Function at 0x180008d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push r13
push r14
sub rsp, 0x90
xor esi, esi
mov rax, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
xor r9d, r9d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov r14d, esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x180008dbd
lea rdx, str.FAT_RecoverFile:_Unable_to_create_recover_file._n
mov rcx, rbx
call fcn.180016b80
xor eax, eax
add rsp, 0x90
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rbx + 0x34]
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], r15
test rcx, rcx
je 0x180008dee
lea rax, [rsp + 0x60]
test rax, rax
je 0x180008dee
lea r12, [rcx + 0x7f]
jmp 0x180008df3
mov r12, qword [rsp + 0x60]
test rcx, rcx
je 0x180008e17
lea rax, [rsp + 0x60]
test rax, rax
je 0x180008e17
mov eax, dword [rcx + 0x87]
mov rdi, qword [rcx + rax*8 + 0x8b]
mov qword [rsp + 0x50], rdi
jmp 0x180008e21
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x50], rdi
mov rdx, qword [rbp + 0x10]
test rcx, rcx
je 0x180008e4c
mov rax, qword [rcx + 0x20]
cmp rax, rdx
jbe 0x180008e4c
mov qword [rcx + 0x18], rax
sub rax, rdx
mov qword [rcx + 0x28], rdx
cmp rax, 0xffffffffffffffff
jbe 0x180008e4c
lea rax, [rdx - 1]
mov qword [rcx + 0x18], rax
mov edx, dword [rdi + 4]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x1800092f9
mov rax, qword [rbp + 0x8b]
mov r13d, esi
mov r14d, dword [rax]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x68], r14d
cmp qword [rbp + 8], rsi
jbe 0x1800092d2
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
nop word [rax + rax]
mov rcx, qword [rbx + 0x24]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1800092cb
cmp r14d, 0xffffffff
je 0x180009013
mov r10, qword [rbx + 0x34]
mov edx, esi
test r10, r10
je 0x180008f0c
lea rax, [rsp + 0x58]
test rax, rax
je 0x180008eec
lea rax, [r10 + 0x7f]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
test rax, rax
je 0x180008f13
mov eax, dword [r10 + 0x87]
mov r11, qword [r10 + rax*8 + 0x8b]
mov qword [rsp + 0x78], r11
jmp 0x180008f18
mov r11, qword [rsp + 0x78]
jmp 0x180008f18
mov r11, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax]
test r8d, r8d
je 0x180008f30
mov eax, dword [r11 + 4]
xor edx, edx
div r8d
mov edx, eax
mov r9d, dword [r11 + 0x14]
mov eax, edx
lea ecx, [r14 - 2]
imul rcx, rax
mov eax, dword [r11 + 0xc]
imul r9d, dword [r11 + 0x10]
add r9, rcx
add r9, rax
cmp dword [r11], 6
mov qword [rsp + 0x58], r9
je 0x180008f6d
mov eax, dword [r11 + 0x18]
xor edx, edx
shl rax, 5
div r8
add r9, rax
mov qword [rsp + 0x58], r9
mov edx, dword [r12]
mov r8d, dword [rdi + 4]
lea rax, [rsp + 0x48]
imul rdx, r9
mov rcx, r10
mov r9, r15
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x18000918f
mov eax, dword [rdi + 4]
cmp dword [rsp + 0x48], eax
jne 0x18000918f
mov r8d, dword [rbp + 8]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
sub r8d, r13d
mov rdx, r15
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], r8d
mov eax, dword [rdi + 4]
cmp r8d, eax
cmova r8d, eax
mov dword [rsp + 0x40], r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000916f
add r13d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xd8]
lea r8, [rsp + 0x68]
mov eax, r13d
mov edx, r14d
mov dword [rsp + 0x6c], r14d
mov qword [rcx], rax
mov rcx, rbx
call fcn.180005770
test eax, eax
je 0x1800091af
mov r14d, dword [rsp + 0x68]
test r14d, r14d
je 0x1800091af
cmp r14d, 0xffffffff
jne 0x180009158
mov rax, qword [rsp + 0x80]
lea rdx, str.FAT_RecoverFile:_restoring_file_found_by_deep_scan._n
mov rcx, rbx
mov rdi, qword [rax + 4]
call fcn.180016b80
mov r11d, r13d
cmp r11, qword [rbp + 8]
jae 0x180009153
nop
mov rcx, qword [rbx + 0x24]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18000914a
mov r8d, dword [r12]
mov rcx, qword [rbx + 0x34]
lea rax, [rsp + 0x48]
mov r9, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x180009124
mov eax, dword [r12]
cmp dword [rsp + 0x48], eax
jne 0x180009124
mov r8d, dword [rbp + 8]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
sub r8d, r13d
mov rdx, r15
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x40], r8d
mov eax, dword [r12]
cmp r8d, eax
cmova r8d, eax
mov rax, qword [rsp + 0xd8]
add r13d, r8d
mov dword [rsp + 0x40], r8d
mov esi, r13d
mov qword [rax], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800090fe
mov eax, dword [r12]
add rdi, rax
cmp rsi, qword [rbp + 8]
jb 0x180009050
mov rdi, qword [rsp + 0x50]
xor esi, esi
jmp 0x180009158
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov rdi, qword [rsp + 0x50]
mov dword [rbx], 0x2000000e
mov dword [rsp + 0x44], 1
xor esi, esi
jmp 0x180009158
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov rdi, qword [rsp + 0x50]
mov dword [rbx], 0x2000000f
mov dword [rsp + 0x44], 1
xor esi, esi
jmp 0x180009158
mov rdi, qword [rsp + 0x50]
xor esi, esi
jmp 0x180009158
mov rdi, qword [rsp + 0x50]
mov eax, r13d
cmp rax, qword [rbp + 8]
jb 0x180008eb0
mov r14d, dword [rsp + 0x44]
jmp 0x1800092e3
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000e
mov r14d, 1
jmp 0x1800092e3
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000f
mov r14d, 1
jmp 0x1800092e3
lea rdx, str.FAT_RecoverFile:_cluster_chain_end__continue_reading_clusters_after_last_cluster_read._n
mov rcx, rbx
call fcn.180016b80
mov eax, r13d
cmp rax, qword [rbp + 8]
jae 0x1800092de
nop dword [rax + rax]
mov rcx, qword [rbx + 0x24]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1800092d7
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rbx + 0x34]
lea r8, [rsp + 0x58]
inc eax
mov edx, eax
mov dword [rsp + 0x6c], eax
call fcn.180004fd0
mov edx, dword [r12]
mov r8d, dword [rdi + 4]
imul rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x34]
lea rax, [rsp + 0x48]
mov r9, r15
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x1800092ae
mov eax, dword [rdi + 4]
cmp dword [rsp + 0x48], eax
jne 0x1800092ae
mov r8d, dword [rbp + 8]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
sub r8d, r13d
mov rdx, r15
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], r8d
mov eax, dword [rdi + 4]
cmp r8d, eax
cmova r8d, eax
mov rax, qword [rsp + 0xd8]
add r13d, r8d
mov dword [rsp + 0x40], r8d
mov edi, r13d
mov qword [rax], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180009291
cmp rdi, qword [rbp + 8]
mov rdi, qword [rsp + 0x50]
jb 0x1800091d0
mov r14d, dword [rsp + 0x44]
jmp 0x1800092e3
lea rdx, str.FAT_RecoverFile:_Error_writing_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000e
mov r14d, 1
jmp 0x1800092e3
lea rdx, str.FAT_RecoverFile:_Error_reading_deleted_file_cluster._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000f
mov r14d, 1
jmp 0x1800092e3
mov r14d, dword [rsp + 0x44]
jmp 0x1800092e3
mov r14d, esi
jmp 0x1800092e3
mov r14d, dword [rsp + 0x44]
jmp 0x1800092e3
mov r14d, dword [rsp + 0x44]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13, qword [rsp + 0x70]
cmp dword [rbp + 0x24], 0
mov r15, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xc0]
je 0x180009327
cmp dword [rbp + 0x2c], 0
je 0x180009327
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x20]
jmp 0x18000932c
xor r8d, r8d
xor edx, edx
lea r9, [rbp + 0x18]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
mov eax, 0
sete al
add rsp, 0x90
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret