Function at 0x180005c4a
Capabilities:
Write file on windows

Disassembly:
jmp 0x180056d60
jmp 0x1800582d0
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 0x2a0]
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
test rsi, rsi
je 0x180057427
cmp qword [rdi + 0x258], 0
je 0x180057427
mov eax, dword [rdi + 0x2c8]
cmp eax, 0x65
je 0x18005741f
cmp qword [rdi + 0x228], 0
jbe 0x18005741f
cmp byte [rdi + 0x251], 0
jne 0x18005741f
xor r15d, r15d
mov qword [rsp + 0x98], r15
mov rcx, rsi
call fcn.180001131
mov r14, rax
mov qword [rsp + 0x30], rax
lea rcx, [rdi + 0x2d0]
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.180004813
test al, al
je 0x18005741f
mov rdx, qword [rsp + 0x98]
mov rcx, rsi
call fcn.180001ded
mov rcx, rsi
call fcn.180001131
mov r12, rax
mov rcx, rsi
call fcn.180002bd0
mov r13, rax
mov r9, qword [rdi + 0x230]
mov r8, qword [rdi + 0x238]
mov rdx, r8
cmp r9, r8
jne 0x180056e9e
cmp byte [rdi + 0x250], r15b
jne 0x180056e9e
imul rcx, r8, 0x38
mov rax, qword [rdi + 0x220]
mov rcx, qword [rcx + rax + 0x10]
sub qword [rdi + 0x240], rcx
mov rax, qword [rdi + 0x228]
dec rax
lea rdx, [r8 + 1]
cmp r8, rax
cmovae rdx, r15
mov qword [rdi + 0x238], rdx
mov eax, dword [rdi + 0x268]
test eax, eax
je 0x180056e9e
dec eax
mov dword [rdi + 0x268], eax
test r9, r9
je 0x180056ea9
imul rcx, r9, 0x38
jmp 0x180056ebf
cmp byte [rdi + 0x250], r15b
je 0x180056eb7
mov rbx, r15
jmp 0x180056ed0
imul rcx, qword [rdi + 0x228], 0x38
mov rax, qword [rdi + 0x220]
mov rbx, qword [rcx + rax - 0x30]
add rbx, qword [rcx + rax - 0x38]
lea rax, [rbx + r13]
cmp rax, qword [rdi + 0x298]
jl 0x180056eff
lfence
mov rbx, r15
mov r9, r12
mov r8, r13
lea rdx, str.WRAPPING_FILE
mov rcx, rdi
call fcn.18000227f
mov rdx, qword [rdi + 0x238]
lea rbp, [rbx + r13]
cmp dword [rdi + 0x268], r15d
jbe 0x180056f96
mov r8, rdx
nop dword [rax]
nop word [rax + rax]
imul r9, r8, 0x38
add r9, qword [rdi + 0x220]
mov rax, qword [r9]
mov rdx, r8
cmp rbx, rax
jg 0x180056f96
cmp rbp, rax
jl 0x180056f96
mov rax, qword [r9 + 0x10]
sub qword [rdi + 0x240], rax
mov rax, qword [rdi + 0x228]
dec rax
cmp r8, rax
jae 0x180056f5b
lea rdx, [r8 + 1]
jmp 0x180056f76
lfence
mov r9, r12
mov r8, r13
lea rdx, str.WRAP_TAIL
mov rcx, rdi
call fcn.18000227f
mov rdx, r15
mov qword [rdi + 0x238], rdx
mov eax, dword [rdi + 0x268]
test eax, eax
je 0x180056f8f
dec eax
mov dword [rdi + 0x268], eax
mov r8, rdx
test eax, eax
jne 0x180056f20
cmp rdx, qword [rdi + 0x228]
jb 0x180056fa6
mov qword [rdi + 0x238], r15
lea rbp, [0x18010070c]
lea r15, [0x180100710]
cmp qword [rdi + 0x240], 0
jge 0x18005701e
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x180056ff9
mov r8, r15
cmp byte [rdi + 0x252], 0
cmovne r8, rbp
mov r9, qword [rdi + 0x240]
lea rdx, str.CircularSampleBuffer::WriteSample__s__Invalid_m_TotalSampleDataSize__lld_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rax, qword [rdi + 0x218]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 0
mov r9d, 0x80004005
xor r8d, r8d
lea edx, [r8 + 0x6c]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov qword [rcx + rax], rbx
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov qword [rcx + rax + 8], r13
mov rcx, rsi
call fcn.180002bd0
add qword [rdi + 0x240], rax
mov rcx, rsi
call fcn.180002bd0
imul rdx, qword [rdi + 0x230], 0x38
mov rcx, qword [rdi + 0x220]
mov qword [rdx + rcx + 0x10], rax
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
cmp byte [rdi + 0x252], 0
je 0x180057092
movzx edx, byte [rsi + 0x3c]
mov byte [rcx + rax + 0x24], dl
jmp 0x180057097
mov byte [rcx + rax + 0x24], 0
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov qword [rcx + rax + 0x28], r12
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov qword [rcx + rax + 0x30], r14
mov edx, dword [rsi + 0x38]
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov dword [rcx + rax + 0x20], edx
imul rdx, qword [rdi + 0x230], 0x38
mov rcx, qword [rdi + 0x220]
mov rax, qword [rdi + 0x260]
mov qword [rdx + rcx + 0x18], rax
inc qword [rdi + 0x260]
mov rax, qword [rdi + 0x248]
cmp qword [rdi + 0x240], rax
jle 0x180057173
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x18005714e
mov r8, r15
cmp byte [rdi + 0x252], 0
cmovne r8, rbp
mov rax, qword [rdi + 0x248]
mov qword [rsp + 0x20], rax
mov r9, qword [rdi + 0x240]
lea rdx, str.CircularSampleBuffer::WriteSample___s__m_TotalSampleDataSize__lld__exceeds_m_MaxSampleDataSize__lld_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rax, qword [rdi + 0x218]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 0
mov r9d, 0x80004005
xor r8d, r8d
lea edx, [r8 + 0x6c]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.180002dd8
mov rcx, rsi
call fcn.180002bd0
mov rbp, rax
mov rcx, rsi
call fcn.180005ab5
mov r14, rax
mov rsi, qword [rdi + 0x258]
cmp byte [rsi + 0x438], 0
je 0x1800571b5
mov rcx, qword [rsi + 0x430]
add rcx, rbx
mov r8, rbp
mov rdx, rax
call fcn.180004de5
jmp 0x180057222
mov qword [rsp + 0xa8], rbx
test r14, r14
je 0x1800572ff
xor r9d, r9d
lea r8, [rsp + 0xac]
mov edx, ebx
mov rcx, qword [rsi + 0x220]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1800572ff
xor eax, eax
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rsi + 0x220]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180057292
mov eax, dword [rsp + 0x90]
cmp rbp, rax
jne 0x180057292
inc dword [rdi + 0x268]
mov byte [rdi + 0x250], 0
mov rcx, qword [rdi + 0x270]
cmp r12, rcx
jle 0x1800573e3
cmp byte [rdi + 0x252], 0
je 0x180057273
test rcx, rcx
jle 0x180057273
mov rax, qword [rdi + 0x280]
cmp rax, qword [rdi + 0x288]
jge 0x180057273
cmp byte [rdi + 0x290], 0
jne 0x180057273
sub rax, rcx
add rax, r12
mov qword [rdi + 0x280], rax
mov byte [rdi + 0x290], 0
mov qword [rdi + 0x270], r12
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x278], rax
jmp 0x1800573e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x1800572d7
mov ecx, dword [rsp + 0x90]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbp
mov r9d, eax
mov r8, rbx
lea rdx, str.DataStorage::WriteAt:_Failed_at_pos___d__errorCode___d__size___d__wasWritten___d
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rax, qword [rsi + 0x218]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r14d
mov edx, 0x6c
mov r9d, 0x80004005
mov r8d, 0x12d
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180057359
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x180057333
mov r9d, eax
mov r8, rbx
lea rdx, str.DataStorage::WriteAt:_Failed_at_pos___d__errorCode___d
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rcx, qword [rsi + 0x218]
mov rcx, qword [rcx]
mov r10, qword [rcx]
mov dword [rsp + 0x20], ebp
mov edx, 0x6c
mov r9d, 0x80004005
mov r8d, 0x12f
call qword [r10 + reloc.OLEAUT32.dll_VariantClear]
mov byte [rdi + 0x251], 1
imul rcx, qword [rdi + 0x230], 0x38
mov rax, qword [rdi + 0x220]
mov qword [rcx + rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180132050], 7
cmp dword [0x18013218c], 7
jg 0x1800573c2
cmp byte [rdi + 0x252], 0
lea rax, [0x18010070c]
cmovne r15, rax
mov r9, qword [rdi + 0x230]
mov r8, r15
lea rdx, str.CircularSampleBuffer::WriteSample:___s__Failed_to_write_SampleNo__d_
lea rcx, vtable.CLogger.0
call fcn.1800024fa
mov rax, qword [rdi + 0x218]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov dword [rsp + 0x20], ebx
mov r9d, 0x80004005
xor r8d, r8d
lea edx, [r8 + 0x6c]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.180002dd8
inc qword [rdi + 0x230]
mov rax, qword [rdi + 0x230]
cmp rax, qword [rdi + 0x228]
jb 0x18005741f
mov r9, r12
mov r8, r13
lea rdx, str.WRAPPING_HEAD
mov rcx, rdi
call fcn.18000227f
mov qword [rdi + 0x230], 0
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp edx, 3
jge 0x1800582f0
lfence
movsxd rax, edx
mov rcx, qword [rcx + rax*8 + 0x220]
test rcx, rcx
je 0x1800582f0
mov rdx, r8
jmp 0x180003e86
ret