Function at 0x100004704
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2f8
mov rax, qword [0x100011100]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rcx
xor eax, eax
xor ebx, ebx
repne scasw ax, word [rdi]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x50], r8d
not rcx
mov rsi, rdx
mov qword [rsp + 0x68], rdx
lea rbp, [rcx - 1]
lea rdi, [rcx + rcx + 0x20a]
mov dword [rsp + 0x54], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
lea edi, [rbx + 8]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
cmp rax, rbx
jne 0x100004787
mov esi, ebx
jmp 0x100004dcf
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rsi, [rcx - 1]
lea rdi, [rcx + rcx + 0x20a]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edi, 8
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
xor eax, eax
cmp rbx, rax
jne 0x1000047cc
mov esi, eax
jmp 0x100004d88
mov r9, qword [rsp + 0x60]
lea rdx, [rbp + 0x106]
mov rbp, qword [rsp + 0x48]
lea r8, [0x100002270]
mov rcx, rbp
call fcn.100003b30
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea r8, [0x100002270]
lea rdx, [rsi + 0x106]
repne scasw ax, word [rdi]
not rcx
lea rax, [rbp + rcx*2 - 2]
mov rbp, qword [rsp + 0x68]
mov rcx, rbx
mov r9, rbp
mov qword [rsp + 0x58], rax
call fcn.100003b30
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov edx, 0x105
repne scasw ax, word [rdi]
lea rdi, [0x100002278]
not rcx
lea rax, [rbx + rcx*2 - 2]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
sub rdi, rax
xor esi, esi
mov rcx, rax
lea rax, [rdx + 0x7ffffef9]
cmp rax, rsi
je 0x100004877
movzx eax, word [rdi + rcx]
cmp ax, si
je 0x100004877
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100004855
xor edi, edi
cmp rdx, rdi
jne 0x100004882
sub rcx, 2
mov word [rcx], di
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x1000048d5
mov rcx, rbp
call fcn.100007d8c
mov esi, eax
cmp eax, edi
jne 0x1000048d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100002280]
mov r8, rbx
mov r9d, eax
mov ecx, 4
mov edi, eax
call fcn.100006a9c
jmp 0x100004d88
cmp dword [rsp + 0x340], edi
je 0x100004902
lea r8, [0x100002040]
xor edx, edx
mov rcx, rbp
call fcn.10000653c
mov esi, eax
cmp eax, edi
jne 0x100004902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100004d88
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10000495a
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x100004929
cmp eax, 0x20
je 0x100004929
cmp eax, 0x21
jne 0x100004931
mov rcx, rbp
call fcn.100005ca4
mov r8, rbp
cmp edi, 2
je 0x100004947
lea rdx, [0x100002610]
mov ecx, 3
jmp 0x1000049ad
lea rdx, [0x100002670]
mov ecx, 2
call fcn.100006a9c
jmp 0x1000049b5
and eax, 0x3120
bts eax, 7
cmp eax, 0x80
je 0x10000496e
btr eax, 7
mov edx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp eax, edi
jne 0x1000049bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x100004996
cmp eax, 0x20
je 0x100004996
cmp eax, 0x21
jne 0x10000499e
mov rcx, rbp
call fcn.100005ca4
mov r8, rbp
lea rdx, [0x1000026d0]
mov ecx, 4
mov r9d, edi
call fcn.100006a9c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
je 0x1000048f5
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
lea rdi, [rsp + 0xbc]
sub rdi, r8
lea rsi, [rsp + 0xbc]
sub rsi, r9
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], rsi
jmp 0x1000049fb
mov rsi, qword [rsp + 0x78]
xor r10d, r10d
mov edx, 0x105
mov rcx, r8
lea r11d, [r10 + 2]
lea rax, [rdx + 0x7ffffef9]
cmp rax, r10
je 0x100004a2c
movzx eax, word [rdi + rcx]
cmp ax, r10w
je 0x100004a2c
mov word [rcx], ax
add rcx, r11
sub rdx, 1
jne 0x100004a0a
xor edi, edi
cmp rdx, rdi
jne 0x100004a36
sub rcx, r11
mov word [rcx], di
mov edx, 0x105
mov rcx, r9
lea rax, [rdx + 0x7ffffef9]
cmp rax, rdi
je 0x100004a62
movzx eax, word [rsi + rcx]
cmp ax, di
je 0x100004a62
mov word [rcx], ax
add rcx, r11
sub rdx, 1
jne 0x100004a41
cmp rdx, rdi
jne 0x100004a6a
sub rcx, r11
mov word [rcx], di
test byte [rsp + 0x90], 0x10
je 0x100004b14
lea rsi, [rsp + 0xbc]
lea rdi, [0x1000022d4]
mov rcx, r11
repe cmpsw word [rsi], word [rdi]
je 0x100004d14
lea rsi, [rsp + 0xbc]
lea rdi, [0x1000022d8]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x100004d14
mov rdi, qword [rsp + 0x48]
lea rdx, [0x1000022e0]
mov r9, rbx
mov r8, rdi
mov ecx, r11d
call fcn.100006a9c
mov eax, dword [rsp + 0x350]
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x348]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x340]
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.100004704
xor edi, edi
mov esi, eax
cmp eax, edi
je 0x100004d4b
jmp 0x100004d16
cmp dword [rsp + 0x348], edi
je 0x100004b6f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 4
jb 0x100004b55
mov eax, ecx
lea rdx, [0x100002588]
lea rcx, [r8 + rax*2 - 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
xor edi, edi
cmp eax, edi
je 0x100004b6f
mov r8, qword [rsp + 0x58]
jmp 0x100004b57
xor edi, edi
lea rdx, [0x100002598]
mov rcx, r8
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, edi
jne 0x100004d16
cmp dword [rsp + 0x40], edi
je 0x100004b9b
lea r8, [0x100001bc0]
xor edx, edx
mov rcx, rbx
call fcn.10000653c
mov esi, eax
cmp eax, edi
jne 0x100004b9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100004d47
cmp dword [rsp + 0x350], edi
jne 0x100004bba
mov r8d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.100004fa8
cmp eax, edi
je 0x100004c19
xor eax, eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r9d, 4
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x14]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov edi, 5
test eax, eax
mov ecx, 1
cmovns edi, dword [rsp + 0x68]
call fcn.100006004
mov rcx, qword [rsp + 0x48]
mov rdx, rbx
call fcn.100004dfc
mov ecx, edi
mov esi, eax
call fcn.100006004
xor edi, edi
cmp esi, edi
je 0x100004d4b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x100004d16
test al, 0x50
jne 0x100004d16
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
jne 0x100004c8c
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x100004c5b
cmp eax, 0x20
je 0x100004c5b
cmp eax, 0x21
jne 0x100004c63
mov rcx, rbx
call fcn.100005ca4
mov r8, rbx
cmp edi, 2
je 0x100004c79
lea rdx, [0x100002610]
mov ecx, 3
jmp 0x100004cdf
lea rdx, [0x100002670]
mov ecx, 2
call fcn.100006a9c
jmp 0x100004ce7
and eax, 0x3120
bts eax, 7
cmp eax, 0x80
je 0x100004ca0
btr eax, 7
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
cmp eax, edi
jne 0x100004cf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x100004cc8
cmp eax, 0x20
je 0x100004cc8
cmp eax, 0x21
jne 0x100004cd0
mov rcx, rbx
call fcn.100005ca4
mov r8, rbx
lea rdx, [0x1000026d0]
mov ecx, 4
mov r9d, edi
call fcn.100006a9c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
je 0x100004d4b
cmp dword [rsp + 0x40], edi
je 0x100004d16
lea r8, [0x100001bc0]
mov edx, 1
mov rcx, rbx
call fcn.10000653c
jmp 0x100004b05
xor edi, edi
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
cmp eax, edi
mov rdi, qword [rsp + 0x80]
mov esi, eax
jne 0x1000049f6
xor edi, edi
cmp esi, edi
jne 0x100004d5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000048f5
lea esi, [rax - 0x11]
cmp dword [rsp + 0x340], edi
je 0x100004d84
lea r8, [0x100002040]
mov edx, 1
mov rcx, rbp
call fcn.10000653c
mov esi, eax
cmp eax, edi
je 0x1000048f5
mov edi, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x100004db7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x70]
cmp rax, 0xffffffffffffffff
je 0x100004dcb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x100004dd7
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10000a2e0
add rsp, 0x2f8
pop rdi
pop rsi
pop rbp
pop rbx
ret