Function at 0x1400f6c30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x42d8
call sub.ntdll.dll___chkstk
sub rsp, rax
mov qword [rsp + 0x120], 0xfffffffffffffffe
movaps xmmword [rsp + 0x42c0], xmm6
movaps xmmword [rsp + 0x42b0], xmm7
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x42a0], rax
mov qword [rsp + 0x58], r9
mov rsi, r8
mov rbp, rdx
mov r13, rcx
mov rbx, qword [rsp + 0x4340]
mov qword [rsp + 0x48], rbx
xor r15d, r15d
mov qword [rbx], r15
lea rcx, [rsp + 0x90]
call fcn.140115570
nop
mov rax, qword [r13]
movzx r9d, word [r13 + 0x2c]
mov r8, qword [rax + 0x10]
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x90]
call fcn.140115b60
test eax, eax
jne 0x1400f6dcd
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d3a0]
mov rcx, rbx
call sub.ntdll.dll_memset
lea edx, [r15 + 0x5c]
lea rcx, str..._ntfscpyex.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400f6d93
mov byte [rsp + 0x41c0], r15b
xor eax, eax
mov qword [rsp + 0x41c1], rax
mov word [rsp + 0x41c9], ax
mov byte [rsp + 0x41cb], al
mov r8d, Ordinal_751
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x41c0]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400f6d50
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x41c0]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400f6d80
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_Initialize_the__MFT:Bitmap_of_the_source_partition_to_fail.
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd1
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400f780e
lea rcx, [rsp + 0x90]
call fcn.140115430
test rax, rax
jne 0x1400f6e32
call fcn.140049470
mov rdi, rax
mov rbx, qword [rax]
mov edx, reloc.MFC80U.DLL_Ordinal_753
lea rcx, str..._ntfscpyex.cpp
call fcn.1400f1280
mov r8, rax
lea rdx, str._s:_Filesystem_error
mov rcx, rdi
call qword [rbx + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd1
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400f780e
mov r14, r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x38], eax
mov r12, r15
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x90]
call fcn.140115430
test rax, rax
jle 0x1400f76fb
movsd xmm7, qword [0x1403b85a8]
nop
lea rax, [r12 + 1]
mov qword [rsp + 0x70], rax
cvtsi2sd xmm6, rax
lea rcx, [rsp + 0x90]
call fcn.140115430
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
mulsd xmm6, xmm7
cvttsd2si edi, xmm6
mov edx, edi
mov rcx, r13
call fcn.1400f1f90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x38]
cmp eax, 0x3e8
jb 0x1400f6f55
mov word [rsp + 0x41d0], 0
xor edx, edx
mov r8d, 0xc6
lea rcx, [rsp + 0x41d2]
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x90]
call fcn.140115430
mov r9, rax
mov dword [rsp + 0x20], edi
mov r8, qword [rsp + 0x70]
lea rdx, str.Analyzing_volume:__I64d__I64d___d__.
lea rcx, [rsp + 0x41d0]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
lea rdx, [rsp + 0x41d0]
call qword [rax + 0x70]
mov r8d, edi
lea rdx, str.Status:_d
lea rcx, [rsp + 0x41d0]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
lea rdx, [rsp + 0x41d0]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x38], eax
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jne 0x1400f75f7
lea r8d, [rax + 1]
mov rdx, r12
lea rcx, [rsp + 0x90]
call fcn.1401154e0
test eax, eax
je 0x1400f74f4
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9890
nop
xor r9d, r9d
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_320]
mov rdx, r12
lea rcx, [r13 + 0x248]
call fcn.1400de420
test eax, eax
je 0x1400f7593
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9510
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da8d0
mov rdi, rax
test rax, rax
je 0x1400f74e7
cmp byte [rdi + 8], 0
jne 0x1400f7022
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da1e0
mov rdi, rax
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp eax, 0x3e8
jg 0x1400f74e7
jmp 0x1400f74de
lea rcx, [rsp + 0xf0]
call fcn.1400db9e0
nop
mov rdx, rdi
lea rcx, [rsp + 0xf0]
call fcn.1400dbb00
test eax, eax
je 0x1400f7519
lea rcx, [rsp + 0xf0]
call fcn.1400dbfc0
mov ecx, eax
mov dword [rsp + 0x60], eax
mov eax, r15d
mov dword [rsp + 0x3c], eax
test ecx, ecx
je 0x1400f74c1
nop
nop
mov edx, eax
lea rcx, [rsp + 0xf0]
call fcn.1400db970
mov rdi, rax
mov rdx, qword [rax]
cmp rdx, 0xffffffffffffffff
je 0x1400f74a7
cmp r12, 6
jne 0x1400f70a3
mov rax, qword [rsp + 0x68]
add rax, qword [rdi + 0x10]
mov qword [rsp + 0x68], rax
mov rcx, qword [rdi + 0x10]
mov r8, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
lea rax, [rcx + rdx]
cmp rax, r8
jle 0x1400f7460
cmp r12, 6
je 0x1400f7441
cmp rdx, r8
jl 0x1400f70cf
add qword [rbx], rcx
jmp 0x1400f710d
mov rax, rcx
sub rax, r8
add rax, rdx
add qword [rbx], rax
mov rbx, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
sub rbx, qword [rdi]
cmp r12, 1
je 0x1400f74a7
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400f710d
mov r8d, ebx
mov edx, dword [rdi]
mov rcx, qword [rsp + 0x58]
call fcn.1401126f0
cmp r12, 1
je 0x1400f74a7
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400f74a7
mov r14d, r15d
mov ebx, r15d
mov rdi, r15
mov rcx, rbp
call fcn.140007310
test rax, rax
je 0x1400f7187
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400f7159
mov rax, qword [rbp + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400f715f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbp + 8]
cmp qword [rax + rdi*8], r12
je 0x1400f7181
add ebx, 1
add rdi, 1
mov rcx, rbp
call fcn.140007310
mov ecx, ebx
cmp rcx, rax
jb 0x1400f7140
jmp 0x1400f7187
mov r14d, 1
mov ebx, r15d
mov rdi, r15
nop
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
test rax, rax
jne 0x1400f71a1
mov rcx, r15
jmp 0x1400f71af
mov rcx, qword [r13 + 0x208]
sub rcx, rax
sar rcx, 3
mov eax, ebx
cmp rax, rcx
jae 0x1400f7349
mov rcx, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
test rcx, rcx
je 0x1400f71d9
mov rax, qword [r13 + 0x208]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400f71df
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_512]
cmp r12, qword [rax + rdi*8]
je 0x1400f71f5
add ebx, 1
add rdi, 1
jmp 0x1400f7190
mov ebx, r15d
mov rdi, r15
mov rcx, rsi
call fcn.140007310
test rax, rax
je 0x1400f7253
nop
nop
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400f7229
mov rax, qword [rsi + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400f722f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsi + 8]
cmp qword [rax + rdi*8], r12
je 0x1400f748d
add ebx, 1
add rdi, 1
mov rcx, rsi
call fcn.140007310
mov ecx, ebx
cmp rcx, rax
jb 0x1400f7210
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x1400f7261
mov rcx, r15
jmp 0x1400f726c
mov rcx, qword [rsi + 0x10]
sub rcx, rdx
sar rcx, 3
test rdx, rdx
je 0x1400f729a
mov rax, qword [rsi + 0x18]
sub rax, rdx
sar rax, 3
cmp rcx, rax
jae 0x1400f729a
mov rax, qword [rsi + 0x10]
mov qword [rax], r12
add rax, 8
mov qword [rsi + 0x10], rax
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
mov rdi, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1400f72a9
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rdi
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x1400f72e6
mov rcx, qword [rsi + 0x10]
mov rax, rcx
sub rax, rbx
sar rax, 3
je 0x1400f72e6
cmp rbx, rcx
jbe 0x1400f72dd
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbx
sar rdi, 3
jmp 0x1400f72e9
mov rdi, r15
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xe0], xmm0
lea r9, [rsp + 0x50]
mov r8d, 1
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.140007440
mov rbx, qword [rsi + 8]
cmp rbx, qword [rsi + 0x10]
jbe 0x1400f7325
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rbx + rdi*8]
cmp rax, qword [rsi + 0x10]
ja 0x1400f7339
cmp rax, qword [rsi + 8]
jae 0x1400f7494
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
test r14d, r14d
jne 0x1400f749b
mov rdx, qword [rbp + 8]
test rdx, rdx
jne 0x1400f7360
mov rcx, r15
jmp 0x1400f736b
mov rcx, qword [rbp + 0x10]
sub rcx, rdx
sar rcx, 3
test rdx, rdx
je 0x1400f7399
mov rax, qword [rbp + 0x18]
sub rax, rdx
sar rax, 3
cmp rcx, rax
jae 0x1400f7399
mov rax, qword [rbp + 0x10]
mov qword [rax], r12
add rax, 8
mov qword [rbp + 0x10], rax
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
mov rdi, qword [rbp + 0x10]
cmp rdx, rdi
jbe 0x1400f73a8
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rdi
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400f73e5
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, rbx
sar rax, 3
je 0x1400f73e5
cmp rbx, rcx
jbe 0x1400f73dc
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbx
sar rdi, 3
jmp 0x1400f73e8
mov rdi, r15
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x130], xmm0
lea r9, [rsp + 0x50]
mov r8d, 1
lea rdx, [rsp + 0x130]
mov rcx, rbp
call fcn.140007440
mov rbx, qword [rbp + 8]
cmp rbx, qword [rbp + 0x10]
jbe 0x1400f7424
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rbx + rdi*8]
cmp rax, qword [rbp + 0x10]
ja 0x1400f7434
cmp rax, qword [rbp + 8]
jae 0x1400f74a2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
cmp rdx, r8
jl 0x1400f7450
add r14, rcx
mov qword [rsp + 0x30], r14
jmp 0x1400f74a7
sub rcx, r8
add rcx, rdx
add r14, rcx
mov qword [rsp + 0x30], r14
jmp 0x1400f74a7
cmp r12, 6
je 0x1400f74a7
cmp r12, 1
je 0x1400f74a7
mov rdx, r12
mov rcx, r13
call fcn.1400e84b0
test eax, eax
jne 0x1400f74a7
mov r8d, dword [rdi + 0x10]
mov edx, dword [rdi]
mov rcx, qword [rsp + 0x58]
call fcn.1401126f0
jmp 0x1400f74a7
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
mov r14, qword [rsp + 0x30]
jmp 0x1400f74a7
mov r14, qword [rsp + 0x30]
mov eax, dword [rsp + 0x3c]
add eax, 1
mov dword [rsp + 0x3c], eax
cmp eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
jb 0x1400f7070
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400da1e0
mov rdi, rax
lea rcx, [rsp + 0xf0]
call fcn.1400dbc40
test rdi, rdi
jne 0x1400f6ff1
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x90]
call fcn.140115430
cmp r12, rax
jge 0x1400f76fb
jmp 0x1400f6e70
call fcn.140049470
mov rbx, rax
mov rsi, qword [rax]
movzx edi, word [rdi + 0xe]
mov edx, 0x338
lea rcx, str..._ntfscpyex.cpp
call fcn.1400f1280
mov r8, rax
mov dword [rsp + 0x20], edi
mov r9, r12
lea rdx, str._s:_Failed_to_initialize_DataRun_List__FrNumber:_I64d__AttrCode:0x_X.
mov rcx, rbx
call qword [rsi + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd3
call qword [rax + 0x40]
nop
lea rcx, [rsp + 0xf0]
call fcn.1400dbc40
nop
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400f780e
call fcn.140049470
mov rdi, rax
mov rbx, qword [rax]
mov edx, 0x31e
lea rcx, str..._ntfscpyex.cpp
call fcn.1400f1280
mov r8, rax
mov r9, r12
lea rdx, str._s:_Failed_to_read_the_file_record__FrNumber:_I64d.
mov rcx, rdi
call qword [rbx + 0x10]
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0xd2
call qword [rax + 0x40]
nop
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_320]
call fcn.1400d9920
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400f780e
mov rcx, qword [r13 + 0x138]
mov rax, qword [rcx]
mov edx, 0x17
call qword [rax + 0x40]
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d3a0]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str..._ntfscpyex.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400f76d3
mov byte [rsp + 0x41c0], 0
xor eax, eax
mov qword [rsp + 0x41c1], rax
mov word [rsp + 0x41c9], ax
mov byte [rsp + 0x41cb], al
mov r8d, Ordinal_786
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x41c0]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400f7690
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x41c0]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400f76c0
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_User_cancel_operations.
mov rcx, rsi
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x90]
call fcn.1401470c0
xor eax, eax
jmp 0x1400f780e
mov ebx, r15d
mov rsi, r15
mov rdi, r15
mov r14, qword [rsp + 0x58]
nop
nop
mov rax, qword [r13 + 0x2d0]
test rax, rax
jne 0x1400f7721
mov rcx, r15
jmp 0x1400f772f
mov rcx, qword [r13 + 0x2d8]
sub rcx, rax
sar rcx, 4
mov eax, ebx
cmp rax, rcx
jae 0x1400f77a1
mov rcx, qword [r13 + 0x2d0]
test rcx, rcx
je 0x1400f7755
mov rax, qword [r13 + 0x2d8]
sub rax, rcx
sar rax, 4
cmp rsi, rax
jb 0x1400f775b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rcx, qword [r13 + 0x2d0]
lea rdx, [rsp + 0x80]
mov rax, qword [rdi + rcx]
mov qword [rdx], rax
mov rax, qword [rdi + rcx + 8]
mov qword [rdx + 8], rax
mov r8d, dword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
mov rcx, r14
call fcn.1401126f0
add ebx, 1
add rsi, 1
add rdi, 0x10
jmp 0x1400f7710
cmp dword [r13 + 0x144], 0
mov r14, qword [rsp + 0x30]
jne 0x1400f77f4
test r14, r14
jle 0x1400f77fc
movzx ecx, word [r13 + 0x2c]
mov edx, dword [r13 + 0x43f4]
imul edx, ecx
mov ecx, edx
mov rax, qword [r13 + reloc.MFC80U.DLL_Ordinal_576]
cqo
and edx, 7
add rax, rdx
sar rax, 3
cqo
idiv rcx
add rax, 1
sub rax, qword [rsp + 0x68]
add rax, r14
mov rcx, qword [rsp + 0x48]
add qword [rcx], rax
jmp 0x1400f77fc
mov rcx, qword [rsp + 0x48]
add qword [rcx], r14
lea rcx, [rsp + 0x90]
call fcn.1401470c0
mov eax, 1
mov rcx, qword [rsp + 0x42a0]
xor rcx, rsp
call fcn.140161080
movaps xmm6, xmmword [rsp + 0x42c0]
movaps xmm7, xmmword [rsp + 0x42b0]
add rsp, 0x42d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret