Function at 0x180011580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc04a0]
mov eax, 0xc05a0
call fcn.180014a10
sub rsp, rax
mov rax, qword [0x1800d61f8]
xor rax, rsp
mov qword [rbp + 0xc0490], rax
mov ebx, 1
mov qword [rbp - 0x20], rcx
mov rdi, rdx
mov dword [rbp + 0xc0080], 0x8040201
mov r15, rcx
mov dword [rbp + 0xc0084], 0x80402010
lea r12d, [rbx + 1]
call fcn.180005ccc
mov ecx, 0x40000
mov r14, rax
call fcn.180026bf8
xor r13d, r13d
mov qword [rbp - 0x28], rax
mov rsi, rax
test rax, rax
jne 0x180011618
lea r9, str.Error:_malloc___returned_NULL.
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.180004968
jmp 0x1800121b1
mov rcx, qword [rdi + 0x20]
lea rax, [rbp - 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0x200
mov qword [rbp - 0x48], r13
mov rdx, rsi
mov qword [rbp - 0x40], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001216b
cmp dword [rsp + 0x60], 0x200
jne 0x18001216b
movabs rax, 0x202020205346544e
cmp qword [rsi + 3], rax
je 0x180011681
lea r9, str.This_is_not_an_NTFS_disk__different_cookie_.
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.180004968
jmp 0x1800121a9
cmp dword [rsi + 0x40], 0x80
mov rax, qword [rsi + 0x30]
movzx r9d, word [rsi + 0xb]
movzx r8d, byte [rsi + 0xd]
mov r10, qword [rsi + 0x28]
mov qword [rbp + 0x18], rax
mov rax, qword [rsi + 0x38]
mov qword [rbp + 0x20], rax
mov dword [rdi + 0x108], ebx
mov qword [rbp], r9
mov qword [rbp + 8], r8
mov qword [rbp + 0x10], r10
jb 0x1800116ce
mov ecx, 0x100
mov rdx, rbx
sub ecx, dword [rsi + 0x40]
shl rdx, cl
mov qword [rbp + 0x28], rdx
jmp 0x1800116dd
mov eax, dword [rsi + 0x40]
imul rax, r8
imul rax, r9
mov qword [rbp + 0x28], rax
mov eax, dword [rsi + 0x44]
mov qword [rbp + 0x30], rax
mov rax, r8
imul rax, r9
mov qword [rdi + 0x1a0], rax
test r8, r8
je 0x180011706
xor edx, edx
mov rax, r10
div r8
mov qword [rdi + 0x198], rax
lea r9, str.This_is_an_NTFS_disk.
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.180004968
mov rax, qword [rsi + 3]
lea r9, str.__Disk_cookie:__I64X
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp]
lea r9, str.__BytesPerSector:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 0x10]
lea r9, str.__TotalSectors:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 8]
lea r9, str.__SectorsPerCluster:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
movzx eax, word [rsi + 0x18]
lea r9, str.__SectorsPerTrack:__lu
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, r12d
mov rcx, r14
call fcn.180004968
movzx eax, word [rsi + 0x1a]
lea r9, str.__NumberOfHeads:__lu
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 0x18]
lea r9, str.__MftStartLcn:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 0x20]
lea r9, str.__Mft2StartLcn:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 0x28]
lea r9, str.__BytesPerMftRecord:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 0x30]
lea r9, str.__ClustersPerIndexRecord:__I64u
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
movzx eax, byte [rsi + 0x15]
lea r9, str.__MediaType:__X
mov dword [rsp + 0x20], eax
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rsi + 0x48]
lea r9, str.__VolumeSerialNumber:__I64X
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 8]
lea r9, [rsp + 0x60]
imul rax, qword [rbp]
mov r8d, dword [rbp + 0x28]
xor edx, edx
div qword [rbp + 0x28]
mov rcx, qword [rdi + 0x20]
mov rdx, rsi
mov qword [rdi + 0x110], rax
mov rax, qword [rbp + 0x18]
imul rax, qword [rbp + 8]
mov qword [rbp - 0x40], r13
imul rax, qword [rbp]
mov dword [rbp - 0x48], eax
shr rax, 0x20
mov dword [rbp - 0x44], eax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180012145
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x28]
cmp rax, rcx
jne 0x180012145
mov qword [rsp + 0x20], rcx
lea r8, [rbp]
mov rcx, r15
mov r9, rsi
mov rdx, rdi
call fcn.180012428
test eax, eax
je 0x1800121a9
mov rax, qword [rbp + 0x28]
lea r8, [rbp]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x50], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
mov rdx, rdi
lea rax, [rsp + 0x78]
mov qword [rbp - 0x78], r13
mov qword [rsp + 0x40], rax
mov rcx, r15
lea rax, [rbp - 0x78]
mov qword [rbp - 0x68], r13
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x78], r13
call fcn.18001255c
test eax, eax
je 0x180012110
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x180012110
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x180012110
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x180012110
mov r12, qword [rbp - 0x80]
test r12, r12
je 0x18001210a
xor r8d, r8d
mov qword [rsp + 0x28], r12
lea r9, str.MftDataBytes___I64u__MftBitmapBytes___I64u
mov qword [rsp + 0x20], rax
mov rcx, r14
lea edx, [r8 + 6]
call fcn.180004968
xor r8d, r8d
lea r9, str.Reading__MFT::_BITMAP_into_memory
mov rcx, r14
lea edx, [r8 + 6]
call fcn.180004968
mov r8, r13
mov rcx, r13
mov rdx, rbx
cmp qword [rdx], 0xffffffffffffffff
je 0x180011a02
mov rax, qword [rdx + 8]
sub rax, r8
imul rax, qword [rbp + 8]
imul rax, qword [rbp]
add rcx, rax
mov r8, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x1800119e8
cmp rcx, r12
cmovb rcx, r12
call fcn.180026bf8
mov qword [rbp - 0x60], rax
mov r13, rax
test rax, rax
jne 0x180011a61
xor r8d, r8d
lea r9, str.Error:_malloc___returned_NULL.
mov rcx, r14
lea edx, [r8 + 2]
call fcn.180004968
mov rcx, rsi
call fcn.180053d58
mov rdx, qword [rdi + 0x120]
mov rcx, qword [r15]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
and qword [rdi + 0x120], 0
jmp 0x1800121b1
mov r8, r12
xor edx, edx
mov rcx, r13
call fcn.1800164c0
and qword [rsp + 0x68], 0
lea r9, str.Reading__MFT::_BITMAP_into_memory
and qword [rsp + 0x70], 0
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 6]
call fcn.180004968
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x180011b97
mov rax, qword [rbx + 8]
lea r9, str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
sub rax, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea edx, [r8 + 6]
mov rcx, r14
call fcn.180004968
mov rax, qword [rbp + 8]
lea r9, str.____Reading__I64u_clusters___I64u_bytes__from_LCN_I64u
imul rax, qword [rbx]
and qword [rbp - 0x40], 0
xor r8d, r8d
imul rax, qword [rbp]
mov dword [rbp - 0x48], eax
shr rax, 0x20
mov dword [rbp - 0x44], eax
mov rdx, qword [rbx + 8]
sub rdx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rdx
imul rcx, qword [rbp + 8]
mov qword [rsp + 0x30], rax
imul rcx, qword [rbp]
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x20], rdx
lea edx, [r8 + 6]
call fcn.180004968
mov r8d, dword [rbx + 8]
lea rax, [rbp - 0x58]
sub r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x60]
imul r8d, dword [rbp]
mov rdx, qword [rsp + 0x70]
imul rdx, qword [rbp + 8]
imul r8d, dword [rbp + 8]
mov rcx, qword [rdi + 0x20]
imul rdx, qword [rbp]
mov qword [rsp + 0x20], rax
add rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180011ce2
mov rdx, qword [rbx + 8]
sub rdx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
mov rcx, rdx
imul rcx, qword [rbp + 8]
imul rcx, qword [rbp]
cmp rax, rcx
jne 0x180011ce2
add qword [rsp + 0x70], rdx
mov rax, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
test rbx, rbx
jne 0x180011a90
mov rax, qword [rbp - 0x78]
lea rcx, [r12*8]
xor edx, edx
div qword [rbp + 0x28]
cmp rcx, rax
mov r13, rax
cmovbe r13, rcx
mov qword [rbp - 0x18], r13
lea rbx, [r13*8]
mov rcx, rbx
call fcn.180026bf8
xor ecx, ecx
mov qword [rsp + 0x68], rax
mov r12, rax
test rax, rax
je 0x180011a27
mov rax, qword [rdi + 0x120]
mov qword [r12], rax
cmp r13, 1
jbe 0x180011c17
lea r8, [rbx - 8]
xor edx, edx
and r8, 0xfffffffffffffff8
lea rcx, [r12 + 8]
call fcn.1800164c0
xor ecx, ecx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x70], rcx
mov qword [rdi + 0x218], rcx
mov qword [rdi + 0x210], rcx
lea rcx, [rbp + 0xc0070]
call fcn.18005423c
imul rcx, qword [rbp + 0xc0070], 0x3e8
movzx eax, word [rbp + 0xc0078]
mov edx, 1
add rcx, rax
mov qword [rbp - 8], rcx
cmp rdx, r13
jae 0x180012031
mov r8, qword [rbp - 0x60]
mov rcx, rdx
mov rax, rdx
shr rax, 3
and ecx, 7
mov al, byte [rax + r8]
test byte [rbp + rcx + 0xc0080], al
je 0x180011c8d
inc qword [rdi + 0x210]
inc rdx
cmp rdx, r13
jb 0x180011c6c
mov r12d, 1
mov rax, qword [rdi + 8]
cmp dword [rax], 0
jne 0x18001202c
mov rcx, r12
mov rax, r12
shr rax, 3
and ecx, 7
mov al, byte [rax + r8]
test byte [rbp + rcx + 0xc0080], al
jne 0x180011d2e
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea r9, str.Inode__I64u_is_not_in_use.
mov rcx, r14
lea edx, [r8 + 6]
call fcn.180004968
jmp 0x18001201b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r15]
lea r8, [rbp + 0xc0090]
mov edx, eax
mov r9d, 0x200
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor r8d, r8d
lea rax, [rbp + 0xc0090]
lea r9, str.___s
mov qword [rsp + 0x20], rax
mov rcx, r14
lea edx, [r8 + 2]
call fcn.180004968
mov rcx, r13
call fcn.180053d58
jmp 0x180011a3d
inc qword [rdi + 0x218]
cmp r12, rbx
jb 0x180011f70
mov rcx, qword [r15]
mov rdx, rdi
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SlowDown_struct_DefragDataStruct____ptr64____ptr64
mov r9, qword [rbp + 0x28]
xor edx, edx
mov rbx, qword [rbp - 0x30]
mov eax, 0x40000
div r9
mov qword [rbp - 0x10], r12
lea rcx, [rax + r12]
mov rax, qword [rbp - 0x80]
lea r8, [rax*8]
cmp rcx, r8
cmovbe r8, rcx
mov qword [rsp + 0x78], r8
test rbx, rbx
je 0x18001202c
mov r13, qword [rbp - 0x70]
mov r15, qword [rbp - 0x38]
mov rax, qword [rbx + 8]
xor edx, edx
mov r10, qword [rbp + 8]
sub rax, r15
mov r11, qword [rbp]
add rax, r13
imul rax, r10
imul rax, r11
div r9
mov qword [rsp + 0x70], rax
cmp rax, r12
ja 0x180011e39
mov esi, 6
lea r9, str.Skipping_to_next_extent
xor r8d, r8d
mov edx, esi
mov rcx, r14
call fcn.180004968
cmp qword [rbx], 0xffffffffffffffff
mov rcx, qword [rbx + 8]
je 0x180011de5
mov rax, rcx
sub rax, r15
add r13, rax
mov rbx, qword [rbx + 0x10]
mov r15, rcx
mov rdx, qword [rbx]
test rbx, rbx
je 0x180011dfa
cmp rdx, 0xffffffffffffffff
je 0x180011dbe
mov rax, qword [rbx + 8]
lea r9, str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
sub rax, rcx
mov qword [rbp - 0x38], rcx
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov rcx, r14
mov qword [rsp + 0x20], rdx
mov edx, esi
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x30], rbx
call fcn.180004968
mov r9, qword [rbp + 0x28]
jmp 0x180011d8c
mov rsi, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
mov r13, qword [rbp - 0x18]
test rbx, rbx
je 0x18001202c
mov rcx, qword [rbx]
mov rax, r12
mov rdx, qword [rsp + 0x70]
cmp qword [rsp + 0x78], rdx
cmovb rdx, qword [rsp + 0x78]
sub rcx, qword [rbp - 0x70]
mov ebx, edx
and qword [rbp - 0x40], 0
mov r8, rdx
imul rcx, r10
imul rax, r9
imul rcx, r11
imul r10, r11
mov qword [rsp + 0x70], rdx
sub r8, r12
add rax, rcx
mov qword [rsp + 0x78], r8
xor edx, edx
mov dword [rbp - 0x48], eax
mov rcx, rax
sub ebx, r12d
shr rcx, 0x20
div r10
mov dword [rbp - 0x44], ecx
mov ecx, ebx
imul ecx, r9d
lea r9, str.Reading_block_of__I64u_Inodes_from_MFT_into_memory___u_bytes_from_LCN_I64u
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov rcx, r14
mov qword [rsp + 0x20], r8
xor r8d, r8d
lea edx, [r8 + 6]
call fcn.180004968
imul ebx, dword [rbp + 0x28]
lea rax, [rbp - 0x58]
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x60]
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180011f0d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x60]
imul rcx, rdx
cmp rax, rcx
je 0x180011f74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r15]
lea r8, [rbp + 0xc0090]
mov edx, eax
mov r9d, 0x200
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rax, qword [rsp + 0x70]
lea rcx, [rbp + 0xc0090]
mov qword [rsp + 0x30], rcx
lea r9, str.Error_while_reading_Inodes__I64u_to__I64u:__s
xor r8d, r8d
dec rax
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], r12
lea edx, [r8 + 2]
call fcn.180004968
mov rcx, rsi
call fcn.180053d58
mov rcx, qword [rsp + 0x68]
jmp 0x180011a40
mov rdx, qword [rbp + 0x28]
mov qword [rsp + 0x20], rdx
lea r8, [rbp]
mov rbx, r12
mov rcx, r15
sub rbx, qword [rbp - 0x10]
mov r9, rbx
imul r9, rdx
mov rdx, rdi
add r9, rsi
call fcn.180012428
test eax, eax
jne 0x180011fbe
mov qword [rsp + 0x28], r13
lea r9, str.The_error_occurred_while_processing_Inode__I64u__max__I64u_
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea edx, [rax + 2]
mov rcx, r14
call fcn.180004968
jmp 0x180012016
mov rax, qword [rbp + 0x28]
lea r8, [rbp]
mov r9, qword [rsp + 0x68]
mov rdx, rdi
mov qword [rsp + 0x58], rax
mov rcx, r15
imul rbx, rax
lea rax, [rbp - 0x80]
add rbx, rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
call fcn.18001255c
mov rbx, qword [rsp + 0x70]
inc r12
cmp r12, r13
jae 0x18001202c
mov r8, qword [rbp - 0x60]
jmp 0x180011c9b
mov r12, qword [rsp + 0x68]
lea rcx, [rbp + 0xc0070]
call fcn.18005423c
imul rcx, qword [rbp + 0xc0070], 0x3e8
movzx eax, word [rbp + 0xc0078]
add rcx, rax
mov rax, qword [rbp - 8]
cmp rcx, rax
jle 0x180012085
sub rcx, rax
lea r9, str.__Analysis_speed:__I64u_items_per_second
xor edx, edx
xor r8d, r8d
imul rax, r13, 0x3e8
div rcx
lea edx, [r8 + 2]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.180004968
mov rcx, rsi
call fcn.180053d58
mov rcx, qword [rbp - 0x60]
call fcn.180053d58
mov rax, qword [rdi + 8]
xor ebx, ebx
cmp dword [rax], ebx
je 0x1800120c3
mov rcx, r12
call fcn.180053d58
mov rdx, qword [rdi + 0x120]
mov rcx, qword [r15]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov qword [rdi + 0x120], rbx
jmp 0x1800121b1
mov rdx, qword [rdi + 0x120]
mov rcx, qword [r15]
call sym.JkDefrag.dll_public:_struct_ItemStruct____ptr64___cdecl_JKDefragLib::TreeSmallest_struct_ItemStruct____ptr64____ptr64
jmp 0x1800120f3
mov rcx, qword [rax + 0x68]
cmp rcx, 5
mov rdx, qword [r12 + rcx*8]
cmove rdx, rbx
mov qword [rax + 0x70], rdx
mov rdx, rax
mov rcx, qword [r15]
call sym.JkDefrag.dll_public:_struct_ItemStruct____ptr64___cdecl_JKDefragLib::TreeNext_struct_ItemStruct____ptr64____ptr64
test rax, rax
jne 0x1800120d4
mov rcx, r12
call fcn.180053d58
mov eax, 1
jmp 0x1800121b3
mov r12d, 2
lea r9, str.Fatal_error__cannot_process_this_disk.
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call fcn.180004968
mov rcx, rsi
call fcn.180053d58
mov rdx, qword [rdi + 0x120]
mov rcx, qword [r15]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov qword [rdi + 0x120], r13
jmp 0x1800121b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r15]
lea r8, [rbp + 0xc0090]
mov edx, eax
mov r9d, 0x200
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea r9, str.Error_while_reading_first_MFT_record:__s
jmp 0x18001218f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r15]
lea r8, [rbp + 0xc0090]
mov edx, eax
mov r9d, 0x200
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea r9, str.Error_while_reading_bootblock:__s
lea rax, [rbp + 0xc0090]
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.180004968
mov rcx, rsi
call fcn.180053d58
xor eax, eax
mov rcx, qword [rbp + 0xc0490]
xor rcx, rsp
call fcn.1800149a0
mov rbx, qword [rsp + 0xc05f0]
add rsp, 0xc05a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret