Function at 0x1400df570
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x720
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [rsp + Ordinal_1898], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + Ordinal_1812], rax
mov dword [rsp + 0xa0], r9d
mov r14, r8
mov qword [rsp + 0xa8], r8
mov r12, rdx
mov qword [rsp + 0x98], rdx
mov rsi, rcx
lea r15, [rcx + 0x58]
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400e066d
mov rcx, qword [r15 + 0x10]
sub rcx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400e066d
xor r13d, r13d
mov ebx, r13d
mov rdi, r13
mov rcx, rsi
call fcn.1400dc680
test rax, rax
je 0x1400df681
nop
nop
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400df639
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400df63f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsi + 8]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call fcn.1400d9520
cmp rax, r12
je 0x1400df66c
add ebx, 1
add rdi, 1
mov rcx, rsi
call fcn.1400dc680
mov ecx, ebx
cmp rcx, rax
jb 0x1400df620
jmp 0x1400df681
mov rdx, r14
mov rcx, rbp
call fcn.1400da580
mov eax, 1
jmp 0x1400e0758
mov ebp, r13d
mov rdi, r13
mov rcx, rsi
call fcn.1400dc680
test rax, rax
je 0x1400df6e6
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400df6ad
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400df6b3
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsi + 8]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
je 0x1400df6d0
mov rcx, rbx
call fcn.1400d9920
mov rcx, rbx
call sub.MFC80U.DLL_Ordinal_776
add ebp, 1
add rdi, 1
mov rcx, rsi
call fcn.1400dc680
mov ecx, ebp
cmp rcx, rax
jb 0x1400df694
mov rbx, qword [rsi + 0x10]
cmp qword [rsi + 8], rbx
jbe 0x1400df6f6
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jbe 0x1400df706
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp rdi, rbx
je 0x1400df73a
mov rax, qword [rsi + 0x10]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
lea rbp, [rdx + rdi]
test rax, rax
jle 0x1400df736
mov r9, rdx
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_memmove_s]
mov qword [rsi + 0x10], rbp
mov ebx, dword [rsi + 0x44]
xor edx, edx
mov r8d, Ordinal_280
lea rcx, [rsp + 0x120]
call sub.ntdll.dll_memset
mov dword [rsp + 0x120], Ordinal_280
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x124], 6
jae 0x1400df819
mov word [rsp + 0x250], r13w
xor eax, eax
mov qword [rsp + 0x252], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_602], rax
mov qword [rsp + 0x262], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_618], rax
mov qword [rsp + 0x272], rax
mov qword [rsp + 0x27a], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_642], rax
mov dword [rsp + 0x28a], eax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_654], ax
mov r8d, ebx
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x250]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
jmp 0x1400df880
call fcn.1400494c0
mov rdi, qword [rax]
mov edx, ebx
mov rcx, rax
call qword [rdi + 0x18]
test eax, eax
js 0x1400e058d
mov r9d, ebx
mov r8d, eax
lea rdx, [0x1402e0fe0]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400e058d
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x38], r13
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x94]
mov ebp, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
cmove ecx, ebp
mov dword [rsi + 0x7c], ecx
mov eax, dword [rsi + 0x78]
shl eax, 0xb
xor edx, edx
div ecx
mov dword [rsp + 0x48], eax
mov word [rsp + 0x290], r13w
xor eax, eax
mov qword [rsp + 0x292], rax
mov qword [rsp + 0x29a], rax
mov qword [rsp + 0x2a2], rax
mov qword [rsp + 0x2aa], rax
mov qword [rsp + 0x2b2], rax
mov qword [rsp + 0x2ba], rax
mov qword [rsp + 0x2c2], rax
mov dword [rsp + 0x2ca], eax
mov word [rsp + 0x2ce], ax
mov r8d, dword [rsi + 0x44]
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x290]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x94]
test eax, eax
cmove edi, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x7c], edi
mov eax, dword [rsi + 0x78]
imul rax, r12
movzx ecx, word [0x14043d650]
imul ecx, edi
cqo
idiv rcx
mov r14, rax
mov ebp, r13d
mov r12, r13
mov rcx, r15
call fcn.1400dc6a0
test rax, rax
je 0x1400e04aa
mov rdi, r13
nop
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400dfa40
mov rcx, qword [r15 + 0x10]
sub rcx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r12, rdx
jb 0x1400dfa46
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbx, qword [r15 + 8]
mov rcx, qword [rdi + rbx + 8]
cmp r14, rcx
jl 0x1400dfa5e
add rcx, qword [rdi + rbx + 0x10]
cmp r14, rcx
jl 0x1400dfa7e
add ebp, 1
add r12, 1
add rdi, 0x18
mov rcx, r15
call fcn.1400dc6a0
mov ecx, ebp
cmp rcx, rax
jae 0x1400e04aa
jmp 0x1400dfa10
mov r14, rbx
cmp rbx, qword [r15 + 0x10]
jbe 0x1400dfa8d
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_576], r15
mov qword [rsp + 0x248], rbx
nop
mov rbp, qword [r15 + 0x10]
cmp qword [r15 + 8], rbp
jbe 0x1400dfab0
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp r14, rbp
je 0x1400dfafa
cmp r14, qword [r15 + 0x10]
jb 0x1400dfac1
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rdi + rbx]
cmp qword [r14], rax
jne 0x1400dfae0
mov rax, qword [rdi + rbx + 8]
cmp qword [r14 + 8], rax
jne 0x1400dfae0
mov rax, qword [rdi + rbx + 0x10]
cmp qword [r14 + 0x10], rax
je 0x1400dfafa
cmp r14, qword [r15 + 0x10]
jb 0x1400dfaec
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add r14, 0x18
mov qword [rsp + 0x248], r14
jmp 0x1400dfaa0
mov ebp, r13d
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x40], r13d
mov r12d, r13d
mov dword [rsp + 0x58], r13d
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_784], bpl
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x311]
call sub.ntdll.dll_memset
movaps xmm5, xmmword [rsp + reloc.MFC80U.DLL_Ordinal_576]
movdqa xmmword [rsp + 0xb0], xmm5
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [r15 + 0x10]
cmp qword [r15 + 8], rdi
jbe 0x1400dfb55
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp r14, rdi
je 0x1400e0496
cmp ebp, dword [rsp + 0x48]
jge 0x1400e0496
cmp r14, qword [r15 + 0x10]
jb 0x1400dfb74
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rcx, [rsp + 0x80]
mov rax, qword [r14]
mov qword [rcx], rax
mov rax, qword [r14 + 8]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x10]
mov qword [rcx + 0x10], rax
test rbx, rbx
je 0x1400dfb9c
cmp rbx, r15
je 0x1400dfba2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
movzx r10d, word [0x14043d650]
cmp qword [rsp + 0xb8], r14
jne 0x1400dfc0b
mov eax, dword [rsi + 0x78]
imul rax, qword [rsp + 0x98]
movzx ecx, r10w
imul ecx, dword [rsi + 0x7c]
cqo
idiv rcx
mov r9, rax
mov rcx, rax
sub rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
add rdi, rcx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov qword [rsp + 0x90], rdx
jmp 0x1400dfc23
mov rdx, qword [rsp + 0x90]
mov r9, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
movzx r11d, r10w
imul rdi, r11
add rdi, qword [rsi + 0x48]
mov eax, dword [rsp + 0x48]
sub eax, ebp
movsxd rbx, eax
imul rdx, r11
cmp rdx, rbx
cmovl rbx, rdx
mov qword [rsp + 0x68], rbx
mov rcx, r9
imul rcx, r11
mov rax, rcx
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400dfc79
mov r8d, dword [rsi + 0x7c]
mov r15d, reloc.MFC80U.DLL_Ordinal_512
cmp r8d, r15d
jne 0x1400dfc7f
mov qword [rsp + 0x70], 0xffffffffffffffff
jmp 0x1400dfca0
mov r15d, reloc.MFC80U.DLL_Ordinal_512
mov r8d, dword [rsi + 0x7c]
mov rax, r8
imul rax, rcx
mov ecx, dword [rsi + 0x78]
cqo
idiv rcx
mov qword [rsp + 0x70], rax
test rax, rax
jns 0x1400dfea9
test r12d, r12d
je 0x1400dfea9
add r9, 1
imul r9, r11
mov rax, r9
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400dfcd1
cmp r8d, r15d
jne 0x1400dfcd1
or r12, 0xffffffffffffffff
mov qword [rsp + 0x70], r12
jmp 0x1400dfce8
mov eax, r8d
imul rax, r9
mov ecx, dword [rsi + 0x78]
cqo
idiv rcx
mov r12, rax
mov qword [rsp + 0x70], rax
mov r9d, 1
mov r8, rdi
lea rdx, [rsp + 0x510]
mov rcx, qword [rsp + 0x50]
call fcn.1400dc2d0
mov ecx, 0x4078
call sub.MFC80U.DLL_Ordinal_774
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400dfd3d
mov ecx, dword [0x14043d654]
mov dword [rsp + 0x20], ecx
movzx r9d, word [0x14043d650]
mov r8, qword [rsi + 0x48]
mov edx, dword [rsi + 0x44]
mov rcx, rax
call fcn.1400d9890
mov rbp, rax
jmp 0x1400dfd40
mov rbp, r13
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_784]
mov rcx, rbp
call fcn.1400dab50
lea r15, [r12 - 1]
mov rdx, r15
mov rcx, rbp
call fcn.1400d9830
mov r11, qword [rsi + 8]
test r11, r11
jne 0x1400dfd81
mov rcx, r13
jmp 0x1400dfd8c
mov rcx, qword [rsi + 0x10]
sub rcx, r11
sar rcx, 3
test r11, r11
je 0x1400dfdb5
mov rax, qword [rsi + 0x18]
sub rax, r11
sar rax, 3
cmp rcx, rax
jae 0x1400dfdb5
mov rax, qword [rsi + 0x10]
mov qword [rax], rbp
add rax, 8
mov qword [rsi + 0x10], rax
jmp 0x1400dfe62
mov rbx, qword [rsi + 0x10]
cmp r11, rbx
jbe 0x1400dfdc4
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rbx
mov r12, qword [rsi + 8]
test r12, r12
je 0x1400dfe01
mov rcx, qword [rsi + 0x10]
mov rax, rcx
sub rax, r12
sar rax, 3
je 0x1400dfe01
cmp r12, rcx
jbe 0x1400dfdf8
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rbx, r12
sar rbx, 3
jmp 0x1400dfe04
mov rbx, r13
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x110], xmm0
lea r9, [rsp + 0x78]
mov r8d, 1
lea rdx, [rsp + 0x110]
mov rcx, rsi
call fcn.140061590
mov r12, qword [rsi + 8]
cmp r12, qword [rsi + 0x10]
jbe 0x1400dfe40
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [r12 + rbx*8]
cmp rax, qword [rsi + 0x10]
ja 0x1400dfe50
cmp rax, qword [rsi + 8]
jae 0x1400dfe5d
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbx, qword [rsp + 0x68]
jmp 0x1400dfe62
mov rbx, qword [rsp + 0x68]
cmp r15, qword [rsp + 0x98]
jne 0x1400dfe84
mov rdx, qword [rsp + 0xa8]
mov rcx, rbp
call fcn.1400da580
mov dword [rsp + 0x40], 1
add rdi, 1
sub rbx, 1
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x58], r13d
mov ebp, dword [rsp + 0x44]
add ebp, 2
mov dword [rsp + 0x44], ebp
mov r10w, word [0x14043d650]
mov rax, rbx
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400dff02
cmp dword [rsi + 0x7c], reloc.MFC80U.DLL_Ordinal_512
jne 0x1400dfefb
cmp r10w, 1
jne 0x1400dff09
sub rbx, 1
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x58], 1
lea r8, [rbx + rdi]
mov r9d, 1
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_784]
mov r12, qword [rsp + 0x50]
mov rcx, r12
call fcn.1400dc2d0
jmp 0x1400dff0e
mov r12, qword [rsp + 0x50]
jmp 0x1400dff0e
mov r12, qword [rsp + 0x50]
jmp 0x1400dff0e
mov r12, qword [rsp + 0x50]
mov ecx, dword [rsi + 0x7c]
imul rcx, rbx
call sub.MFC80U.DLL_Ordinal_265
mov r15, rax
test rax, rax
je 0x1400e03ae
mov r8d, dword [rsi + 0x7c]
imul r8, rbx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov r9, rbx
mov r8, rdi
mov rdx, r15
mov rcx, r12
call fcn.1400dc2d0
test eax, eax
je 0x1400e02be
mov eax, dword [rsi + 0x7c]
imul rax, rbx
mov ecx, dword [rsi + 0x78]
cqo
idiv rcx
mov rdi, rax
mov qword [rsp + 0x78], rax
mov r12d, r13d
test eax, eax
jle 0x1400e015e
mov ecx, 0x4078
call sub.MFC80U.DLL_Ordinal_774
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400dffad
mov ecx, dword [0x14043d654]
mov dword [rsp + 0x20], ecx
movzx r9d, word [0x14043d650]
mov r8, qword [rsi + 0x48]
mov edx, dword [rsi + 0x44]
mov rcx, rax
call fcn.1400d9890
mov rbx, rax
jmp 0x1400dffb0
mov rbx, r13
mov qword [rsp + 0xc0], rbx
mov edx, dword [rsi + 0x78]
mov ecx, edx
imul ecx, r12d
add rcx, r15
call fcn.1400d94a0
test eax, eax
je 0x1400dfff5
mov r8d, dword [rsi + 0x78]
mov edx, r8d
imul edx, r12d
add rdx, r15
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov rcx, rbx
call fcn.1400dab50
test eax, eax
je 0x1400e01a0
jmp 0x1400e0013
mov r8d, dword [rsi + 0x78]
mov edx, r8d
imul edx, r12d
add rdx, r15
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov rcx, rbx
call fcn.1400dab50
movsxd rax, r12d
mov rcx, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rdx, rax
mov rcx, rbx
call fcn.1400d9830
mov r11, qword [rsi + 8]
test r11, r11
jne 0x1400e003c
mov rcx, r13
jmp 0x1400e0047
mov rcx, qword [rsi + 0x10]
sub rcx, r11
sar rcx, 3
test r11, r11
je 0x1400e0070
mov rax, qword [rsi + 0x18]
sub rax, r11
sar rax, 3
cmp rcx, rax
jae 0x1400e0070
mov rax, qword [rsi + 0x10]
mov qword [rax], rbx
add rax, 8
mov qword [rsi + 0x10], rax
jmp 0x1400e0121
mov rdi, qword [rsi + 0x10]
cmp r11, rdi
jbe 0x1400e007f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rdi
mov rbp, qword [rsi + 8]
test rbp, rbp
je 0x1400e00bc
mov rcx, qword [rsi + 0x10]
mov rax, rcx
sub rax, rbp
sar rax, 3
je 0x1400e00bc
cmp rbp, rcx
jbe 0x1400e00b3
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbp
sar rdi, 3
jmp 0x1400e00bf
mov rdi, r13
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r9, [rsp + 0xc0]
mov r8d, 1
lea rdx, [rsp + 0xf0]
mov rcx, rsi
call fcn.140061590
mov rbp, qword [rsi + 8]
cmp rbp, qword [rsi + 0x10]
jbe 0x1400e00fe
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rbp + rdi*8]
cmp rax, qword [rsi + 0x10]
ja 0x1400e010f
cmp rax, qword [rsi + 8]
jae 0x1400e011c
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdi, qword [rsp + 0x78]
jmp 0x1400e0121
mov rdi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x98]
cmp qword [rsp + 0x60], rax
jne 0x1400e0148
mov rdx, qword [rsp + 0xa8]
mov rcx, rbx
call fcn.1400da580
mov dword [rsp + 0x40], 1
add r12d, 1
cmp r12d, edi
jl 0x1400dff73
mov rbx, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x44]
mov rcx, r15
call sub.MFC80U.DLL_Ordinal_266
add ebp, ebx
mov dword [rsp + 0x44], ebp
cmp dword [rsp + 0xa0], 0
jne 0x1400e0496
lea r15, [rsi + 0x58]
cmp r14, qword [r15 + 0x10]
jb 0x1400e018a
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add r14, 0x18
mov r12d, dword [rsp + 0x58]
mov rbx, qword [rsp + 0xb0]
jmp 0x1400dfb45
call fcn.140049470
mov rbp, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400e0273
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x3ef
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
nop
nop
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400e0230
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0260
mov r13, rsi
mov rax, qword [rbp]
movsxd r9, r12d
add r9, qword [rsp + 0x70]
mov r8, r13
lea rdx, str._s:_Initialize_MftFile_failed._FILE_Record_Number:__I64d
mov rcx, rbp
call qword [rax + 0x10]
mov rcx, r15
call sub.MFC80U.DLL_Ordinal_266
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400e02b7
mov rcx, rbx
call fcn.1400d9920
mov rcx, rbx
call sub.MFC80U.DLL_Ordinal_776
xor eax, eax
jmp 0x1400e0758
call fcn.140049470
mov rbx, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400e0383
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x3e0
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400e0341
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0370
mov r13, rsi
mov rax, qword [rbx]
mov r8, r13
lea rdx, str._s:_Read_sector_failed.
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, r15
call sub.MFC80U.DLL_Ordinal_266
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400e0758
call fcn.140049470
mov rbx, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400e0473
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x3d8
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400e0431
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0460
mov r13, rsi
mov rax, qword [rbx]
mov r8, r13
lea rdx, str._s:_No_sufficient_memory.
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400e0758
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
jmp 0x1400e0758
call fcn.140049470
mov rbx, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400e0573
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], r13b
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x372
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400e0530
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0560
mov r13, rsi
mov rax, qword [rbx]
mov r8, r13
lea rdx, str._s:_Failed_to_get_the_data_run.
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400e0758
call fcn.140049470
mov rbx, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400e0653
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], r13b
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, Ordinal_876
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400e0610
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0640
mov r13, rsi
mov rax, qword [rbx]
mov r8, r13
lea rdx, str._s:_Failed_to_open_disk.
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400e0758
call fcn.140049470
mov rbx, rax
xor edx, edx
mov r8d, 0x80
lea rsi, [0x14043d190]
mov rcx, rsi
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x1400e06ae
xor r13d, r13d
jmp 0x1400e0743
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x34d
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rsi
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400e0700
mov rdi, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400e0730
mov r13, rsi
mov rax, qword [rbx]
mov r8, r13
lea rdx, str._s:_The_data_run_list_of__MFT_is_not_initialization.
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x768]
add rsp, 0x720
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret