Function at 0x1000f338
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push 0xd84
mov eax, 0x10044df5
call fcn.1002f38a
mov eax, dword [ebp + 0xc]
movsx bx, byte [ebp + 8]
mov dword [ebp - 0xd88], eax
push 0x3a
pop eax
mov word [ebp - 0x22], ax
push 0x5c
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0xfe
mov word [ebp - 0x164], ax
xor edi, edi
lea eax, [ebp - 0x162]
push edi
push eax
mov esi, ecx
call fcn.100321a0
add esp, 0xc
xor eax, eax
push 0x3e
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push edi
push eax
call fcn.100321a0
add esp, 0xc
mov dword [ebp - method.MemoryHolder_wchar_t_const__.virtual_0], vtable.MemoryHolder_wchar_t_const__.0
mov dword [ebp - 0xd80], edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
pop ecx
cdq
idiv ecx
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xd7c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002dd99
mov dword [ebp - 0xd80], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xd70], eax
test eax, eax
je 0x1000f44a
and dword [ebp - 0xd68], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
cmp edi, eax
jb 0x1000f41a
call fcn.1002e810
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0xd68]
cmp dword [eax + 0x18], 8
jb 0x1000f42e
mov eax, dword [eax + 4]
jmp 0x1000f431
add eax, 4
mov ecx, dword [ebp - 0xd80]
add dword [ebp - 0xd68], 0x1c
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [ebp - 0xd70]
jne 0x1000f405
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x20
mov dword [ebp - 0xd8c], eax
lea eax, [ebp - 0x64]
push eax
xor esi, esi
push esi
push esi
push esi
push 0x80
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1000f67c
push str.ntfs
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000f663
mov dword [ebp - 0xd68], esi
mov esi, ebx
call fcn.1000e9a1
mov esi, eax
test esi, esi
jne 0x1000f4ba
mov dword [ebp - 0xd68], 3
jmp 0x1000f61e
call fcn.1000ead2
or eax, edx
je 0x1000f60f
lea eax, [ebp - 0xd90]
push eax
mov eax, esi
call fcn.1000f1b4
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0xd78], 0
cmp dword [esi + 0xc], 0
mov edi, eax
mov eax, dword [esi + 0x248]
jbe 0x1000f619
mov dword [ebp - 0xd74], eax
test byte [eax + 6], 1
je 0x1000f5e9
mov eax, dword [eax]
test eax, eax
je 0x1000f5e9
call fcn.1000f2ef
test eax, eax
jne 0x1000f5e9
and dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd70], eax
je 0x1000f5e9
mov eax, dword [ebp - 0xd74]
push dword [eax]
mov eax, dword [ebp - 0xd80]
mov ecx, dword [ebp - 0xd6c]
mov ebx, dword [eax + ecx*4]
call fcn.10015c94
test eax, eax
jne 0x1000f562
inc dword [ebp - 0xd6c]
mov eax, dword [ebp - 0xd6c]
cmp eax, dword [ebp - 0xd70]
jne 0x1000f52e
mov eax, dword [ebp - 0xd70]
cmp dword [ebp - 0xd6c], eax
je 0x1000f5e9
xor eax, eax
mov word [ebp - 0xd64], ax
lea eax, [ebp - 0xd64]
push eax
mov eax, dword [ebp - 0xd78]
push esi
call fcn.1000f22a
pop ecx
pop ecx
test eax, eax
je 0x1000f5e9
cmp word [eax], 0
je 0x1000f5e9
push 0x200
push eax
lea eax, [ebp - 0x564]
xor ecx, ecx
push eax
mov word [ebp - 0x564], cx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0xd74]
push dword [eax]
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x564], 0
je 0x1000f5e9
push dword [ebp - 0xd88]
lea eax, [ebp - 0x564]
push eax
call fcn.1000a9f1
test eax, eax
je 0x1000f619
inc dword [ebp - 0xd78]
mov eax, dword [ebp - 0xd74]
mov ecx, dword [ebp - 0xd78]
add eax, 0x10
mov dword [ebp - 0xd74], eax
cmp ecx, dword [esi + 0xc]
jb 0x1000f4fb
jmp 0x1000f619
mov dword [ebp - 0xd68], 4
call fcn.1000e9fd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
sub edi, dword [ebp - 0xd8c]
push eax
movsx eax, byte [ebp + 8]
push edi
push dword [ebp - 0xd68]
push eax
push str.NSFindFile_finished_:_c__status:__d___parse_mft_cost__d_ms__find_cost__d_ms_n
call fcn.10027287
add esp, 0x14
cmp dword [ebp - 0xd80], 0
je 0x1000f65b
push dword [ebp - 0xd80]
call fcn.1002ec0a
pop ecx
mov eax, dword [ebp - 0xd68]
jmp 0x1000f693
cmp dword [ebp - 0xd80], esi
je 0x1000f677
push dword [ebp - 0xd80]
call fcn.1002ec0a
pop ecx
push 2
pop eax
jmp 0x1000f693
cmp dword [ebp - 0xd80], esi
je 0x1000f690
push dword [ebp - 0xd80]
call fcn.1002ec0a
pop ecx
xor eax, eax
inc eax
call fcn.1002f40d
ret 8