Function at 0x1400c3ac0
Capabilities:
Check if file exists
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, reloc.MFC80U.DLL_Ordinal_4048
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1000], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0xfc0], rax
mov r13d, r9d
mov rbp, r8
mov rdi, rdx
mov word [rsp + Ordinal_2856], 0
xor edx, edx
lea r8d, [rdx + 0x7e]
lea rcx, [rsp + 0xb22]
call sub.ntdll.dll_memset
mov word [rsp + 0xaa0], 0
xor edx, edx
lea r8d, [rdx + 0x7e]
lea rcx, [rsp + 0xaa2]
call sub.ntdll.dll_memset
mov word [rsp + Ordinal_3505], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xdb2]
call sub.ntdll.dll_memset
mov word [rsp + Ordinal_2984], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xba2]
call sub.ntdll.dll_memset
call fcn.140049400
mov r12, rax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x30]
mov rsi, rax
mov rbx, qword [r12]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x38]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x50]
mov r9d, eax
mov qword [rsp + 0x20], rdi
mov r8d, 0x40
lea rdx, [rsp + 0xb20]
mov rcx, r12
call qword [rbx + 0x58]
test eax, eax
jne 0x1400c3caa
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x140434340]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...opthelp.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x1400c3c04
xor ebx, ebx
jmp 0x1400c3c90
mov byte [rsp + 0xa90], 0
xor eax, eax
mov qword [rsp + 0xa91], rax
mov word [rsp + 0xa99], ax
mov byte [rsp + 0xa9b], al
mov r8d, reloc.MFC80U.DLL_Ordinal_3703
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xa90]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400c3c50
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0xa90]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400c3c80
mov rax, qword [rsi]
mov r8, rbx
lea rdx, [0x1402eb918]
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400c40cf
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x30]
mov rsi, rax
mov rbx, qword [r12]
mov rdx, qword [rbp]
mov rcx, rbp
call qword [rdx + 0x38]
mov rdi, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x50]
mov r9d, eax
mov qword [rsp + 0x20], rdi
mov r8d, 0x40
lea rdx, [rsp + 0xaa0]
mov rcx, r12
call qword [rbx + 0x58]
test eax, eax
jne 0x1400c3d1d
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, Ordinal_3710
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, [0x1402eb918]
mov rcx, rdi
call qword [rsi + 0x10]
lea r8, [rsp + 0xb20]
lea rdx, str.__Volume_sRecovery
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400c3d80
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, 0xe83
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, str._s:_No_search_recovery_folder.
mov rcx, rdi
call qword [rsi + 0x10]
xor eax, eax
jmp 0x1400c40cf
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xdb0]
call sub.ntdll.dll_memset
lea r8, [rsp + 0xb20]
lea rdx, str.__Volume_sRecovery.
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.MSVCR80.dll__swprintf]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_588
lea rcx, [rsp + 0x44]
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
lea r12d, [rbx + 1]
lea rsi, [rsp + 0x6c]
lea rdi, [0x1403b6c40]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1400c3e39
lea rsi, [rsp + 0x6c]
lea rdi, [0x1403b6c44]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1400c3e39
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x6c]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp rcx, 0x24
je 0x1400c3e30
cmp rcx, 9
jb 0x1400c3e39
test byte [rsp + 0x40], 0x10
cmovne ebx, r12d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400c3e4f
test ebx, ebx
je 0x1400c3de4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x1400c3e8f
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, 0xe9b
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, str._s:_Not_found_recovery_ENV.
mov rcx, rdi
call qword [rsi + 0x10]
xor eax, eax
jmp 0x1400c40cf
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xdb0]
call sub.ntdll.dll_memset
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0xb20]
lea rdx, str.__Volume_sRecovery_s
lea rcx, [rsp + 0xdb0]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0x290]
call fcn.140147040
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xba0]
call sub.ntdll.dll_memset
lea r8, [rsp + 0xaa0]
lea rdx, str.__Volume_sRecovery
lea rcx, [rsp + 0xba0]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400c3f81
xor edx, edx
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400c3f6e
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, 0xeb1
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, str._s:_CreateDir_failed.
mov rcx, rdi
call qword [rsi + 0x10]
nop
lea rcx, [rsp + 0x290]
call fcn.140050540
xor eax, eax
jmp 0x1400c40cf
mov edx, 2
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xba0]
call sub.ntdll.dll_memset
test r13d, r13d
je 0x1400c3fc1
lea r9, str.890f989b_7d40_11e2_8053_9b1bda41daaa
lea r8, [rsp + 0xaa0]
lea rdx, str.__Volume_sRecovery_s
lea rcx, [rsp + 0xba0]
call qword [sym.imp.MSVCR80.dll__swprintf]
jmp 0x1400c3fe5
lea r9, str.f7492315_139b_11e3_af14_ce9d489bae23
lea r8, [rsp + 0xaa0]
lea rdx, str.__Volume_sRecovery_s
lea rcx, [rsp + 0xba0]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400c4060
xor edx, edx
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400c404d
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, Ordinal_3787
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, str._s:_CreateDir_failed.
mov rcx, rdi
call qword [rsi + 0x10]
nop
lea rcx, [rsp + 0x290]
call fcn.140050540
xor eax, eax
jmp 0x1400c40cf
mov edx, 2
lea rcx, [rsp + 0xba0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [rsp + 0xba0]
lea rdx, [rsp + 0xdb0]
lea rcx, [rsp + 0x290]
call fcn.1400561e0
test eax, eax
jne 0x1400c40bf
call fcn.140049470
mov rdi, rax
mov rsi, qword [rax]
mov edx, 0xed1
lea rcx, str...opthelp.cpp
call fcn.1400bc810
mov r8, rax
lea rdx, str._s:_Copy_directory_failed.
mov rcx, rdi
call qword [rsi + 0x10]
nop
lea rcx, [rsp + 0x290]
call fcn.140050540
xor eax, eax
jmp 0x1400c40cf
lea rcx, [rsp + 0x290]
call fcn.140050540
mov eax, r12d
mov rcx, qword [rsp + 0xfc0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x1000]
add rsp, reloc.MFC80U.DLL_Ordinal_4048
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret