Function at 0x1400e47a0
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x340
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x330], rax
movzx eax, word [r8 + 0xa0]
mov r13, qword [rdx + 8]
mov rsi, rcx
mov rcx, qword [rdx]
mov r12, r8
mov qword [rsp + 0x40], r8
imul r13, rax
mov r15, rdx
mov qword [rsp + 0x68], r13
imul rcx, rax
mov qword [rsp + 0x98], rcx
movsxd rcx, dword [rsi + 0x14]
imul rcx, r13
call sub.MFC80U.DLL_Ordinal_265
test rax, rax
mov rbp, rax
mov qword [rsp + 0x50], rax
jne 0x1400e48fa
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea edx, [rbp + 0x5c]
lea rcx, str..._ntfsfmt.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400e4852
xor ebx, ebx
jmp 0x1400e48e0
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
mov r8d, Ordinal_760
mov byte [rsp + 0x98], 0
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e48a0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x98]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e48d0
mov rax, qword [rsi]
lea rdx, str._s:_No_sufficient_memory.
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400e55e0
movsxd r8, dword [rsi + 0x14]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x398], r14
imul r8, r13
call sub.ntdll.dll_memset
mov edx, dword [rsi + 0x14]
xor r14d, r14d
cmp edx, reloc.MFC80U.DLL_Ordinal_512
jne 0x1400e4939
lea rdx, [0x140332450]
mov r8d, 0x6c00
mov rcx, rbp
call sub.ntdll.dll_memcpy
jmp 0x1400e499b
cmp edx, reloc.MFC80U.DLL_Ordinal_512
jle 0x1400e499b
mov eax, dword [rsi + 0x18]
mov edi, r14d
cdq
idiv dword [rsi + 0x10]
test eax, eax
mov ebp, eax
jle 0x1400e4996
mov r13, qword [rsp + 0x50]
lea rbx, [0x140332450]
nop
mov ecx, dword [rsi + 0x10]
mov r9d, dword [rsi + 0x14]
mov r8d, 0x400
mov rdx, rbx
imul ecx, edi
movsxd rcx, ecx
add rcx, r13
call fcn.1400d6a70
add edi, 1
add rbx, 0x400
cmp edi, ebp
jl 0x1400e4960
mov rbp, r13
mov r13, qword [rsp + 0x68]
jmp 0x1400e499b
mov rbp, qword [rsp + 0x50]
mov edx, dword [rsi + 0x10]
lea ecx, [rdx*8]
shl edx, 4
movsxd r8, ecx
movsxd rcx, edx
xor edx, edx
add rcx, rbp
call sub.ntdll.dll_memset
movsxd rdi, dword [rsi + 0x10]
xor edx, edx
mov eax, 0x6c00
div rdi
cmp dword [rsi + 0x14], reloc.MFC80U.DLL_Ordinal_512
mov rbx, rax
mov qword [rsp + 0x60], rax
jle 0x1400e49e4
mov eax, dword [rsi + 0x18]
cdq
idiv edi
mov ebx, eax
mov qword [rsp + 0x60], rbx
test ebx, ebx
mov r9d, r14d
jle 0x1400e4a49
nop
nop
mov eax, dword [rsi + 0x10]
mov edi, r14d
imul eax, r9d
movsxd r8, eax
add r8, rbp
movzx eax, word [r8 + 6]
movzx edx, word [r8 + 4]
sub eax, 1
add rdx, r8
test eax, eax
jle 0x1400e4a40
lea rcx, [r8 + 0x1fe]
add rdx, 2
nop
movzx eax, word [rdx]
add edi, 1
add rdx, 2
mov word [rcx], ax
movzx eax, word [r8 + 6]
add rcx, reloc.MFC80U.DLL_Ordinal_512
sub eax, 1
cmp edi, eax
jl 0x1400e4a20
add r9d, 1
cmp r9d, ebx
jl 0x1400e49f0
movsxd rcx, dword [rsi + 0x14]
imul rcx, r13
call sub.MFC80U.DLL_Ordinal_265
test rax, rax
mov rdi, rax
mov qword [rsp + 0x58], rax
jne 0x1400e4b35
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea edx, [rdi + 0x5c]
lea rcx, str..._ntfsfmt.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e5233
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
mov r8d, 0x322
mov byte [rsp + 0x98], r14b
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e4af0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x98]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e4b20
jmp 0x1400e5230
movsxd r8, dword [rsi + 0x14]
xor edx, edx
mov rcx, rax
imul r8, r13
call sub.ntdll.dll_memset
xor eax, eax
lea rcx, [rsp + 0x70]
mov word [rsp + 0x70], r14w
mov qword [rsp + 0x72], rax
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test ebx, ebx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rdx
mov r13d, r14d
jle 0x1400e50a5
nop
nop
nop
mov eax, dword [rsi + 0x10]
imul eax, r13d
cmp r13d, 0x10
movsxd rcx, eax
mov rax, qword [rsp + 0x58]
lea rdi, [rcx + rbp]
lea r14, [rcx + rax]
mov qword [rsp + 0x90], rdi
jl 0x1400e4bcf
cmp r13d, 0x17
jle 0x1400e5090
movzx r8d, word [rdi + 0x14]
mov rdx, rdi
mov rcx, r14
call sub.ntdll.dll_memcpy
movzx ecx, word [r14 + 0x14]
mov dword [r14], 0x454c4946
movzx eax, word [rdi + 0x14]
mov dword [r14 + 0x2c], r13d
mov dword [rsp + 0x48], ecx
mov dword [r14 + 0x18], eax
mov eax, dword [rsi + 0x10]
mov dword [r14 + 0x1c], eax
mov eax, dword [rsi + 0x10]
cdq
and edx, 0x1ff
add eax, edx
mov edx, 0xffffffff
sar eax, 9
add ax, 1
mov word [r14 + 6], ax
movzx eax, word [rdi + 0x14]
cmp dword [rdi + rax], edx
lea rbp, [rdi + rax]
mov dword [rsp + 0x4c], eax
je 0x1400e507f
cmp dword [rbp], edx
je 0x1400e507a
mov r8d, dword [rbp + 4]
movsxd rbx, ecx
mov rdx, rbp
add rbx, r14
mov rcx, rbx
call sub.ntdll.dll_memcpy
mov r12d, dword [rbx + 4]
mov eax, dword [rbx]
add r12d, 7
add eax, 0xfffffff0
and r12d, 0xfffffff8
cmp eax, 0xa0
mov dword [rbx + 4], r12d
ja case.default.0x1400e4c8b
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xe5628]
mov ecx, dword [rdx + rax*4 + 0xe5604]
add rcx, rdx
jmp rcx
movzx eax, word [rbx + 0x14]
mov rcx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x40]
add rax, rbx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, r15
mov r8, rbx
mov edx, r13d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.1400e4610
jmp 0x1400e5041
cmp r13d, 5
jne 0x1400e5027
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x88]
mov r8, qword [r15 + 0x78]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
cmp r13d, 3
jne 0x1400e5020
lea rcx, [rsp + 0x132]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0x130], 0
call sub.ntdll.dll_memset
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x130]
add rdx, 0x20
sub rcx, rdx
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x1400e4d50
mov edx, dword [rbx + 0x10]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
add ecx, ecx
mov eax, ecx
mov r8d, ecx
sub eax, edx
lea rdx, [rsp + 0x130]
mov dword [rbx + 0x10], r8d
lea ecx, [rax + r12 + 7]
and ecx, 0xfffffff8
mov dword [rbx + 4], ecx
movzx ecx, word [rbx + 0x14]
add rcx, rbx
call sub.ntdll.dll_memcpy
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x90]
jmp 0x1400e5041
cmp byte [rbx + 8], 0
je 0x1400e500b
cmp r13d, 0xa
ja case.default.0x1400e4ddb
movsxd rax, r13d
mov ecx, dword [rdx + rax*4 + 0xe56cc]
add rcx, rdx
jmp rcx
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x10]
mov r8, qword [r15]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x40]
mov r8, qword [r15 + 0x30]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x58]
mov r8, qword [r15 + 0x48]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x70]
mov r8, qword [r15 + 0x60]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0xb8]
mov r8, qword [r15 + 0xa8]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0xd0]
mov r8, qword [r15 + 0xc0]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
movsxd rax, dword [rsi + 0x14]
mov r12, qword [rsp + 0x40]
or r8, 0xffffffffffffffff
mov r9, qword [r12 + 0x10]
mov rdx, rbx
mov rcx, rsi
sub r9, 1
imul r9, rax
movzx eax, word [r12 + 0xa0]
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0xe8]
mov r8, qword [r15 + 0xd8]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x100]
mov r8, qword [r15 + 0xf0]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
movzx ecx, byte [rsi]
movzx edx, word [rbx + 0x14]
mov r12, qword [rsp + 0x40]
test cl, cl
mov eax, 8
cmovg eax, ecx
mov byte [rdx + rbx + 0xc], al
jmp 0x1400e5041
cmp r13d, 5
jne 0x1400e5004
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0xa0]
mov r8, qword [r15 + 0x90]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
test r13d, r13d
jne 0x1400e503c
mov r12, qword [rsp + 0x40]
mov r9, qword [r15 + 0x28]
mov r8, qword [r15 + 0x18]
movzx eax, word [r12 + 0xa0]
mov rdx, rbx
mov rcx, rsi
mov word [rsp + 0x20], ax
call fcn.1400e4380
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
jmp 0x1400e5041
mov r12, qword [rsp + 0x40]
mov eax, dword [rbx + 4]
mov edx, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x48]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 4], eax
add edx, dword [rbp + 4]
add dword [r14 + 0x18], eax
movsxd rbp, edx
add ecx, eax
mov dword [rsp + 0x4c], edx
add rbp, rdi
mov edx, 0xffffffff
mov dword [rsp + 0x48], ecx
cmp dword [rbp], edx
jne 0x1400e4c34
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
movsxd rax, ecx
mov qword [rax + r14], rdx
add dword [r14 + 0x18], 8
add r13d, 1
cmp r13d, ebx
jl 0x1400e4ba0
mov rdi, qword [rsp + 0x58]
xor r14d, r14d
test ebx, ebx
mov r10d, r14d
jle 0x1400e5136
mov eax, dword [rsi + 0x10]
mov r8d, r14d
mov ecx, eax
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
imul ecx, r10d
movsxd rcx, ecx
add rcx, rdi
movzx r9d, word [rcx + 4]
add r9, rcx
test eax, eax
jle 0x1400e5129
lea rdi, [r9 + 2]
add rcx, 0x1fe
nop
nop
nop
movzx eax, word [rcx]
add r8d, 1
add rcx, reloc.MFC80U.DLL_Ordinal_512
mov word [rdi], ax
movzx eax, word [r9]
add rdi, 2
mov word [rcx - reloc.MFC80U.DLL_Ordinal_512], ax
mov eax, dword [rsi + 0x10]
cdq
and edx, 0x1ff
add eax, edx
sar eax, 9
cmp r8d, eax
jl 0x1400e50f0
mov rdi, qword [rsp + 0x58]
add r10d, 1
cmp r10d, ebx
jl 0x1400e50b0
mov ecx, dword [r15 + 0x38]
movzx eax, word [r12 + 0xa0]
imul ecx, eax
imul ecx, dword [rsi + 0x14]
movsxd rdi, ecx
mov rcx, rdi
call sub.MFC80U.DLL_Ordinal_265
test rax, rax
mov qword [rsi + 8], rax
jne 0x1400e524b
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str..._ntfsfmt.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e5233
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
mov r8d, Ordinal_940
mov byte [rsp + 0x98], 0
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e51f0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x98]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e5220
mov r14, rbx
mov rax, qword [rsi]
lea rdx, str._s:_No_sufficient_memory.
mov r8, r14
mov rcx, rsi
call qword [rax + 0x10]
jmp 0x1400e55d6
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov r13, qword [rsp + 0x58]
mov rcx, qword [rsi + 8]
mov rdx, r13
mov r8, rdi
call sub.ntdll.dll_memcpy
mov ebx, dword [r12]
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x130], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x134], 6
jae 0x1400e534b
xor eax, eax
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0xb0]
mov r8d, ebx
mov word [rsp + 0xb0], 0
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov qword [rsp + 0xda], rax
mov qword [rsp + 0xe2], rax
mov dword [rsp + 0xea], eax
mov word [rsp + 0xee], ax
call qword [sym.imp.MSVCR80.dll__swprintf]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
jmp 0x1400e53b0
call fcn.1400494c0
mov edx, ebx
mov rdi, qword [rax]
mov rcx, rax
call qword [rdi + 0x18]
test eax, eax
js 0x1400e54e5
lea rdx, [0x1402e0fe0]
lea rcx, [rsp + 0xf0]
mov r9d, ebx
mov r8d, eax
call qword [sym.imp.MSVCR80.dll__swprintf]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xf0]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x1400e54e5
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x68]
mov rdx, r13
add r8, qword [r12 + 8]
mov rcx, rbx
call fcn.1400e0c00
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call sub.MFC80U.DLL_Ordinal_266
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
test edi, edi
jne 0x1400e54db
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea edx, [rdi + 0x5c]
lea rcx, str..._ntfsfmt.cpp
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e54c3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
mov r8d, 0x3c3
mov byte [rsp + 0x98], 0
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e5480
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x98]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e54b0
mov r14, rbx
mov rax, qword [rsi]
lea rdx, str._s:_Failed_to_write__MFT:_Bitmap_Data.
mov r8, r14
mov rcx, rsi
call qword [rax + 0x10]
jmp 0x1400e55d6
mov eax, 1
jmp 0x1400e55d8
call fcn.140049470
lea rbx, [0x14043d210]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str..._ntfsfmt.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
je 0x1400e55b3
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
mov r8d, Ordinal_955
mov byte [rsp + 0x98], 0
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400e5570
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x98]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400e55a0
mov r14, rbx
mov rax, qword [rsi]
lea rdx, str._s:_Failed_to_open_disk.
mov r8, r14
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, r13
call sub.MFC80U.DLL_Ordinal_266
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_266
xor eax, eax
mov r14, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.140161080
add rsp, 0x340
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret