Function at 0x140003fec
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov rax, qword [0x140036068]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rsp + 0x70], r8
mov r13, rdx
mov qword [rbp - 0x78], rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor edx, edx
mov r8d, 0x250
mov dword [rsp + 0x58], r9d
lea rcx, [rbp - 0x70]
call sub.msvcrt.dll_memset
xor esi, esi
or r15, 0xffffffffffffffff
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x50], r15
mov rdi, r15
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140004055
add rdi, 0x106
lea rbx, [rdi + rdi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov ebx, 8
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
jne 0x140004094
mov r14d, ebx
mov edi, esi
jmp 0x140004489
inc r15
cmp word [r13 + r15*2], si
jne 0x140004094
add r15, 0x106
lea rbx, [r15 + r15]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov ebx, 8
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
xor eax, eax
test rsi, rsi
jne 0x1400040d7
mov r14d, ebx
mov edi, eax
jmp 0x140004444
mov r9, qword [rsp + 0x60]
lea r8, [0x1400265a0]
mov rdx, rdi
mov rcx, r12
call fcn.140002eac
or rax, 0xffffffffffffffff
xor edi, edi
inc rax
cmp word [r12 + rax*2], di
jne 0x1400040f4
lea rbx, [r12 + rax*2]
mov r9, r13
lea r8, [0x1400265a0]
mov qword [rsp + 0x78], rbx
mov rdx, r15
mov rcx, rsi
call fcn.140002eac
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140004120
lea rax, [rsi + rax*2]
mov edx, 0x105
mov qword [rbp - 0x80], rax
lea rcx, [0x1400265a8]
mov rax, qword [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x70], rcx
mov r8, rcx
mov rcx, rbx
call fcn.1400019b8
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x50], rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400041b7
test r13, r13
je 0x140004185
mov rcx, r13
call fcn.14000df28
mov edi, eax
jmp 0x140004190
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1400041b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, str.Error_creating__s_path__Last_Error___x
mov r9d, eax
lea ecx, [rdi + 4]
mov r14d, eax
call fcn.14000b134
jmp 0x140004449
mov r15d, dword [rbp + 0x268]
test r15d, r15d
je 0x1400041e8
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
xor edx, edx
mov rcx, r13
call fcn.14000b588
mov edi, eax
test eax, eax
jne 0x1400041e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x140004449
mov edx, 0x80
mov rcx, r13
call fcn.140004d00
mov edi, eax
xor eax, eax
test edi, edi
je 0x1400041da
mov r14d, dword [rbp + 0x260]
mov r13, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
lea r8, [rbp - 0x44]
mov rcx, rdi
mov edx, 0x105
call fcn.1400019b8
mov rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x44]
mov edx, 0x105
call fcn.1400019b8
test byte [rbp - 0x70], 0x10
je 0x1400042c2
mov edx, dword [rbp + 0x280]
xor r8d, r8d
test edx, edx
je 0x1400043eb
movzx ecx, word [rbp - 0x44]
cmp cx, word [0x140026604]
movzx eax, word [rbp - 0x42]
jne 0x14000426a
cmp ax, word [0x140026606]
je 0x1400043eb
cmp cx, word [0x140026608]
jne 0x14000428d
cmp ax, word [0x14002660a]
jne 0x14000428d
movzx eax, word [rbp - 0x40]
cmp ax, word [0x14002660c]
je 0x1400043eb
mov eax, dword [rbp + 0x270]
mov rcx, r12
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], edx
mov rdx, rsi
mov dword [rsp + 0x38], r8d
mov r8, r13
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
call fcn.140003fec
jmp 0x1400043e5
xor ecx, ecx
cmp dword [rbp + 0x270], ecx
je 0x140004311
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], cx
jne 0x1400042d0
cmp eax, 4
jb 0x1400042f9
mov eax, eax
lea rdx, str..mui
add rax, 0xfffffffffffffffc
lea rcx, [rdi + rax*2]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140004311
lea rdx, str.bootfix.bin
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400043eb
test r14d, r14d
je 0x14000433c
lea r8, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
xor edx, edx
mov rcx, rsi
call fcn.14000b588
mov edi, eax
test eax, eax
jne 0x14000433c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140004404
mov r8d, dword [rsp + 0x58]
mov rdx, rsi
mov rcx, r12
call fcn.1400047b4
xor ecx, ecx
test eax, eax
je 0x1400043a7
mov dword [rsp + 0x60], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edi, edi
lea r8, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 4]
lea edx, [rdi + 0x18]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
lea ebx, [rdi + 5]
lea ecx, [rdi + 1]
cmovns ebx, dword [rsp + 0x60]
call fcn.140002560
mov rdx, rsi
mov rcx, r12
call fcn.1400044c0
mov ecx, ebx
mov edi, eax
call fcn.140002560
test edi, edi
je 0x140004404
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400043eb
test al, 0x50
jne 0x1400043eb
mov edx, 0x80
mov rcx, rsi
call fcn.140004d00
mov edi, eax
test eax, eax
je 0x140004404
test r14d, r14d
je 0x1400043eb
lea r8, str.O:_sG:_sD:P_A__FA____s__A__GRGX___BA__A__GRGX___SY__A__GRGX___BU_S:_AU_FASA_0x000D0116___WD_
mov edx, 1
mov rcx, rsi
call fcn.14000b588
mov edi, eax
test eax, eax
je 0x140004404
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, eax
xor eax, eax
test edi, edi
jne 0x140004209
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, dword [rsp + 0x68]
mov r13, qword [rbp - 0x78]
cmp eax, 0x12
jne 0x14000443b
mov eax, 1
mov edi, eax
test r15d, r15d
je 0x140004444
lea r8, str.O:_sG:_sD:P_A_CI_GA____s__A__0x1201bf___SY__A_IOCIOI_GA___SY__A__0x1201bf___BA__A_IOCIOI_GA___BA__A_CIOI_GRGX___BU__A_OICIIO_GA___CO_
mov edx, eax
mov rcx, r13
call fcn.14000b588
mov edi, eax
test eax, eax
jne 0x140004444
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140004476
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, 0xffffffffffffffff
je 0x140004485
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
jne 0x140004492
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14001fbe0
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret