Function at 0x18000fc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13d, r8d
mov rbx, rcx
mov qword [rsp + 0x78], rcx
mov rax, qword [rcx + 0x210]
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x60], rax
mov rax, qword [rcx + 0x34]
test rax, rax
je 0x18000fc9d
lea rcx, [rsp + 0x58]
test rcx, rcx
je 0x18000fc9d
lea r12, [rax + 0x7f]
mov qword [rsp + 0x58], r12
mov eax, 1
xor esi, esi
jmp 0x18000fca6
xor esi, esi
mov eax, esi
mov r12, qword [rsp + 0x58]
test eax, eax
je 0x180010285
cmp qword [r12 + 0x804], 0
jne 0x18000fcc0
xor eax, eax
jmp 0x18001028a
lea rax, [rsp + 0x60]
test rax, rax
jne 0x18000fcd3
mov eax, esi
mov r14, qword [rsp + 0x60]
jmp 0x18000fcfa
mov edx, 0x6c
xor ecx, ecx
lea r9d, [rdx - 0x68]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x60], rax
mov eax, esi
test r14, r14
setne al
test eax, eax
je 0x180010285
mov edi, dword [rbx + 0x284]
mov dword [rsp + 0x40], edi
mov qword [rbx + 0x284], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov eax, dword [r12]
mov dword [rsp + 0x20], eax
mov r9, qword [rbx + 0x34]
mov r8, qword [rbx + 0x2c]
mov rdx, qword [rbx + 0x24]
mov rcx, r14
call fcn.1800013a0
test eax, eax
je 0x180010251
mov r15d, esi
mov dword [rsp + 0x44], esi
lea rax, str.Performing_raw_and_format_recovery
mov qword [rbx + 0x24c], rax
nop word [rax + rax]
bt dword [rbx + 0x54], 0x1f
jb 0x180010209
cmp edi, r15d
jb 0x18000fda2
mov r8, qword [rbx + 0x34]
cmp qword [r8 + 0x88b], 0
je 0x18000fd98
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x40]
call fcn.1800031c0
mov edi, dword [rsp + 0x40]
mov r15d, dword [rsp + 0x44]
jmp 0x18000fd9a
mov eax, esi
test eax, eax
je 0x180010209
mov eax, edi
and eax, 0x7f
test al, al
jne 0x18000fdc9
xor edx, edx
mov rcx, qword [rbx + 0x24]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18000fdc9
mov eax, edi
mov qword [rbx + 0x284], rax
jmp 0x180010209
mov ecx, edi
mov qword [rbx + 8], rcx
mov eax, dword [rsp + 0x2b8]
sub eax, r13d
imul rax, rcx
xor edx, edx
div qword [r12 + 0x804]
add eax, r13d
mov dword [rbx + 4], eax
mov r13d, dword [r12]
imul r13, rcx
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x4c], esi
mov qword [rbx + 0x240], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
mov r8d, 4
mov rdx, r13
mov rcx, qword [rbx + 0x34]
call fcn.180002c60
test eax, eax
je 0x18000fe53
mov eax, dword [rsp + 0x4c]
cmp eax, 0x454c4946
je 0x18000fe53
cmp eax, 0x2020202e
je 0x18000fe53
mov ecx, 0x105
cmp cx, ax
je 0x18000fe53
mov ecx, 0x101
cmp cx, ax
jne 0x18000fe67
mov rdx, r13
mov rcx, rbx
call qword [rbx + 0x27c]
test eax, eax
jne 0x1800101ec
mov ecx, r15d
sub ecx, edi
imul ecx, dword [r12]
mov qword [r14 + 0x2c], r13
mov qword [r14 + 0x34], rcx
mov qword [r14 + 0x1c], r13
mov qword [r14 + 0x24], rcx
mov dword [r14 + 0x44], esi
mov dword [r14 + 0x48], esi
mov qword [r14 + 0x4c], rsi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x68], rsi
lea rax, [0x18003f204]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.18000f180
test eax, eax
je 0x1800101c6
mov r12d, dword [rsp + 0x50]
test r12d, r12d
je 0x1800101c6
xor al, al
mov byte [rsp + 0x150], al
cmp r12d, 0x2b
jae 0x18000ff16
mov r9, r13
lea r8, str.file__I64d
mov edx, 0x7c
lea rcx, [rsp + 0x150]
call fcn.18002e064
movzx eax, byte [rsp + 0x150]
test al, al
je 0x18001018d
xor edx, edx
mov r8d, 0x93
lea rcx, [rsp + 0xa0]
call fcn.180035040
mov dword [rsp + 0x28], 0x40
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r11d, eax
lea edx, [r12 - 1]
mov qword [rsp + 0x88], rdx
lea rcx, [rsp + r11*2 + 0x1ce]
lea rax, str..wav
mov rdx, qword [rax + rdx*8]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rax, [rbx + 0x88]
cmp qword [rax], 0xffffffffffffffff
jne 0x18000ffbc
lea rcx, [rbx + 0x3c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8, str.Files_by_content
mov rdx, qword [rbx + 0x70]
call fcn.1800174c0
lea r9, [rsp + 0x12b]
mov r8d, 4
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x3c]
call fcn.180017020
test eax, eax
je 0x18001018d
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x1d0]
lea rcx, [rbx + 0x3c]
call fcn.180016f30
test eax, eax
je 0x18001018d
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov r11, qword [rsp + 0xc0]
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xc8], r11
mov eax, 0x8fff
and word [rsp + 0x125], ax
mov dword [rsp + 0x127], 0xffffffff
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0xa8], r15
movzx r8d, byte [rsp + 0x118]
and r8b, 0xfe
mov byte [rsp + 0x118], r8b
mov qword [rsp + 0xf0], 0xffffffffffffffff
mov qword [rsp + 0xf8], 0xffffffffffffffff
mov qword [rsp + 0x100], 0xffffffffffffffff
mov qword [rsp + 0x108], rsi
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax]
lea rax, [rcx + r15 - 1]
xor edx, edx
div rcx
mov ecx, eax
mov qword [rsp + 0x110], rcx
movzx eax, byte [rsp + 0x48]
add al, al
xor al, r8b
and al, 0x3e
xor r8b, al
mov byte [rsp + 0x118], r8b
lea rax, [rbx + r12*8 + 0x90]
mov qword [rsp + 0x90], rax
cmp qword [rax], 0xffffffffffffffff
jne 0x18001012a
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8, qword [rsp + 0x88]
lea rax, str..wav
mov r8, qword [rax + r8*8]
mov rdx, qword [rbx + 0x88]
lea rcx, [rbx + 0x3c]
call fcn.1800174c0
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov qword [rsp + 0xa0], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe8], 0xffffffffffffffff
or byte [rsp + 0x11b], 1
mov rax, qword [rbx + 0x34]
test rax, rax
je 0x180010177
lea rcx, [rsp + 0xb0]
test rcx, rcx
je 0x180010177
mov rax, qword [rax + 0x28]
mov qword [rsp + 0xb0], rax
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rbx + 0x3c]
call fcn.180017150
jmp 0x180010192
mov r15, qword [rsp + 0x68]
cmp r12d, 0x16
jne 0x18001019f
cmp dword [rsp + 0x48], 3
je 0x1800101ab
cmp r12d, 0x22
je 0x1800101ab
cmp r12d, 0x10
jne 0x1800101c6
test r15, r15
je 0x1800101c6
lea rax, [r15 - 1]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx]
xor edx, edx
div rcx
add edi, eax
mov dword [rsp + 0x40], edi
jmp 0x1800101ec
inc edi
mov dword [rsp + 0x40], edi
mov r12, qword [rsp + 0x58]
mov r15d, dword [rsp + 0x44]
mov r13d, dword [rsp + 0x2b0]
jmp 0x18000fd60
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rbx + 0x27c]
cmp qword [rbx + 0x284], 0
jne 0x18001022f
mov rax, qword [r12 + 0x804]
mov qword [rbx + 0x284], rax
mov rax, qword [rbx + 0x210]
mov qword [rbx + 0x68], rax
mov rcx, qword [r14 + 0x3c]
test rcx, rcx
je 0x180010251
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [r14 + 0x60]
test rcx, rcx
je 0x180010274
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [r14 + 0x58], esi
mov dword [r14 + 0x54], esi
mov qword [r14 + 0x60], rsi
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18002d590
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret