Function at 0x1800132b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rdi, r8
mov r8, rdx
mov r12, rcx
xor r15d, r15d
mov r13, r15
mov qword [rsp + 0x60], r15
mov dword [rsp + 0xc0], r15d
mov qword [rsp + 0x30], r15
mov r14d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov r10, qword [rcx + 0x34]
test r10, r10
je 0x180013328
lea rax, [rsp + 0x38]
test rax, rax
je 0x180013328
mov eax, dword [r10 + 0x87]
mov rsi, qword [r10 + rax*8 + 0x8b]
mov qword [rsp + 0x50], rsi
jmp 0x180013332
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x38]
mov rcx, r8
call fcn.180004a00
test eax, eax
je 0x18001342e
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x18001342e
mov edx, dword [rsi + 4]
mov rbx, rdx
imul rbx, rax
cmp rbx, qword [rdi + 8]
jbe 0x180013369
mov rbx, qword [rdi + 8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18001341b
test rbx, rbx
je 0x180013400
mov r14, qword [rsp + 0xe0]
nop word [rax + rax]
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, dword [rsi + 4]
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800133ea
lea rdx, str.NTFS_RecoverCompressed:_Destination_file_write_error._n
mov rcx, r12
call fcn.180016b80
mov dword [r12], 0x2000000e
mov dword [rsp + 0xc0], 1
mov eax, dword [rsi + 4]
add r13, rax
mov qword [r14], r13
cmp r13, rbx
jb 0x1800133a0
mov qword [rsp + 0x60], r13
mov r14d, r15d
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0xd0]
jmp 0x18001342e
mov dword [rsp + 0xc0], 1
mov rdi, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x50]
nop dword [rax]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xc8]
call fcn.180004850
test eax, eax
je 0x18001381b
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x18001381b
cmp r13, qword [rdi + 8]
jae 0x18001381b
xor edx, edx
mov rcx, qword [r12 + 0x24]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18001381b
mov r13d, r14d
mov eax, dword [rbx + 4]
lea edi, [r14 + rax]
mov edx, edi
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800134ba
mov eax, r15d
mov rcx, qword [rsp + 0x30]
jmp 0x18001351e
test r14d, r14d
je 0x1800134e0
mov rcx, rax
mov r8, qword [rsp + 0x30]
sub r8, rax
mov edx, r14d
nop dword [rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1800134d0
mov r8d, edi
sub r8d, r14d
mov ecx, r14d
add rcx, rbx
xor edx, edx
call fcn.180035040
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18001350e
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
mov qword [rsp + 0x30], rbx
mov r14d, edi
mov eax, 1
test eax, eax
jne 0x180013536
lea rdx, str.NTFS_RecoverCompressed:_Unable_to_resize_memory_block._n
mov rcx, r12
call fcn.180016b80
jmp 0x18001381b
lea rax, [rsp + 0x38]
test rax, rax
jne 0x18001354f
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
jmp 0x180013560
mov rbx, qword [rsp + 0x50]
mov edi, dword [rbx + 4]
imul rdi, rsi
mov eax, 1
test eax, eax
jne 0x180013578
lea rdx, str.NTFS_RecoverCompressed:_NTFS_ClusterNoToOffset_error._n
mov rcx, r12
call fcn.180016b80
jmp 0x18001381b
add rdi, qword [rbx + 0x24]
mov qword [rsp + 0x58], rdi
lea r9, [rcx + r13]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov rcx, qword [r12 + 0x34]
call fcn.180002c60
test eax, eax
je 0x1800135ad
mov eax, dword [rbx + 4]
cmp dword [rsp + 0x68], eax
je 0x1800135cf
lea rdx, str.NTFS_RecoverCompressed:_Unable_to_read_source_drive._n
mov rcx, r12
call fcn.180016b80
mov dword [r12], 0x2000000f
mov dword [rsp + 0xc0], 1
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0xc8]
call fcn.180004a00
mov rsi, qword [rsp + 0x38]
test rsi, rsi
jne 0x18001360c
mov eax, dword [rbx + 4]
shl eax, 4
cmp r14d, eax
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0xd0]
jb 0x180013440
mov edi, dword [rbx + 4]
imul edi, esi
add edi, r14d
mov edx, edi
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18001363f
mov eax, r15d
mov ebx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x48]
jmp 0x1800136ab
mov r9d, dword [rsp + 0x44]
test r9d, r9d
je 0x180013670
mov rcx, rax
mov r8, qword [rsp + 0x48]
sub r8, rax
mov rdx, r9
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x180013660
mov r8d, edi
sub r8d, r9d
lea rcx, [rbx + r9]
xor edx, edx
call fcn.180035040
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18001369c
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r10, rbx
mov qword [rsp + 0x48], rbx
mov ebx, edi
mov eax, 1
test eax, eax
jne 0x1800136c3
lea rdx, str.NTFS_RecoverCompressed:_Unable_to_resize_memory_block._n
mov rcx, r12
call fcn.180016b80
jmp 0x18001381b
test rsi, rsi
je 0x18001370d
mov r9d, r14d
mov rsi, qword [rsp + 0x30]
mov r8, rsi
mov edx, ebx
mov rcx, r10
call fcn.180013000
test eax, eax
je 0x18001370b
lea rdx, str.NTFS_RecoverCompressed:_NTFS_Decompress_error._n
mov rcx, r12
call fcn.180016b80
mov ecx, 0x20000010
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
mov dword [rsp + 0xc0], eax
mov dword [rsp + 0x6c], eax
jmp 0x180013747
mov eax, ebx
cmp r14d, ebx
cmovb eax, r14d
test eax, eax
je 0x180013742
mov rcx, r10
mov rsi, qword [rsp + 0x30]
mov r8, rsi
sub r8, r10
mov edx, eax
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x180013730
jmp 0x180013747
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 8]
mov r13, qword [rsp + 0x60]
sub rax, r13
movabs rcx, 0xffffffff00000000
test rcx, rax
jne 0x18001376f
cmp ebx, eax
cmova ebx, eax
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800137c0
lea rdx, str.NTFS_RecoverCompressed:_Destination_file_write_error._n
mov rcx, r12
call fcn.180016b80
mov ecx, 0x2000000e
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0xc0], 1
mov eax, ebx
add r13, rax
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0xe0]
mov qword [rax], r13
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x30], r15
mov r14d, r15d
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0xd0]
jmp 0x180013440
mov eax, dword [rsp + 0xc0]
test eax, eax
sete r15b
mov eax, r15d
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret