Function at 0x1800050e0
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r12, r9
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x58], r15
mov rcx, qword [rcx + 0x34]
test rcx, rcx
je 0x180005136
lea rax, [rsp + 0x70]
test rax, rax
je 0x180005136
lea r13, [rcx + 0x7f]
mov qword [rsp + 0x70], r13
jmp 0x18000513b
mov r13, qword [rsp + 0x70]
lea rdx, [rsp + 0x48]
call fcn.180001d60
or r8, 0xffffffffffffffff
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rbx + 0x34]
call fcn.180002590
mov rax, qword [rsp + 0x48]
mov edx, dword [rax + 4]
xor ecx, ecx
lea r9d, [r8 + 5]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18000567f
mov rcx, qword [r14 + 0x8b]
mov qword [rsp + 0x90], rcx
mov eax, r15d
mov dword [rsp + 0x34], eax
mov edx, dword [rcx]
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x40], edx
mov qword [r12], r15
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x54], ecx
nop word [rax + rax]
mov r12d, eax
cmp r12, qword [r14 + 8]
jae 0x18000566e
xor edx, edx
mov rcx, qword [rbx + 0x24]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18000566e
mov eax, dword [rsp + 0x50]
cmp eax, 0xffffffff
je 0x18000535c
lea r8, [rsp + 0x70]
mov edx, eax
mov rcx, qword [rbx + 0x34]
call fcn.180004fd0
mov edx, dword [r13]
imul rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 4]
mov rcx, qword [rbx + 0x34]
call fcn.180002c60
test eax, eax
je 0x180005339
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + 4]
cmp dword [rsp + 0x3c], eax
jne 0x180005339
mov ecx, dword [r14 + 8]
mov r12d, dword [rsp + 0x34]
sub ecx, r12d
mov dword [rsp + 0x30], ecx
mov eax, dword [rdx + 4]
cmp ecx, eax
cmova ecx, eax
mov dword [rsp + 0x30], ecx
test r15d, r15d
je 0x1800052b0
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov r8d, ecx
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800052ac
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000e
mov edi, 1
mov dword [rsp + 0x38], edi
jmp 0x18000566e
mov ecx, dword [rsp + 0x30]
mov r8d, ecx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
add rcx, rax
mov rdx, rsi
call fcn.18002dae0
mov r11d, dword [rsp + 0x30]
add r12d, r11d
mov dword [rsp + 0x34], r12d
mov rcx, qword [rsp + 0x58]
add rcx, r11
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x60]
sub rcx, r11
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0xe8]
mov qword [rax], r12
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x78], edx
lea r8, [rsp + 0x40]
mov rcx, rbx
call fcn.180005770
test eax, eax
jne 0x18000532f
mov eax, r15d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x40], eax
jmp 0x18000535c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
jmp 0x18000535c
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000f
mov edi, 1
mov dword [rsp + 0x38], edi
jmp 0x18000566e
test eax, eax
jne 0x1800054e4
lea rdx, str.FAT_RecoverFile:_cluster_chain_end__continue_reading_clusters_after_last_cluster_read._n
mov rcx, rbx
call fcn.180016b80
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x40], eax
nop dword [rax + rax]
cmp r12, qword [r14 + 8]
jae 0x18000566e
xor edx, edx
mov rcx, qword [rbx + 0x24]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18000566e
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x70]
mov edx, eax
mov rcx, qword [rbx + 0x34]
call fcn.180004fd0
mov edx, dword [r13]
imul rdx, qword [rsp + 0x70]
mov qword [rsp + 0x80], rdx
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax + 4]
mov rcx, qword [rbx + 0x34]
call fcn.180002c60
test eax, eax
je 0x1800054c1
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + 4]
cmp dword [rsp + 0x3c], eax
jne 0x1800054c1
mov ecx, dword [r14 + 8]
mov r12d, dword [rsp + 0x34]
sub ecx, r12d
mov dword [rsp + 0x30], ecx
mov eax, dword [rdx + 4]
cmp ecx, eax
cmova ecx, eax
mov dword [rsp + 0x30], ecx
mov r8d, ecx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
add rcx, rax
mov rdx, rsi
call fcn.18002dae0
mov r8d, dword [rsp + 0x30]
add r12d, r8d
mov dword [rsp + 0x34], r12d
mov rcx, qword [rsp + 0x58]
add rcx, r8
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x60]
sub rcx, r8
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0xe8]
mov qword [rax], r12
test r15d, r15d
je 0x1800054bc
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800054bc
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000e
mov edi, 1
mov dword [rsp + 0x38], edi
jmp 0x18000566e
jmp 0x180005380
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000f
mov edi, 1
mov dword [rsp + 0x38], edi
jmp 0x18000566e
cmp eax, 0xffffffff
jne 0x180005665
mov rax, qword [rsp + 0x90]
mov rsi, qword [rax + 4]
mov qword [rsp + 0x80], rsi
lea rdx, str.FAT_RecoverFile:_restoring_file_found_by_deep_scan._n
mov rcx, rbx
call fcn.180016b80
cmp r12, qword [r14 + 8]
jae 0x180005660
xor edx, edx
mov rcx, qword [rbx + 0x24]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180005659
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x68]
mov r9, r12
mov r8d, dword [r13]
mov rdx, rsi
mov rcx, qword [rbx + 0x34]
call fcn.180002c60
test eax, eax
je 0x180005636
mov eax, dword [r13]
cmp dword [rsp + 0x3c], eax
jne 0x180005636
mov ecx, dword [r14 + 8]
sub ecx, dword [rsp + 0x34]
mov dword [rsp + 0x30], ecx
mov eax, dword [r13]
cmp ecx, eax
cmova ecx, eax
mov dword [rsp + 0x30], ecx
mov r8d, ecx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xf0]
add rcx, rax
mov rdx, r12
call fcn.18002dae0
mov r8d, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
add ecx, r8d
mov dword [rsp + 0x34], ecx
mov rdx, qword [rsp + 0x58]
add rdx, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x88], rdx
mov rdx, qword [rsp + 0x60]
sub rdx, r8
mov qword [rsp + 0x60], rdx
mov r12d, ecx
mov rax, qword [rsp + 0xe8]
mov qword [rax], r12
test r15d, r15d
je 0x180005622
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180005622
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000e
mov edi, 1
mov dword [rsp + 0x38], edi
mov rsi, qword [rsp + 0x68]
jmp 0x180005665
mov eax, dword [r13]
add rsi, rax
mov qword [rsp + 0x80], rsi
jmp 0x180005510
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000f
mov edi, 1
mov dword [rsp + 0x38], edi
mov rsi, r12
jmp 0x180005665
mov rsi, qword [rsp + 0x68]
jmp 0x180005665
mov rsi, qword [rsp + 0x68]
mov eax, dword [rsp + 0x34]
jmp 0x1800051c0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15d, r15d
je 0x1800056ca
cmp dword [r14 + 0x24], 0
je 0x1800056ab
cmp dword [r14 + 0x2c], 0
je 0x1800056ab
lea r9, [r14 + 0x18]
lea r8, [r14 + 0x28]
lea rdx, [r14 + 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1800056bf
lea r9, [r14 + 0x18]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800056d3
test edi, edi
sete r15b
mov eax, r15d
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret