Function at 0x14004ca28
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Get file size

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rdi, rcx
mov dword [rsp + 0xc0], 1
xor ecx, ecx
mov r15, r9
mov dword [rsp + 0xc8], ecx
mov rbp, r8
mov qword [rsp + 0x40], rcx
mov r13, rdx
mov dword [rsp + 0xd8], ecx
mov ebx, ecx
mov qword [rsp + 0x48], rcx
mov r14d, ecx
test rdx, rdx
je 0x14004ca7d
mov rsi, qword [rdx]
jmp 0x14004ca81
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14004caaa
cmp qword [rdi + 0x48], rcx
mov rax, rdi
cmovne rax, qword [rdi + 0x48]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0xd8], eax
mov rax, rdi
cmovne rax, qword [rdi + 0x48]
mov r12, qword [rax + 0x28]
jmp 0x14004caad
mov r12, rcx
test byte [r9 + 0x1c], 0x10
je 0x14004cb32
mov rcx, rbp
mov dword [rsp + 0xc0], 3
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x14004cb32
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14004cb32
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov ebp, 0x80004005
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14004cc59
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14004cc5b
mov ebp, 0x80004005
cmp rsi, 0xffffffffffffffff
jne 0x14004cb82
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rdi
call fcn.140034310
mov r14, qword [rsp + 0x48]
mov rsi, rax
test r14, r14
je 0x14004ce0a
lea rdx, [r15 + 0x20]
mov r9, r14
mov r8, rax
mov rcx, rdi
call fcn.140046ea8
test eax, eax
je 0x14004cd9d
mov dword [rsp + 0xc8], 1
mov r15d, 0x80070000
test ebx, ebx
js 0x14004cc7c
test r12, r12
je 0x14004cc7c
test dword [r12], 0x20000
mov rdi, qword [rsp + 0xd0]
je 0x14004cc84
mov edx, dword [rsp + 0xc0]
lea r8, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawW]
nop dword [rax + rax]
test eax, eax
jne 0x14004ce61
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x58]
mov rcx, rsi
movdqu xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [0x14004c970]
call qword [sym.imp.ADVAPI32.dll_WriteEncryptedFileRaw]
nop dword [rax + rax]
test eax, eax
je 0x14004cc46
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004cc46
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restoreworker.c
mov r9d, ebx
lea rcx, str.RestoreEncryptedFile
mov r8d, 0x82a
call fcn.140046874
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CloseEncryptedFileRaw]
nop dword [rax + rax]
jmp 0x14004cc84
mov ebx, ebp
and qword [rsp + 0x20], r14
mov r8d, 0x7ce
mov r9d, ebx
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restoreworker.c
lea rcx, str.RestoreEncryptedFile
call fcn.140046874
mov rdi, qword [rsp + 0xd0]
cmp rsi, 0xffffffffffffffff
je 0x14004cca3
cmp dword [rsp + 0xc8], 0
je 0x14004cca3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test r14, r14
je 0x14004ccd7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test ebx, ebx
js 0x14004cebf
test r13, r13
je 0x14004cebf
cmp qword [r13], 0xffffffffffffffff
je 0x14004ccff
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rsp + 0xd8]
mov rcx, rdi
and eax, 0x10000
neg eax
sbb edx, edx
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x2200000
and edx, 0x10c0000
mov dword [rsp + 0x20], 3
add edx, 0x120100
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov qword [r13], rax
cmp rax, 0xffffffffffffffff
jne 0x14004cebf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov edi, 0x80070000
movzx eax, ax
or eax, edi
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14004ce9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004cebf
jmp 0x14004ce9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov r15d, 0x80070000
movzx eax, ax
or eax, r15d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14004cde1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004cb90
jmp 0x14004cde3
mov ebx, ebp
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restoreworker.c
mov r9d, ebx
lea rcx, str.RestoreEncryptedFile
mov r8d, 0x7ec
call fcn.140046874
jmp 0x14004cb88
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov r15d, 0x80070000
movzx eax, ax
or eax, r15d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14004ce4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004cb90
jmp 0x14004ce50
mov ebx, ebp
and qword [rsp + 0x20], 0
mov r8d, 0x7f6
jmp 0x14004cc66
movzx ebx, ax
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14004cc84
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restoreworker.c
mov r9d, ebx
lea rcx, str.RestoreEncryptedFile
mov r8d, 0x83f
call fcn.140046874
jmp 0x14004cc84
mov ebx, ebp
and qword [rsp + 0x20], 0
lea rdx, str.onecore_base_ntsetupopktoolsosimagelibmain_restoreworker.c
mov r9d, ebx
lea rcx, str.RestoreEncryptedFile
mov r8d, 0x880
call fcn.140046874
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret