Function at 0x1000f014
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push 0xd84
mov eax, 0x100437fa
call fcn.1002ddda
mov eax, dword [ebp + 0xc]
movsx bx, byte [ebp + 8]
mov dword [ebp - 0xd88], eax
push 0x3a
pop eax
mov word [ebp - 0x22], ax
push 0x5c
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0xfe
mov word [ebp - 0x164], ax
xor edi, edi
lea eax, [ebp - 0x162]
push edi
push eax
mov esi, ecx
call fcn.10030bf0
add esp, 0xc
xor eax, eax
push 0x3e
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push edi
push eax
call fcn.10030bf0
add esp, 0xc
mov dword [ebp - method.MemoryHolder_wchar_t_const__.virtual_0], vtable.MemoryHolder_wchar_t_const__.0
mov dword [ebp - 0xd80], edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
pop ecx
cdq
idiv ecx
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xd7c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002c8a8
mov dword [ebp - 0xd80], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xd70], eax
test eax, eax
je 0x1000f126
and dword [ebp - 0xd68], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
cmp edi, eax
jb 0x1000f0f6
call fcn.1002d258
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0xd68]
cmp dword [eax + 0x18], 8
jb 0x1000f10a
mov eax, dword [eax + 4]
jmp 0x1000f10d
add eax, 4
mov ecx, dword [ebp - 0xd80]
add dword [ebp - 0xd68], 0x1c
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [ebp - 0xd70]
jne 0x1000f0e1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x20
mov dword [ebp - 0xd8c], eax
lea eax, [ebp - 0x64]
push eax
xor esi, esi
push esi
push esi
push esi
push 0x80
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1000f358
push str.ntfs
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000f33f
mov dword [ebp - 0xd68], esi
mov esi, ebx
call fcn.1000e67d
mov esi, eax
test esi, esi
jne 0x1000f196
mov dword [ebp - 0xd68], 3
jmp 0x1000f2fa
call fcn.1000e7ae
or eax, edx
je 0x1000f2eb
lea eax, [ebp - 0xd90]
push eax
mov eax, esi
call fcn.1000ee90
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0xd78], 0
cmp dword [esi + 0xc], 0
mov edi, eax
mov eax, dword [esi + 0x248]
jbe 0x1000f2f5
mov dword [ebp - 0xd74], eax
test byte [eax + 6], 1
je 0x1000f2c5
mov eax, dword [eax]
test eax, eax
je 0x1000f2c5
call fcn.1000efcb
test eax, eax
jne 0x1000f2c5
and dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd70], eax
je 0x1000f2c5
mov eax, dword [ebp - 0xd74]
push dword [eax]
mov eax, dword [ebp - 0xd80]
mov ecx, dword [ebp - 0xd6c]
mov ebx, dword [eax + ecx*4]
call fcn.100156f6
test eax, eax
jne 0x1000f23e
inc dword [ebp - 0xd6c]
mov eax, dword [ebp - 0xd6c]
cmp eax, dword [ebp - 0xd70]
jne 0x1000f20a
mov eax, dword [ebp - 0xd70]
cmp dword [ebp - 0xd6c], eax
je 0x1000f2c5
xor eax, eax
mov word [ebp - 0xd64], ax
lea eax, [ebp - 0xd64]
push eax
mov eax, dword [ebp - 0xd78]
push esi
call fcn.1000ef06
pop ecx
pop ecx
test eax, eax
je 0x1000f2c5
cmp word [eax], 0
je 0x1000f2c5
push 0x200
push eax
lea eax, [ebp - 0x564]
xor ecx, ecx
push eax
mov word [ebp - 0x564], cx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0xd74]
push dword [eax]
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x564], 0
je 0x1000f2c5
push dword [ebp - 0xd88]
lea eax, [ebp - 0x564]
push eax
call fcn.1000a6a0
test eax, eax
je 0x1000f2f5
inc dword [ebp - 0xd78]
mov eax, dword [ebp - 0xd74]
mov ecx, dword [ebp - 0xd78]
add eax, 0x10
mov dword [ebp - 0xd74], eax
cmp ecx, dword [esi + 0xc]
jb 0x1000f1d7
jmp 0x1000f2f5
mov dword [ebp - 0xd68], 4
call fcn.1000e6d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
sub edi, dword [ebp - 0xd8c]
push eax
movsx eax, byte [ebp + 8]
push edi
push dword [ebp - 0xd68]
push eax
push str.NSFindFile_finished_:_c__status:__d___parse_mft_cost__d_ms__find_cost__d_ms_n
call fcn.100267b4
add esp, 0x14
cmp dword [ebp - 0xd80], 0
je 0x1000f337
push dword [ebp - 0xd80]
call fcn.1002d652
pop ecx
mov eax, dword [ebp - 0xd68]
jmp 0x1000f36f
cmp dword [ebp - 0xd80], esi
je 0x1000f353
push dword [ebp - 0xd80]
call fcn.1002d652
pop ecx
push 2
pop eax
jmp 0x1000f36f
cmp dword [ebp - 0xd80], esi
je 0x1000f36c
push dword [ebp - 0xd80]
call fcn.1002d652
pop ecx
xor eax, eax
inc eax
call fcn.1002de5d
ret 8