Function at 0x1400eaf10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x42d8
call sub.ntdll.dll___chkstk
sub rsp, rax
mov qword [rsp + 0x120], 0xfffffffffffffffe
movaps xmmword [rsp + 0x42c0], xmm6
movaps xmmword [rsp + 0x42b0], xmm7
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x42a0], rax
mov qword [rsp + 0x58], r9
mov rsi, r8
mov rbp, rdx
mov r13, rcx
mov rbx, qword [rsp + 0x4340]
mov qword [rsp + 0x48], rbx
xor r15d, r15d
mov qword [rbx], r15
lea rcx, [rsp + 0x90]
call fcn.140115570
nop
mov rax, qword [r13]
movzx r9d, word [r13 + 0x2c]
mov r8, qword [rax + 0x10]
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x90]
call fcn.140115b60
test eax, eax
jne 0x1400eb0ad
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d310]
mov rcx, rbx
call sub.ntdll.dll_memset
lea edx, [r15 + 0x5c]
lea rcx, str..._ntfsresize.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400eb073
mov byte [rsp + 0x41c0], r15b
xor eax, eax
mov qword [rsp + 0x41c1], rax
mov word [rsp + 0x41c9], ax
mov byte [rsp + 0x41cb], al
mov r8d, Ordinal_727
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x41c0]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400eb030
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x41c0]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400eb060
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_Initialize_the__MFT:Bitmap_of_the_source_partition_to_fail.
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd1
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400ebafe
lea rcx, [rsp + 0x90]
call fcn.140115430
test rax, rax
jne 0x1400eb112
call fcn.140049470
mov rdi, rax
mov rbx, qword [rax]
mov edx, Ordinal_734
lea rcx, str..._ntfsresize.cpp
call fcn.1400e68c0
mov r8, rax
lea rdx, str._s:_Filesystem_error
mov rcx, rdi
call qword [rbx + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd1
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400ebafe
mov r14, r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x38], eax
mov r12, r15
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x90]
call fcn.140115430
test rax, rax
jle 0x1400eb9eb
movsd xmm7, qword [0x1403b85a8]
nop
lea rax, [r12 + 1]
mov qword [rsp + 0x70], rax
cvtsi2sd xmm6, rax
lea rcx, [rsp + 0x90]
call fcn.140115430
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
mulsd xmm6, xmm7
cvttsd2si edi, xmm6
mov edx, edi
mov rcx, r13
call fcn.1400e7640
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x38]
cmp eax, 0x3e8
jb 0x1400eb235
mov word [rsp + 0x41d0], 0
xor edx, edx
mov r8d, 0xc6
lea rcx, [rsp + 0x41d2]
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x90]
call fcn.140115430
mov r9, rax
mov dword [rsp + 0x20], edi
mov r8, qword [rsp + 0x70]
lea rdx, str.Analyzing_volume:__I64d__I64d___d__.
lea rcx, [rsp + 0x41d0]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
lea rdx, [rsp + 0x41d0]
call qword [rax + 0x70]
mov r8d, edi
lea rdx, str.Status:_d
lea rcx, [rsp + 0x41d0]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
lea rdx, [rsp + 0x41d0]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x38], eax
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jne 0x1400eb8e1
lea r8d, [rax + 1]
mov rdx, r12
lea rcx, [rsp + 0x90]
call fcn.1401154e0
test eax, eax
je 0x1400eb7de
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9890
nop
xor r9d, r9d
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_320]
mov rdx, r12
lea rcx, [r13 + 0x248]
call fcn.1400de420
test eax, eax
je 0x1400eb87d
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9510
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da8d0
mov rdi, rax
test rax, rax
je 0x1400eb7d1
cmp byte [rdi + 8], 0
jne 0x1400eb302
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da1e0
mov rdi, rax
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp eax, 0x3e8
jg 0x1400eb7d1
jmp 0x1400eb7c8
lea rcx, [rsp + 0xf0]
call fcn.1400db9e0
nop
mov rdx, rdi
lea rcx, [rsp + 0xf0]
call fcn.1400dbb00
test eax, eax
je 0x1400eb803
lea rcx, [rsp + 0xf0]
call fcn.1400dbfc0
mov ecx, eax
mov dword [rsp + 0x60], eax
mov eax, r15d
mov dword [rsp + 0x3c], eax
test ecx, ecx
je 0x1400eb7ab
nop
nop
mov edx, eax
lea rcx, [rsp + 0xf0]
call fcn.1400db970
mov rdi, rax
mov rdx, qword [rax]
cmp rdx, 0xffffffffffffffff
je 0x1400eb791
cmp r12, 6
jne 0x1400eb383
mov rax, qword [rsp + 0x68]
add rax, qword [rdi + 0x10]
mov qword [rsp + 0x68], rax
mov rcx, qword [rdi + 0x10]
mov r8, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
lea rax, [rcx + rdx]
cmp rax, r8
jle 0x1400eb740
cmp r12, 6
je 0x1400eb721
cmp rdx, r8
jl 0x1400eb3af
add qword [rbx], rcx
jmp 0x1400eb3ed
mov rax, rcx
sub rax, r8
add rax, rdx
add qword [rbx], rax
mov rbx, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
sub rbx, qword [rdi]
cmp r12, 1
je 0x1400eb791
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400eb3ed
mov r8d, ebx
mov edx, dword [rdi]
mov rcx, qword [rsp + 0x58]
call fcn.1401126f0
cmp r12, 1
je 0x1400eb791
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400eb791
mov r14d, r15d
mov ebx, r15d
mov rdi, r15
mov rcx, rbp
call fcn.140007310
test rax, rax
je 0x1400eb467
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400eb439
mov rax, qword [rbp + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400eb43f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbp + 8]
cmp qword [rax + rdi*8], r12
je 0x1400eb461
add ebx, 1
add rdi, 1
mov rcx, rbp
call fcn.140007310
mov ecx, ebx
cmp rcx, rax
jb 0x1400eb420
jmp 0x1400eb467
mov r14d, 1
mov ebx, r15d
mov rdi, r15
nop
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
test rax, rax
jne 0x1400eb481
mov rcx, r15
jmp 0x1400eb48f
mov rcx, qword [r13 + 0x208]
sub rcx, rax
sar rcx, 3
mov eax, ebx
cmp rax, rcx
jae 0x1400eb629
mov rcx, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
test rcx, rcx
je 0x1400eb4b9
mov rax, qword [r13 + 0x208]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400eb4bf
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
cmp r12, qword [rax + rdi*8]
je 0x1400eb4d5
add ebx, 1
add rdi, 1
jmp 0x1400eb470
mov ebx, r15d
mov rdi, r15
mov rcx, rsi
call fcn.140007310
test rax, rax
je 0x1400eb533
nop
nop
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400eb509
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400eb50f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsi + 8]
cmp qword [rax + rdi*8], r12
je 0x1400eb777
add ebx, 1
add rdi, 1
mov rcx, rsi
call fcn.140007310
mov ecx, ebx
cmp rcx, rax
jb 0x1400eb4f0
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x1400eb541
mov rcx, r15
jmp 0x1400eb54c
mov rcx, qword [rsi + 0x10]
sub rcx, rdx
sar rcx, 3
test rdx, rdx
je 0x1400eb57a
mov rax, qword [rsi + 0x18]
sub rax, rdx
sar rax, 3
cmp rcx, rax
jae 0x1400eb57a
mov rax, qword [rsi + 0x10]
mov qword [rax], r12
add rax, 8
mov qword [rsi + 0x10], rax
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
mov rdi, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1400eb589
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rdi
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400eb5c6
mov rcx, qword [rsi + 0x10]
mov rax, rcx
sub rax, rbx
sar rax, 3
je 0x1400eb5c6
cmp rbx, rcx
jbe 0x1400eb5bd
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbx
sar rdi, 3
jmp 0x1400eb5c9
mov rdi, r15
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xe0], xmm0
lea r9, [rsp + 0x50]
mov r8d, 1
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.140007440
mov rbx, qword [rsi + 8]
cmp rbx, qword [rsi + 0x10]
jbe 0x1400eb605
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rbx + rdi*8]
cmp rax, qword [rsi + 0x10]
ja 0x1400eb619
cmp rax, qword [rsi + 8]
jae 0x1400eb77e
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
test r14d, r14d
jne 0x1400eb785
mov rdx, qword [rbp + 8]
test rdx, rdx
jne 0x1400eb640
mov rcx, r15
jmp 0x1400eb64b
mov rcx, qword [rbp + 0x10]
sub rcx, rdx
sar rcx, 3
test rdx, rdx
je 0x1400eb679
mov rax, qword [rbp + 0x18]
sub rax, rdx
sar rax, 3
cmp rcx, rax
jae 0x1400eb679
mov rax, qword [rbp + 0x10]
mov qword [rax], r12
add rax, 8
mov qword [rbp + 0x10], rax
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
mov rdi, qword [rbp + 0x10]
cmp rdx, rdi
jbe 0x1400eb688
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rdi
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400eb6c5
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, rbx
sar rax, 3
je 0x1400eb6c5
cmp rbx, rcx
jbe 0x1400eb6bc
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbx
sar rdi, 3
jmp 0x1400eb6c8
mov rdi, r15
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x130], xmm0
lea r9, [rsp + 0x50]
mov r8d, 1
lea rdx, [rsp + 0x130]
mov rcx, rbp
call fcn.140007440
mov rbx, qword [rbp + 8]
cmp rbx, qword [rbp + 0x10]
jbe 0x1400eb704
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rbx + rdi*8]
cmp rax, qword [rbp + 0x10]
ja 0x1400eb714
cmp rax, qword [rbp + 8]
jae 0x1400eb78c
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
cmp rdx, r8
jl 0x1400eb730
add r14, rcx
mov qword [rsp + 0x30], r14
jmp 0x1400eb791
sub rcx, r8
add rcx, rdx
add r14, rcx
mov qword [rsp + 0x30], r14
jmp 0x1400eb791
cmp r12, 6
je 0x1400eb76d
cmp r12, 1
je 0x1400eb791
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400eb791
mov r8d, dword [rdi + 0x10]
mov edx, dword [rdi]
mov rcx, qword [rsp + 0x58]
call fcn.1401126f0
jmp 0x1400eb791
add r14, rcx
mov qword [rsp + 0x30], r14
jmp 0x1400eb791
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
mov r14, qword [rsp + 0x30]
jmp 0x1400eb791
mov r14, qword [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
add eax, 1
mov dword [rsp + 0x3c], eax
cmp eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
jb 0x1400eb350
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da1e0
mov rdi, rax
lea rcx, [rsp + 0xf0]
call fcn.1400dbc40
test rdi, rdi
jne 0x1400eb2d1
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x90]
call fcn.140115430
cmp r12, rax
jge 0x1400eb9eb
jmp 0x1400eb150
call fcn.140049470
mov rbx, rax
mov rsi, qword [rax]
movzx edi, word [rdi + 0xe]
mov edx, 0x321
lea rcx, str..._ntfsresize.cpp
call fcn.1400e68c0
mov r8, rax
mov dword [rsp + 0x20], edi
mov r9, r12
lea rdx, str._s:_Failed_to_initialize_DataRun_List__FrNumber:_I64d__AttrCode:0x_X.
mov rcx, rbx
call qword [rsi + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd3
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0xf0]
call fcn.1400dbc40
nop
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400ebafe
call fcn.140049470
mov rdi, rax
mov rbx, qword [rax]
mov edx, Ordinal_776
lea rcx, str..._ntfsresize.cpp
call fcn.1400e68c0
mov r8, rax
mov r9, r12
lea rdx, str._s:_Failed_to_read_the_file_record__FrNumber:_I64d.
mov rcx, rdi
call qword [rbx + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd2
call qword [rax + 0x40]
nop
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400ebafe
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0x17
call qword [rax + 0x40]
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d310]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str..._ntfsresize.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400eb9c3
mov byte [rsp + 0x41c0], 0
xor eax, eax
mov qword [rsp + 0x41c1], rax
mov word [rsp + 0x41c9], ax
mov byte [rsp + 0x41cb], al
mov r8d, Ordinal_766
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x41c0]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400eb980
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x41c0]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400eb9b0
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_User_cancel_operations.
mov rcx, rsi
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400ebafe
mov ebx, r15d
mov rsi, r15
mov rdi, r15
mov r14, qword [rsp + 0x58]
nop
nop
mov rax, qword [r13 + 0x2d0]
test rax, rax
jne 0x1400eba11
mov rcx, r15
jmp 0x1400eba1f
mov rcx, qword [r13 + 0x2d8]
sub rcx, rax
sar rcx, 4
mov eax, ebx
cmp rax, rcx
jae 0x1400eba91
mov rcx, qword [r13 + 0x2d0]
test rcx, rcx
je 0x1400eba45
mov rax, qword [r13 + 0x2d8]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x1400eba4b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rcx, qword [r13 + 0x2d0]
lea rdx, [rsp + 0x80]
mov rax, qword [rdi + rcx]
mov qword [rdx], rax
mov rax, qword [rdi + rcx + 8]
mov qword [rdx + 8], rax
mov r8d, dword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
mov rcx, r14
call fcn.1401126f0
add ebx, 1
add rsi, 1
add rdi, 0x10
jmp 0x1400eba00
cmp dword [r13 + 0x144], 0
mov r14, qword [rsp + 0x30]
jne 0x1400ebae4
test r14, r14
jle 0x1400ebaec
movzx ecx, word [r13 + 0x2c]
mov edx, dword [r13 + 0x4348]
imul edx, ecx
mov ecx, edx
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
cqo
and edx, 7
add rax, rdx
sar rax, 3
cqo
idiv rcx
add rax, 1
sub rax, qword [rsp + 0x68]
add rax, r14
mov rcx, qword [rsp + 0x48]
add qword [rcx], rax
jmp 0x1400ebaec
mov rcx, qword [rsp + 0x48]
add qword [rcx], r14
lea rcx, [rsp + 0x90]
call fcn.1401470c0
mov eax, 1
mov rcx, qword [rsp + 0x42a0]
xor rcx, rsp
call fcn.140161080
movaps xmm6, xmmword [rsp + 0x42c0]
movaps xmm7, xmmword [rsp + 0x42b0]
add rsp, 0x42d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret