], ax
lea rcx, [rbp + 0x380]
mov r8d, 0x104
mov rdx, rbx
call sub.msvcrt.dll_wcsncpy
lea rcx, [rbp + 0x380]
xor ebx, ebx
mov word [rbp + 0x588], bx
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x1400df184
cdqe
cmp word [rbp + rax*2 + 0x37e], 0x5c
je 0x1400df184
lea rdx, [0x14018db3c]
lea rcx, [rbp + 0x380]
call sub.msvcrt.dll_wcscat
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x7a0]
call sub.msvcrt.dll_wcscpy
mov rbx, qword [rbp + 0x9f0]
xor eax, eax
lea rdx, [0x14018db40]
test rbx, rbx
je 0x1400df1b1
cmp word [rbx], ax
jne 0x1400df1b4
mov rbx, rdx
lea rcx, [rbp + 0x380]
call sub.msvcrt.dll_wcscat
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, 1
cmp rax, 0xffffffffffffffff
je 0x1400df1f0
test byte [rbp + 0x130], 0x10
cmovne esi, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x9e0], rax
cmp rax, 0xffffffffffffffff
je 0x1400df39d
test esi, esi
jne 0x1400df247
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcslen
mov rsi, qword [rbp + 0x9e8]
cmp word [rsp + rax*2 + 0x1e], 0x3a
je 0x1400df24e
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400df390
jmp 0x1400df24e
mov rsi, qword [rbp + 0x9e8]
mov edi, 1
lea rdx, [rbp + 0x7a0]
lea rcx, [rbp + 0x590]
call sub.msvcrt.dll_wcscpy
lea rdx, [rbp + 0x15c]
lea rcx, [rbp + 0x590]
call sub.msvcrt.dll_wcscat
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rsi
call sub.msvcrt.dll_wcsncpy
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rbp + 0x128], ax
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x1400df2be
cdqe
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x1400df2be
lea rdx, [0x14018db3c]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
lea rdx, [rbp + 0x15c]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscat
test byte [rbp + 0x130], 0x10
je 0x1400df330
test byte [rbp + 0x9f8], 1
je 0x1400df374
lea rdx, [0x14018db64]
lea rcx, [rbp + 0x15c]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400df374
lea rdx, [0x14018db6c]
lea rcx, [rbp + 0x15c]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400df374
mov r9d, dword [rbp + 0x9f8]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x590]
mov r8, rbx
call fcn.1400df0b0
jmp 0x1400df372
lea rcx, [rbp + 0x15c]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1400df374
test byte [rbp + 0x9f8], 2
je 0x1400df35d
lea rcx, [rsp + 0x20]
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x590]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
and edi, eax
mov rcx, qword [rbp + 0x9e0]
lea rdx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400df253
mov rcx, qword [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
movsxd rax, edi
add rsp, 0xab8
pop rdi
pop rsi
pop rbx
pop rbp
ret