Function at 0x1400e13d0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov byte [rax + 0x10], dl
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x770
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
mov rax, qword [0x14016bb40]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov r14, qword [rbp + 0x6b0]
movzx edi, byte [rbp + 0x6b8]
mov byte [rsp + 0x40], dil
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x58], rax
mov rbx, qword [r14 + 0x20]
mov qword [rbp + 0x60], rbx
test rbx, rbx
je 0x1400e1461
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x3f0], rax
mov qword [rbp + 0x3f8], rbx
test rbx, rbx
je 0x1400e147c
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x60]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x400]
call fcn.140062cd0
xor esi, esi
mov dword [rbp + 0x600], esi
mov qword [rbp + 0x608], rsi
or r13d, 0xffffffff
test rbx, rbx
je 0x1400e14cc
lock dec dword [rbx + 8]
jne 0x1400e14cc
mov rbx, qword [rbp + 0x60]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e14cc
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov qword [rsp + 0x50], rsi
mov ecx, 0x18
call fcn.14005e584
test rax, rax
je 0x1400e2f77
mov qword [rsp + 0x48], rax
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x20], eax
mov qword [rbp - 0x10], rsi
mov r12, rsi
mov qword [rsp + 0x60], rsi
mov r15, rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp + 0x18], rsi
mov qword [rbp + 8], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0x178], rax
xorpd xmm10, xmm10
movsd qword [rbp + 0x180], xmm10
mov qword [rbp + 0x188], rsi
mov dword [rbp + 0x190], esi
lea rdx, str.Unknown
lea rcx, [rbp + 0x198]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x1a0], rax
mov dword [rbp + 0x188], ebx
mov qword [rbp + 0x18c], 1
lea rdx, [rbp + 0x178]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x1a0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e15cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e15ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 0x3f0]
call fcn.1400b6900
test al, al
jne 0x1400e174a
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0x1a8], rax
movsd qword [rbp + 0x1b0], xmm10
mov qword [rbp + 0x1b8], rsi
mov dword [rbp + 0x1c0], esi
lea rdx, str.Unknown
lea rcx, [rbp + 0x1c8]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x1d0], rax
mov dword [rbp + 0x1b8], ebx
mov qword [rbp + 0x1bc], 7
lea rdx, [rbp + 0x1a8]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e169e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x1c8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e16c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e16f9
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e16e4
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp + 0x608]
test rcx, rcx
je 0x1400e1713
call fcn.14005e57c
mov rbx, qword [rbp + 0x3f8]
test rbx, rbx
je 0x1400e1743
mov eax, r13d
lock xadd dword [rbx + 8], eax
dec eax
jne 0x1400e1743
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e1743
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
xor al, al
jmp 0x1400e2fb3
mov eax, dword [0x1401785b0]
test al, 1
jne 0x1400e175d
or eax, 1
mov dword [0x1401785b0], eax
mov rax, qword [rbp + 0x430]
mov qword [0x1401785b8], rax
mov qword [0x1401785c0], 1
mov ecx, dword [rbp + 0x600]
movzx r8d, word [rbp + 0x40b]
movzx r9d, byte [rbp + 0x40d]
mov eax, ecx
shl rax, 0xe
dec rax
xor edx, edx
div r8
xor edx, edx
div r9
inc rax
imul r9, r8
imul rax, r9
xor edx, edx
div rcx
mov qword [rbp + 0x268], rax
imul rcx, rax
call fcn.140057728
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp + 0x608]
movzx edx, word [rcx + 0x14]
add rdx, rcx
mov ecx, dword [rdx]
cmp ecx, 0x80
ja 0x1400e1973
je 0x1400e17f6
mov eax, dword [rdx + 4]
add rdx, rax
mov ecx, dword [rdx]
cmp ecx, 0x80
jbe 0x1400e17df
jmp 0x1400e1973
test rdx, rdx
je 0x1400e1973
cmp byte [rdx + 8], 1
jne 0x1400e180b
mov rax, qword [rdx + 0x28]
jmp 0x1400e180e
mov eax, dword [rdx + 0x10]
mov ecx, dword [rbp + 0x600]
cqo
idiv rcx
mov rbx, rax
mov qword [rbp - 0x30], rax
cmp rax, 0xffffffffffffffff
jbe 0x1400e197a
lea rax, [0x140123c98]
mov qword [rbp + 0x2b8], rax
mov dword [rbp + 0x2c0], 0xb2
mov dword [rbp + 0x2c4], 1
mov r8, rbx
lea rdx, str.Too_many_file_records_in_Mft:__I64d
lea rcx, [rbp + 0x2b8]
call fcn.14000b580
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0x208], rax
movsd qword [rbp + 0x210], xmm10
mov qword [rbp + 0x218], rsi
mov dword [rbp + 0x220], esi
lea rdx, str.Unknown
lea rcx, [rbp + 0x228]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x230], rax
mov dword [rbp + 0x218], ebx
mov qword [rbp + 0x21c], 7
lea rdx, [rbp + 0x208]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x230]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e18fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x228]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e1920
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x38]
call fcn.14005e57c
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e1965
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e1950
mov rcx, rax
call fcn.14005e094
nop
jmp 0x1400e1702
mov rbx, rsi
mov qword [rbp - 0x30], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.140033170
nop
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x68], rsi
mov ecx, 0x18
call fcn.14005e584
test rax, rax
je 0x1400e2f3b
mov qword [rbp - 0x70], rax
mov qword [rax], rax
mov rax, qword [rbp - 0x70]
mov qword [rax + 8], rax
mov qword [rsp + 0x68], rsi
test rbx, rbx
je 0x1400e2763
mov qword [rbp + 0x320], rsi
mov qword [rbp + 0x328], rsi
movsd xmm8, qword [0x140135628]
xorps xmm9, xmm9
lea r15, [0x140123f88]
lea r9, [rbp + 0x320]
mov r8b, 1
mov edx, dword [r14 + 0x40]
mov rcx, r14
call fcn.1400c7cc0
test al, al
sete al
test al, al
jne 0x1400e2625
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x268]
div rcx
mov rdi, rax
imul rdi, rcx
mov rsi, rbx
sub rsi, rdi
cmp rcx, rsi
cmovb rsi, rcx
mov qword [rbp + 0x270], rsi
mov r9, rsi
mov r8, qword [rbp - 0x38]
mov rdx, rdi
lea rcx, [rbp + 0x3f0]
call fcn.1400b7350
mov ebx, eax
test eax, eax
js 0x1400e2417
mov eax, dword [0x1401785a4]
test al, 1
jne 0x1400e1aa2
or eax, 1
mov dword [0x1401785a4], eax
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rbp + 0x10]
mov qword [0x1401785a8], r11
jmp 0x1400e1aa9
mov r11, qword [0x1401785a8]
test r11, r11
jne 0x1400e1ab4
movaps xmm1, xmm9
jmp 0x1400e1b20
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x1401785a4]
test r11b, 1
jne 0x1400e1af8
or r11d, 1
mov dword [0x1401785a4], r11d
mov qword [rbp + 0x20], 0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rbp + 0x20]
mov qword [0x1401785a8], r11
jmp 0x1400e1aff
mov r11, qword [0x1401785a8]
mov rax, qword [rbp + 0x280]
sub rax, qword [rbp]
pxor xmm1, xmm1
cvtsi2ss xmm1, rax
pxor xmm0, xmm0
cvtsi2ss xmm0, r11
divss xmm1, xmm0
mov qword [rbp + 0x2d8], r15
mov dword [rbp + 0x2e0], 0xd0
mov dword [rbp + 0x2e4], 3
unpcklps xmm1, xmm1
cvtps2pd xmm0, xmm1
movsd qword [rsp + 0x20], xmm0
mov r9, rsi
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rdx, str.ReadFileRecords_for__I64d__d_took__.3f_seconds.
lea rcx, [rbp + 0x2d8]
call fcn.14000b580
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
sub rbx, rdi
mov r15, rbx
cmp rbx, rsi
jae 0x1400e21bc
mov rdi, qword [rbp - 0x30]
pxor xmm7, xmm7
cvtsi2sd xmm7, rdi
test rdi, rdi
jns 0x1400e1b95
addsd xmm7, xmm8
lea rax, [rbp - 0x28]
mov qword [rbp + 0x3d8], rax
lea rsi, [0x14011a68c]
mov rbx, rsi
shr rbx, 0x10
mov qword [rbp + 0x278], rbx
lea rax, [rbp - 0x28]
mov qword [rbp + 0x3e0], rax
xor edi, edi
mov qword [rbp + 0x380], rdi
mov qword [rbp + 0x388], rdi
jmp 0x1400e1be7
lea rsi, [0x14011a68c]
mov rax, qword [rsp + 0x68]
pxor xmm6, xmm6
cvtsi2sd xmm6, rax
test rax, rax
jns 0x1400e1bff
addsd xmm6, xmm8
divsd xmm6, xmm7
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x28], rax
test rbx, rbx
jne 0x1400e1c41
movzx ebx, si
mov ecx, ebx
call fcn.14001df50
test rax, rax
je 0x1400e1c51
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14001e130
jmp 0x1400e1c51
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.14001e490
nop
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0xf0], rax
movsd qword [rbp + 0xf8], xmm10
mov qword [rbp + 0x100], 0
mov dword [rbp + 0x108], edi
lea rdx, str.Unknown
lea rcx, [rbp + 0x110]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x118], rax
mov dword [rbp + 0x100], ebx
mov qword [rbp + 0x104], 2
movsd qword [rbp + 0xf8], xmm6
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x110]
call fcn.14001deb0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e1cf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rdx, [rbp + 0xf0]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e1d29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e1d4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea r9, [rbp + 0x380]
mov r8b, 1
mov edx, dword [r14 + 0x40]
mov rcx, r14
call fcn.1400c7cc0
test al, al
sete al
test al, al
jne 0x1400e22cf
mov esi, dword [rbp + 0x600]
imul rsi, r15
add rsi, qword [rbp - 0x38]
cmp dword [rsi], 0x454c4946
jne 0x1400e219d
test byte [rsi + 0x16], 1
je 0x1400e219d
cmp qword [rsi + 0x20], 0
jne 0x1400e219d
inc qword [rbp - 0x10]
mov rax, qword [rsp + 0x68]
lea rcx, [rax + rax*4]
mov rax, qword [rsp + 0x70]
lea r12, [rax + rcx*8]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x3a8]
call fcn.140033820
nop
mov rdx, rax
mov rcx, r12
call fcn.14003e010
nop
mov rbx, qword [rbp + 0x3b0]
test rbx, rbx
je 0x1400e1dfc
lock dec dword [rbx + 8]
jne 0x1400e1dfc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e1dfc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, r12
mov rdx, rsi
lea rcx, [rbp + 0x3f0]
call fcn.1400e04b0
test al, al
jne 0x1400e1e6a
mov rbx, qword [rsp + 0x68]
cmp rbx, 0xc
jb 0x1400e1e23
cmp rbx, 0x18
jb 0x1400e1e5d
lea rax, [0x140124098]
mov qword [rbp + 0x2f0], rax
mov dword [rbp + 0x2f8], 0x102
mov dword [rbp + 0x2fc], 1
mov r8, qword [rsp + 0x68]
lea rdx, str.Mft_record_for_file__I64d_doesnt_contain_file_name_attribute.
lea rcx, [rbp + 0x2f0]
call fcn.14000b580
mov rcx, r12
call fcn.140032d60
jmp 0x1400e2198
mov r8, r12
mov rdx, rsi
lea rcx, [rbp + 0x3f0]
call fcn.1400e0670
movzx r11d, word [rsi + 0x14]
add r11, rsi
mov eax, dword [r11]
cmp eax, 0x20
ja 0x1400e1eca
je 0x1400e1e9f
mov eax, dword [r11 + 4]
add r11, rax
mov eax, dword [r11]
cmp eax, 0x20
jbe 0x1400e1e8c
jmp 0x1400e1eca
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
lea r8, [rbp + 0x3f0]
mov rdx, r12
mov rcx, rsi
call fcn.1400e0050
jmp 0x1400e1f44
mov r9, r12
xor r8d, r8d
mov edx, 0x80
mov rcx, rsi
call fcn.1400ded30
mov r11, qword [r12]
cmp byte [r11 + 0x1b], 0
jne 0x1400e1f1c
test byte [rsi + 0x16], 2
je 0x1400e1f1c
mov r9, r12
lea r8, [0x140124240]
mov edx, 0xa0
mov rcx, rsi
call fcn.1400ded30
mov r9, r12
lea r8, [0x140124250]
mov edx, 0x90
mov rcx, rsi
call fcn.1400ded30
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x70]
mov rdx, r12
mov rcx, rsi
call fcn.1400dfa80
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x70]
mov rdx, r12
mov rcx, rsi
call fcn.1400df120
mov rax, qword [r12]
cmp byte [rax + 0x1b], 0
je 0x1400e1f93
test byte [rsi + 0x16], 2
je 0x1400e1f5a
inc qword [rbp + 8]
jmp 0x1400e1f5e
inc qword [rbp + 0x18]
call fcn.1400c87d0
mov rbx, qword [r12]
mov rdi, qword [r14 + 0x18]
mov r8, qword [rax]
lea rdx, [rbx + 0x1b]
mov rcx, rax
call qword [r8 + 0x28]
xor r9d, r9d
test al, al
setne r9b
lea rdx, [rbx + 0x1b]
xor r8d, r8d
mov rcx, rdi
call fcn.1400c5440
xor edi, edi
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x330], rax
mov rax, qword [r14 + 0x20]
mov qword [rbp + 0x338], rax
test rax, rax
je 0x1400e1fb2
lock inc dword [rax + 8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, rsi
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x330]
call fcn.1400dec30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400e2198
mov ecx, dword [rbp - 0x20]
add ecx, 0xc8
cmp eax, ecx
jbe 0x1400e2198
mov dword [rbp - 0x20], eax
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x68], rax
mov rbx, qword [r14 + 0x20]
mov qword [rbp + 0x70], rbx
test rbx, rbx
je 0x1400e2021
lock inc dword [rbx + 8]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x68]
lea rcx, [rbp + 0x68]
mov qword [rbp + 0xd8], rcx
test rdx, rdx
jne 0x1400e2065
test rbx, rbx
je 0x1400e2198
lock dec dword [rbx + 8]
jne 0x1400e2198
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e2198
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x1400e2198
mov r12, qword [rsp + 0x60]
add r12, rdx
mov qword [rsp + 0x60], r12
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], rbx
test rbx, rbx
je 0x1400e209e
lock inc dword [rbx + 8]
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x30], al
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb8]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x370]
call fcn.1400e0a30
mov r11, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xc0]
cmp r11, rax
je 0x1400e2104
sub rax, r11
sar rax, 4
add qword [rbp - 0x18], rax
lea rdx, [rbp + 0xb8]
mov rcx, qword [rbp + 0x68]
call fcn.1400c5540
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rdi
cmp rcx, qword [rsp + 0x48]
je 0x1400e2136
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
cmp rbx, qword [rsp + 0x48]
jne 0x1400e2124
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x1400e215a
mov rdx, qword [rbp + 0xc0]
call fcn.14000cce0
mov rcx, qword [rbp + 0xb8]
call fcn.14005e094
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], rdi
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x1400e219d
lock dec dword [rbx + 8]
jne 0x1400e219d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e219d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x1400e219d
mov r12, qword [rsp + 0x60]
inc r15
inc qword [rsp + 0x68]
mov rsi, qword [rbp + 0x270]
cmp r15, rsi
mov rbx, qword [rbp + 0x278]
jb 0x1400e1be0
mov eax, dword [0x1401785a4]
test al, 1
jne 0x1400e21ee
or eax, 1
mov dword [0x1401785a4], eax
mov qword [rbp + 0x30], 0
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rbp + 0x30]
mov qword [0x1401785a8], r11
jmp 0x1400e21f5
mov r11, qword [0x1401785a8]
test r11, r11
jne 0x1400e2200
movaps xmm1, xmm9
jmp 0x1400e226c
lea rcx, [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, dword [0x1401785a4]
test r11b, 1
jne 0x1400e2244
or r11d, 1
mov dword [0x1401785a4], r11d
mov qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rbp + 0x28]
mov qword [0x1401785a8], r11
jmp 0x1400e224b
mov r11, qword [0x1401785a8]
mov rax, qword [rbp + 0x288]
sub rax, qword [rbp]
pxor xmm1, xmm1
cvtsi2ss xmm1, rax
pxor xmm0, xmm0
cvtsi2ss xmm0, r11
divss xmm1, xmm0
lea rax, [0x1401240b8]
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x298], 0x126
mov dword [rbp + 0x29c], 2
unpcklps xmm1, xmm1
cvtps2pd xmm3, xmm1
movq r9, xmm3
mov r8, rsi
lea rdx, str.Processing__d_items_took__.3f_seconds.
lea rcx, [rbp + 0x290]
call fcn.14000b580
mov rbx, qword [rsp + 0x68]
inc rbx
mov qword [rsp + 0x68], rbx
cmp rbx, qword [rbp - 0x30]
jae 0x1400e2407
mov rbx, qword [rbp - 0x30]
jmp 0x1400e19f0
lea rax, [0x140123fa8]
mov qword [rbp + 0x258], rax
mov dword [rbp + 0x260], 0xdc
mov dword [rbp + 0x264], 1
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, qword [rbp - 0x18]
lea rdx, str.Aborting_at___I64u__I64u__I64u__I64u__I64u__file...
lea rcx, [rbp + 0x258]
call fcn.14000b5d0
nop
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x70]
mov qword [rax + 8], rax
mov qword [rbp - 0x68], rdi
mov rax, qword [rbp - 0x70]
cmp rcx, rax
je 0x1400e235b
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rbp - 0x70]
cmp rbx, rax
jne 0x1400e2347
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400e237f
mov rdx, qword [rbp - 0x50]
call fcn.140033e50
mov rcx, qword [rbp - 0x58]
call fcn.14005e094
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e23a9
mov rdx, qword [rsp + 0x78]
call fcn.140033e50
mov rcx, qword [rsp + 0x70]
call fcn.14005e094
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rbp - 0x38]
call fcn.14005e57c
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e23f9
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e23e4
mov rcx, rax
call fcn.14005e094
nop
jmp 0x1400e1702
mov r15, qword [rbp - 0x18]
movzx edi, byte [rsp + 0x40]
xor esi, esi
jmp 0x1400e2763
lea rdx, [rbp + 0x2a0]
mov rcx, qword [r14 + 0x18]
call fcn.140001bd0
nop
lea rcx, [0x140123e88]
mov qword [rbp + 0x2c8], rcx
mov dword [rbp + 0x2d0], 0xcb
mov dword [rbp + 0x2d4], 2
mov r9d, ebx
mov r8, qword [rax]
lea rdx, str.CNtfs::ReadFileRecords_for_volume__s_failed_with_error_code_0x_08x.
lea rcx, [rbp + 0x2c8]
call fcn.14000b5d0
nop
mov rdx, qword [rbp + 0x2a0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e2486
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0x148], rax
movsd qword [rbp + 0x150], xmm10
xor edi, edi
mov qword [rbp + 0x158], rdi
mov dword [rbp + 0x160], edi
lea rdx, str.Unknown
lea rcx, [rbp + 0x168]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x170], rax
mov dword [rbp + 0x158], ebx
mov qword [rbp + 0x15c], 7
lea rdx, [rbp + 0x148]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e2523
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e2546
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x70]
mov qword [rax + 8], rax
mov qword [rbp - 0x68], rdi
mov rax, qword [rbp - 0x70]
cmp rcx, rax
je 0x1400e2579
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rbp - 0x70]
cmp rbx, rax
jne 0x1400e2565
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400e259d
mov rdx, qword [rbp - 0x50]
call fcn.140033e50
mov rcx, qword [rbp - 0x58]
call fcn.14005e094
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e25c7
mov rdx, qword [rsp + 0x78]
call fcn.140033e50
mov rcx, qword [rsp + 0x70]
call fcn.14005e094
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov rcx, qword [rbp - 0x38]
call fcn.14005e57c
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e2617
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e2602
mov rcx, rax
call fcn.14005e094
nop
jmp 0x1400e1702
lea rax, [0x140123e00]
mov qword [rbp + 0x238], rax
mov dword [rbp + 0x240], 0xbf
mov dword [rbp + 0x244], 1
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9, r12
mov r8, qword [rbp - 0x18]
lea rdx, [0x140123e20]
lea rcx, [rbp + 0x238]
call fcn.14000b5d0
nop
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x70]
mov qword [rax + 8], rax
xor esi, esi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp - 0x70]
cmp rcx, rax
je 0x1400e26b4
nop dword [rax + rax]
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rbp - 0x70]
cmp rbx, rax
jne 0x1400e26a0
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400e26d8
mov rdx, qword [rbp - 0x50]
call fcn.140033e50
mov rcx, qword [rbp - 0x58]
call fcn.14005e094
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e2702
mov rdx, qword [rsp + 0x78]
call fcn.140033e50
mov rcx, qword [rsp + 0x70]
call fcn.14005e094
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov rcx, qword [rbp - 0x38]
call fcn.14005e57c
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e2755
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e2740
mov rcx, rax
call fcn.14005e094
nop
jmp 0x1400e1702
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x48], rax
mov rbx, qword [r14 + 0x20]
mov qword [rbp + 0x50], rbx
test rbx, rbx
je 0x1400e2784
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
mov qword [rbp + 0xd8], rcx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400e279e
jmp 0x1400e28a2
add r12, rcx
mov qword [rsp + 0x60], r12
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0x350], rax
mov qword [rbp + 0x358], rbx
test rbx, rbx
je 0x1400e27d2
lock inc dword [rbx + 8]
mov byte [rsp + 0x30], dil
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x98]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x350]
call fcn.1400e0a30
mov r11, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
cmp r11, rax
je 0x1400e2833
sub rax, r11
sar rax, 4
add r15, rax
lea rdx, [rbp + 0x98]
mov rcx, qword [rbp + 0x48]
call fcn.1400c5540
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
cmp rcx, qword [rsp + 0x48]
je 0x1400e2865
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
cmp rbx, qword [rsp + 0x48]
jne 0x1400e2853
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1400e2889
mov rdx, qword [rbp + 0xa0]
call fcn.14000cce0
mov rcx, qword [rbp + 0x98]
call fcn.14005e094
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x1400e28c5
lock dec dword [rbx + 8]
jne 0x1400e28c5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e28c5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
sub rcx, qword [rsp + 0x70]
movabs rax, 0x6666666666666667
imul rcx
mov rsi, rdx
sar rsi, 4
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov r12, rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x2e8], rax
mov rbx, qword [rbp - 8]
cmp rbx, qword [rbp + 0x2e8]
je 0x1400e2a58
xor eax, eax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x130]
call fcn.1400330f0
nop
mov rax, qword [rbx]
mov qword [rbp + 0xe0], rax
mov rcx, qword [rbx + 8]
mov qword [rbp + 0xe8], rcx
test rcx, rcx
je 0x1400e2956
lock inc dword [rcx + 8]
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x120], rax
mov rdi, qword [rbp + 0x128]
mov qword [rbp + 0x128], rcx
test rdi, rdi
je 0x1400e2995
lock dec dword [rdi + 8]
jne 0x1400e2995
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
lock dec dword [rdi + 0xc]
jne 0x1400e2995
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rax, qword [rbp + 0xe0]
mov qword [rax + 0xb], r12
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x70]
call fcn.140032df0
mov r11, qword [rbp - 8]
xor eax, eax
mov qword [r11], rax
mov rdi, qword [rbx + 8]
mov qword [rbx + 8], rax
test rdi, rdi
je 0x1400e29e5
lock dec dword [rdi + 8]
jne 0x1400e29e5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
lock dec dword [rdi + 0xc]
jne 0x1400e29e5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
inc r12
mov rdi, qword [rbp + 0x130]
mov rcx, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rcx, rdi
je 0x1400e2a10
nop
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
cmp rbx, rdi
jne 0x1400e2a00
mov rcx, rdi
call fcn.14005e094
mov r11, qword [rbp + 0x128]
test r11, r11
je 0x1400e2a4e
lock dec dword [r11 + 8]
jne 0x1400e2a4e
mov rbx, qword [rbp + 0x128]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e2a4e
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
add qword [rbp - 8], 0x28
jmp 0x1400e2903
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
sub rcx, r8
movabs rdi, 0x6666666666666667
mov rax, rdi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jae 0x1400e2afe
lea rbx, [rsi + rsi*4]
shl rbx, 3
lea r9, [r8 + rbx]
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x310], rax
mov rax, qword [r14 + 0x20]
mov qword [rbp + 0x318], rax
test rax, rax
je 0x1400e2ab3
lock inc dword [rax + 8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x310]
call fcn.1400dec30
inc rsi
add rbx, 0x28
mov rcx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x1400e2a90
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x38], rax
mov rbx, qword [r14 + 0x20]
mov qword [rbp + 0x40], rbx
test rbx, rbx
je 0x1400e2b1f
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x38]
lea rcx, [rbp + 0x38]
mov qword [rbp + 0xd8], rcx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400e2b68
test rbx, rbx
je 0x1400e2c82
lock dec dword [rbx + 8]
jne 0x1400e2c82
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e2c82
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x1400e2c82
mov rdi, qword [rsp + 0x60]
add rdi, rcx
xor esi, esi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rbx
test rbx, rbx
je 0x1400e2b9b
lock inc dword [rbx + 8]
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x30], al
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x78]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x300]
call fcn.1400e0a30
mov r11, qword [rbp + 0x78]
mov rax, qword [rbp + 0x80]
cmp r11, rax
je 0x1400e2bf7
sub rax, r11
sar rax, 4
add r15, rax
lea rdx, [rbp + 0x78]
mov rcx, qword [rbp + 0x38]
call fcn.1400c5540
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
cmp rcx, qword [rsp + 0x48]
je 0x1400e2c29
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
cmp rbx, qword [rsp + 0x48]
jne 0x1400e2c17
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x1400e2c47
mov rdx, qword [rbp + 0x80]
call fcn.14000cce0
mov rcx, qword [rbp + 0x78]
call fcn.14005e094
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rsi
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x1400e2c89
lock dec dword [rbx + 8]
jne 0x1400e2c89
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e2c89
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x1400e2c89
xor esi, esi
mov rdi, qword [rsp + 0x60]
mov rbx, qword [r14 + 0x18]
add rbx, 0x3d0
mov qword [rbp + 0x340], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0x348], 1
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x360], rax
mov rax, qword [r14 + 0x20]
mov qword [rbp + 0x368], rax
test rax, rax
je 0x1400e2cd1
lock inc dword [rax + 8]
mov rbx, qword [rbp + 0x340]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x360]
call fcn.1400dff80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [r14 + 0x18]
mov byte [r11 + 0x171], 1
mov ebx, dword [r14 + 0x40]
lea rax, vtable.OperationStatus.0
mov qword [rbp + 0x1d8], rax
movsd qword [rbp + 0x1e0], xmm10
mov qword [rbp + 0x1e8], 0
mov dword [rbp + 0x1f0], esi
lea rdx, str.Unknown
lea rcx, [rbp + 0x1f8]
call fcn.14001e210
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x200], rax
mov dword [rbp + 0x1e8], ebx
mov qword [rbp + 0x1ec], 6
lea rdx, [rbp + 0x1d8]
mov rcx, r14
call fcn.140022750
nop
mov rdx, qword [rbp + 0x200]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e2d97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x1f8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400e2db9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, str.CAnalysis::AnalyzeNtfsVolume
mov qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin], rax
mov dword [rbp + 0x2b0], 0x151
mov dword [rbp + 0x2b4], 1
mov rax, qword [rbp + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, r15
lea rdx, str.Processed___I64u__I64u__I64u__I64u__I64u__I64u__files.
lea rcx, [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.14000b5d0
nop
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp - 0x70]
mov qword [rax + 8], rax
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp - 0x70]
cmp rcx, rax
je 0x1400e2e4c
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rbp - 0x70]
cmp rbx, rax
jne 0x1400e2e38
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400e2e70
mov rdx, qword [rbp - 0x50]
call fcn.140033e50
mov rcx, qword [rbp - 0x58]
call fcn.14005e094
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400e2e9a
mov rdx, qword [rsp + 0x78]
call fcn.140033e50
mov rcx, qword [rsp + 0x70]
call fcn.14005e094
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov rcx, qword [rbp - 0x38]
call fcn.14005e57c
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rax
mov qword [rsp + 0x50], rsi
mov rax, qword [rsp + 0x48]
cmp rcx, rax
je 0x1400e2eea
mov rbx, qword [rcx]
call fcn.14005e094
mov rcx, rbx
mov rax, qword [rsp + 0x48]
cmp rbx, rax
jne 0x1400e2ed5
mov rcx, rax
call fcn.14005e094
nop
mov rcx, qword [rbp + 0x608]
test rcx, rcx
je 0x1400e2f04
call fcn.14005e57c
mov rbx, qword [rbp + 0x3f8]
test rbx, rbx
je 0x1400e2f34
mov eax, r13d
lock xadd dword [rbx + 8], eax
dec eax
jne 0x1400e2f34
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x1400e2f34
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov al, 1
jmp 0x1400e2fb3
mov qword [rbp + 0x248], rsi
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x390]
call fcn.14005e770
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x390], r11
lea rdx, [0x1401692c0]
lea rcx, [rbp + 0x390]
call fcn.140062dbc
nop
mov qword [rbp + 0x250], rsi
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x3b8]
call fcn.14005e770
lea r11, vtable.std::bad_alloc.0
mov qword [rbp + 0x3b8], r11
lea rdx, [0x1401692c0]
lea rcx, [rbp + 0x3b8]
call fcn.140062dbc
nop
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.14005e0b0
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret