Function at 0x403470
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x548
mov rax, qword [0x0042baf8]
mov qword [rsp + 0x500], rax
mov qword [r11 - 8], rsi
mov rsi, rcx
mov qword [r11 - 0x18], r12
mov ecx, 0x40000
mov qword [r11 - 0x30], r15
mov qword [rsp + 0xd8], rdx
mov byte [rsp + 0xf0], 1
mov byte [rsp + 0xf1], 2
mov byte [rsp + 0xf2], 4
mov byte [rsp + 0xf3], 8
mov byte [rsp + 0xf4], 0x10
mov byte [rsp + 0xf5], 0x20
mov byte [rsp + 0xf6], 0x40
mov byte [rsp + 0xf7], 0x80
call fcn.00410900
lea rcx, [rsp + 0xe0]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor r12d, r12d
test eax, eax
jne 0x403522
mov qword [rsp + 0x98], r12
jmp 0x403545
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0xc4]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsi + 0x28]
lea r9, [rsp + 0xd0]
mov r8d, 0x200
mov rdx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4035a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x100]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
xor edx, edx
lea r9, [rsp + 0x100]
lea ecx, [rdx + 2]
lea r8, str.Error_while_reading_bootblock:__s
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
xor eax, eax
jmp 0x4039d6
movabs rax, 0x202020205346544e
cmp qword [r15 + 3], rax
je 0x4035d8
xor edx, edx
lea r8, str.Bad_cookie._This_is_not_an_NTFS_disk.
lea ecx, [rdx + 2]
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
xor eax, eax
jmp 0x4039d6
movzx eax, word [r15 + 0xb]
mov qword [rsi + 0x118], rax
movzx eax, byte [r15 + 0xd]
mov qword [rsi + 0x120], rax
movzx eax, byte [r15 + 0x15]
mov qword [rsi + 0x128], rax
movzx eax, word [r15 + 0x18]
mov qword [rsi + 0x130], rax
movzx eax, word [r15 + 0x1a]
mov qword [rsi + 0x138], rax
mov rax, qword [r15 + 0x28]
mov qword [rsi + 0x140], rax
mov rax, qword [r15 + 0x30]
mov qword [rsi + 0x148], rax
mov rax, qword [r15 + 0x38]
mov qword [rsi + 0x150], rax
mov ecx, dword [r15 + 0x40]
cmp ecx, 0x80
jb 0x40365c
mov eax, 0x100
mov edx, 1
sub eax, ecx
movzx ecx, al
shl rdx, cl
mov qword [rsi + 0x158], rdx
jmp 0x403676
mov rax, rcx
imul rax, qword [rsi + 0x120]
imul rax, qword [rsi + 0x118]
mov qword [rsi + 0x158], rax
mov eax, dword [r15 + 0x44]
xor edx, edx
lea r8, str.__Disk_cookie:__I64X
mov qword [rsi + 0x160], rax
mov rax, qword [r15 + 0x48]
lea ecx, [rdx + 2]
mov qword [rsi + 0x168], rax
mov r9, qword [r15 + 3]
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x118]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__BytesPerSector:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x140]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__TotalSectors:__I64u
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x120]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__SectorsPerCluster:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x130]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__SectorsPerTrack:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x138]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__NumberOfHeads:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x148]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__MftStartLcn:__I64u
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x150]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__Mft2StartLcn:__I64u
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x158]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__BytesPerMftRecord:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x160]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__ClustersPerIndexRecord:__lu
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x128]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__MediaType:__X
call qword [rsi + 0x298]
mov r9, qword [rsi + 0x168]
xor edx, edx
lea ecx, [rdx + 2]
lea r8, str.__VolumeSerialNumber:__I64X
call qword [rsi + 0x298]
mov r11, qword [rsi + 0x120]
mov r8d, dword [rsi + 0x158]
imul r11, qword [rsi + 0x148]
mov rcx, qword [rsi + 0x28]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0x50]
imul r11, qword [rsi + 0x118]
mov dword [rsp + 0xb0], r11d
shr r11, 0x20
mov rdx, r15
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xb4], r11d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4043ac
mov r8, qword [rsi + 0x158]
mov eax, dword [rsp + 0x50]
cmp rax, r8
jne 0x4043ac
mov rdx, r15
mov rcx, rsi
call fcn.004013f0
test eax, eax
je 0x4043db
mov rax, qword [rsi + 0x158]
mov qword [rsp + 0x560], rbx
mov qword [rsp + 0x568], rbp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x538], rdi
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x528], r13
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x88], r12
call fcn.00402f40
test eax, eax
je 0x40438b
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x40438b
mov r13, qword [rsp + 0x90]
test r13, r13
je 0x40438b
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x40438b
mov rbp, qword [rsp + 0x70]
test rbp, rbp
je 0x40438b
xor edx, edx
lea r8, str.MftDataBytes___I64u__MftBitmapBytes___I64u
mov r9, r13
lea ecx, [rdx + 6]
mov qword [rsp + 0x20], rbp
call qword [rsi + 0x298]
xor edx, edx
lea r8, str.Reading__MFT::_BITMAP_into_memory
lea ecx, [rdx + 6]
call qword [rsi + 0x298]
mov r11, r12
mov rcx, r12
mov rdx, rbx
cmp qword [rdx], 0xffffffffffffffff
je 0x403961
mov rax, qword [rdx + 8]
sub rax, r11
imul rax, qword [rsi + 0x120]
imul rax, qword [rsi + 0x118]
add rcx, rax
mov r11, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x403941
cmp rcx, rbp
mov qword [rsp + 0x520], r14
cmovb rcx, rbp
call fcn.00410900
test rax, rax
mov r14, rax
mov qword [rsp + 0x80], rax
jne 0x403a03
xor edx, edx
lea r8, str.Error:_malloc___returned_NULL.
lea ecx, [rdx + 2]
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
xor eax, eax
mov r14, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x538]
mov rbp, qword [rsp + 0x568]
mov rbx, qword [rsp + 0x560]
mov r13, qword [rsp + 0x528]
mov r15, qword [rsp + 0x518]
mov r12, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x540]
mov rcx, qword [rsp + 0x500]
call fcn.0041e010
add rsp, 0x548
ret
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00416230
xor edx, edx
lea r8, str.Reading__MFT::_BITMAP_into_memory
lea ecx, [rdx + 6]
mov rbp, r12
call qword [rsi + 0x298]
nop
nop
nop
mov r9, qword [rbx]
cmp r9, 0xffffffffffffffff
je 0x403b43
mov rax, qword [rbx + 8]
xor edx, edx
lea r8, str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
sub rax, rbp
lea ecx, [rdx + 6]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [rsi + 0x298]
mov rdx, qword [rsi + 0x118]
mov rax, qword [rbx]
mov r11, qword [rsi + 0x120]
imul rax, rdx
mov qword [rsp + 0xb8], 0
lea r8, str.____Reading__I64u_clusters___I64u_bytes__from_LCN_I64u
imul rax, r11
mov dword [rsp + 0xb0], eax
shr rax, 0x20
mov dword [rsp + 0xb4], eax
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
sub r9, rbp
mov qword [rsp + 0x28], rax
mov rcx, r9
imul rcx, rdx
xor edx, edx
imul rcx, r11
mov qword [rsp + 0x20], rcx
lea ecx, [rdx + 6]
call qword [rsi + 0x298]
mov rdx, qword [rsi + 0x120]
mov r8d, dword [rbx + 8]
imul rdx, r12
mov rcx, qword [rsi + 0x28]
sub r8d, ebp
lea rax, [rsp + 0xa0]
imul rdx, qword [rsi + 0x118]
imul r8d, dword [rsi + 0x120]
lea r9, [rsp + 0x50]
add rdx, r14
mov qword [rsp + 0x20], rax
imul r8d, dword [rsi + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c1a
mov rdx, qword [rbx + 8]
mov rcx, qword [rsi + 0x120]
mov eax, dword [rsp + 0x50]
sub rdx, rbp
imul rcx, rdx
imul rcx, qword [rsi + 0x118]
cmp rax, rcx
jne 0x403c1a
add r12, rdx
mov rbp, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403a30
mov rax, qword [rsp + 0x70]
xor edx, edx
shl rax, 3
mov qword [rsp + 0x58], rax
mov rax, r13
div qword [rsi + 0x158]
mov r13, qword [rsp + 0x58]
cmp r13, rax
cmova r13, rax
mov qword [rsp + 0x58], r13
lea rcx, [r13*8]
call fcn.00410900
test rax, rax
mov rcx, rax
mov qword [rsp + 0x68], rax
je 0x403992
cmp r13, 1
mov rax, qword [rsi + 0x178]
mov qword [rcx], rax
jbe 0x403bc0
lea r8, [r13 - 1]
add rcx, 8
xor edx, edx
shl r8, 3
call fcn.00416230
xor r10d, r10d
mov edx, 1
cmp rdx, r13
mov r14, r10
mov rbp, r10
mov r12, r10
mov qword [rsi + 0x258], r10
mov qword [rsi + 0x250], r10
jae 0x403c60
mov rbx, qword [rsp + 0x80]
nop
mov cl, dl
mov rax, rdx
shr rax, 3
and ecx, 7
movzx eax, byte [rax + rbx]
test byte [rsp + rcx + 0xf0], al
je 0x403c10
inc qword [rsi + 0x250]
inc rdx
cmp rdx, r13
jb 0x403bf0
jmp 0x403c68
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x100]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
xor edx, edx
lea r9, [rsp + 0x100]
lea ecx, [rdx + 2]
lea r8, str.___s
call qword [rsi + 0x298]
mov rcx, r14
call fcn.004109b0
mov rcx, r15
call fcn.004109b0
xor eax, eax
jmp 0x4039ae
mov rbx, qword [rsp + 0x80]
mov r13d, 1
cmp r13, qword [rsp + 0x58]
jae 0x403f45
nop
nop
mov rax, qword [rsi + 8]
cmp dword [rax], 0
jne 0x403f45
mov cl, r13b
mov rax, r13
shr rax, 3
and ecx, 7
movzx eax, byte [rax + rbx]
test byte [rsp + rcx + 0xf0], al
jne 0x403cc1
xor edx, edx
lea r8, str.Inode__I64u_is_not_in_use.
mov r9, r13
lea ecx, [rdx + 6]
call qword [rsi + 0x298]
jmp 0x403f37
inc qword [rsi + 0x258]
cmp r13, r14
jb 0x403e83
xor edx, edx
mov eax, 0x40000
mov qword [rsp + 0xc8], r13
div qword [rsi + 0x158]
lea r9, [r13 + rax]
mov rax, qword [rsp + 0x70]
lea rcx, [rax*8]
cmp r9, rcx
cmova r9, rcx
test rdi, rdi
mov qword [rsp + 0x78], r9
je 0x403f45
nop
mov rax, qword [rdi + 8]
xor edx, edx
sub rax, rbp
add rax, r12
imul rax, qword [rsi + 0x120]
imul rax, qword [rsi + 0x118]
div qword [rsi + 0x158]
cmp rax, r13
ja 0x403da0
nop
nop
xor edx, edx
lea r8, str.Skipping_to_next_extent
lea ecx, [rdx + 6]
call qword [rsi + 0x298]
cmp qword [rdi], 0xffffffffffffffff
je 0x403d62
mov rax, qword [rdi + 8]
sub rax, rbp
add r12, rax
mov rbp, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
test rdi, rdi
je 0x403d75
cmp qword [rdi], 0xffffffffffffffff
je 0x403d40
mov rax, qword [rdi + 8]
mov r9, qword [rdi]
xor edx, edx
sub rax, rbp
lea r8, str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
lea ecx, [rdx + 6]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [rsi + 0x298]
jmp 0x403d10
mov rdx, qword [rsi + 0x120]
mov r9, qword [rsp + 0x78]
mov r8, qword [rsi + 0x118]
cmp r9, rax
mov rcx, r13
cmovae r9, rax
mov rax, qword [rdi]
mov qword [rsp + 0xb8], 0
imul rcx, qword [rsi + 0x158]
sub rax, r12
mov ebx, r9d
mov r14, r9
mov qword [rsp + 0x78], r9
sub ebx, r13d
sub r14, r13
imul rax, r8
imul r8, rdx
mov r9, r14
imul rax, rdx
xor edx, edx
add rax, rcx
mov rcx, rax
mov dword [rsp + 0xb0], eax
div r8
shr rcx, 0x20
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0xb4], ecx
mov ecx, ebx
lea r8, str.Reading_block_of__I64u_Inodes_from_MFT_into_memory___u_bytes_from_LCN_I64u
imul ecx, dword [rsi + 0x158]
mov dword [rsp + 0x20], ecx
lea ecx, [rdx + 6]
call qword [rsi + 0x298]
mov rcx, qword [rsi + 0x28]
lea rax, [rsp + 0xa0]
imul ebx, dword [rsi + 0x158]
lea r9, [rsp + 0x50]
mov rdx, r15
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4040f9
imul r14, qword [rsi + 0x158]
mov eax, dword [rsp + 0x50]
cmp rax, r14
jne 0x4040f9
mov r14, qword [rsp + 0x78]
mov r8, qword [rsi + 0x158]
mov rbx, r13
mov rcx, rsi
sub rbx, qword [rsp + 0xc8]
mov rdx, rbx
imul rdx, r8
add rdx, r15
call fcn.004013f0
test eax, eax
jne 0x403ed4
mov rax, qword [rsp + 0x58]
xor edx, edx
lea r8, str.The_error_occurred_while_processing_Inode__I64u__max__I64u_
lea ecx, [rdx + 2]
mov r9, r13
mov qword [rsp + 0x20], rax
call qword [rsi + 0x298]
mov rbx, qword [rsp + 0x80]
jmp 0x403f37
mov rax, qword [rsi + 0x158]
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
imul rbx, rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
add rbx, r15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov r8, r13
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.00402f40
mov rbx, qword [rsp + 0x80]
inc r13
cmp r13, qword [rsp + 0x58]
jb 0x403c80
mov rcx, r15
call fcn.004109b0
mov rcx, rbx
call fcn.004109b0
mov rax, qword [rsi + 8]
cmp dword [rax], 0
jne 0x404145
mov rax, qword [rsi + 0x250]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsi + 0x258], rax
call qword [rsi + 0x2a0]
mov rcx, qword [rsi + 0x178]
xor r12d, r12d
mov qword [rsi + 0x258], r12
mov qword [rsi + 0x250], r12
call sym.JkDefragCmd64.exe_TreeSmallest
test rax, rax
je 0x403fc4
nop
nop
nop
nop
inc qword [rsi + 0x250]
mov rcx, rax
call sym.JkDefragCmd64.exe_TreeNext
test rax, rax
jne 0x403fb0
xor edx, edx
xor ecx, ecx
call qword [rsi + 0x290]
mov rcx, qword [rsi + 0x178]
call sym.JkDefragCmd64.exe_TreeSmallest
test rax, rax
mov rbx, rax
je 0x404358
mov rbp, qword [rsp + 0x98]
movabs r13, 0x1792f8648000
movabs r14, 0x346dc5d63886594b
mov rax, qword [rsi + 8]
cmp dword [rax], r12d
jne 0x404358
mov rax, qword [rsi + 0x10]
cmp dword [rax], 1
jne 0x404020
mov rcx, rsi
call sym.JkDefragCmd64.exe_ShowDiskmap
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.004020b0
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x404087
mov rcx, qword [rbx + 0x20]
mov rdx, rdi
call sym.JkDefragCmd64.exe_MatchMask
test eax, eax
jne 0x404087
mov rcx, qword [rbx + 0x30]
mov rdx, rdi
call sym.JkDefragCmd64.exe_MatchMask
test eax, eax
jne 0x404087
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov dword [rbx + 0x88], 1
mov dword [rsp + 0x20], r12d
call sym.JkDefragCmd64.exe_ColorizeItem
cmp dword [rbx + 0x88], r12d
jne 0x404176
mov rax, qword [rsi + 0x188]
test rax, rax
je 0x404176
cmp qword [rax], r12
je 0x404176
mov rdi, r12
mov rdx, qword [rsi + 0x188]
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rdx + rdi]
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x404156
mov rdx, qword [rsi + 0x188]
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rdx + rdi]
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x404156
mov rax, qword [rsi + 0x188]
add rdi, 8
cmp qword [rdi + rax], r12
jne 0x4040b0
jmp 0x404176
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x100]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
mov r11, qword [rsp + 0x78]
xor edx, edx
lea rax, [rsp + 0x100]
dec r11
lea r8, str.Error_while_reading_Inodes__I64u_to__I64u:__s
mov qword [rsp + 0x28], rax
lea ecx, [rdx + 2]
mov r9, r13
mov qword [rsp + 0x20], r11
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
mov rcx, qword [rsp + 0x68]
call fcn.004109b0
xor eax, eax
jmp 0x4039ae
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov dword [rbx + 0x88], 1
mov dword [rsp + 0x20], r12d
call sym.JkDefragCmd64.exe_ColorizeItem
cmp dword [rbx + 0x88], r12d
jne 0x4041e0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x4041e0
lea rdx, str.jkdefrag.log
call fcn.00410100
test eax, eax
je 0x4041c0
mov rcx, qword [rbx + 0x18]
lea rdx, str.jkdefragcmd.log
call fcn.00410100
test eax, eax
je 0x4041c0
mov rcx, qword [rbx + 0x18]
lea rdx, str.jkdefragscreensaver.log
call fcn.00410100
test eax, eax
jne 0x4041e0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov dword [rbx + 0x88], 1
mov dword [rsp + 0x20], r12d
call sym.JkDefragCmd64.exe_ColorizeItem
cmp dword [rbx + 0x88], r12d
jne 0x4042be
cmp dword [rbx + 0x80], r12d
jne 0x4042be
mov rcx, qword [rsi + 0x190]
test rcx, rcx
je 0x4042be
cmp qword [rbx + 0x38], 0x3200000
jbe 0x404223
mov dword [rbx + 0x8c], 1
jmp 0x40429f
cmp dword [rsi + 0x18], 1
jne 0x404241
mov rax, qword [rbx + 0x60]
add rax, r13
cmp rax, rbp
jae 0x404241
mov dword [rbx + 0x8c], 1
jmp 0x40429f
cmp qword [rcx], r12
je 0x40429f
mov rdi, r12
nop
nop
mov rdx, qword [rsi + 0x190]
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rdi + rdx]
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x404295
mov rdx, qword [rsi + 0x190]
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rdi + rdx]
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
je 0x404295
mov rax, qword [rsi + 0x190]
add rdi, 8
cmp qword [rdi + rax], r12
jne 0x404250
jmp 0x40429f
mov dword [rbx + 0x8c], 1
cmp dword [rbx + 0x8c], 1
jne 0x4042be
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call sym.JkDefragCmd64.exe_ColorizeItem
mov rcx, qword [rbx + 0x20]
lea rdx, str._safeboot.fs
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
jne 0x4042d9
mov dword [rbx + 0x84], eax
mov rcx, qword [rbx + 0x20]
lea rdx, str._:_bootwiz.sys
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
jne 0x4042f4
mov dword [rbx + 0x84], eax
mov rcx, qword [rbx + 0x20]
lea rdx, str.BOOTWIZ
call sym.JkDefragCmd64.exe_MatchMask
cmp eax, 1
jne 0x40430f
mov dword [rbx + 0x84], eax
inc qword [rsi + 0x258]
mov rcx, qword [rsi + 0x258]
mov rax, r14
mul rcx
shr rdx, 0xb
imul rdx, rdx, 0x2710
cmp rcx, rdx
jne 0x404344
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [rsi + 0x2a0]
mov rcx, rbx
call sym.JkDefragCmd64.exe_TreeNext
test rax, rax
mov rbx, rax
jne 0x404002
mov rcx, qword [rsi + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsi + 0x258], rcx
mov rcx, rsi
xor edx, edx
call qword [rsi + 0x2a0]
mov rcx, qword [rsp + 0x68]
call fcn.004109b0
mov eax, 1
jmp 0x4039ae
xor edx, edx
lea r8, str.Fatal_error__cannot_process_this_disk.
lea ecx, [rdx + 2]
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
xor eax, eax
jmp 0x4039b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x100]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
xor edx, edx
lea r9, [rsp + 0x100]
lea ecx, [rdx + 2]
lea r8, str.Error_while_reading_first_MFT_record:__s
call qword [rsi + 0x298]
mov rcx, r15
call fcn.004109b0
xor eax, eax
jmp 0x4039d6