Function at 0x180017bb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0xc05f8
call fcn.180011ab0
sub rsp, rax
mov rax, qword [0x1800810b0]
xor rax, rsp
mov qword [rsp + 0xc05e8], rax
mov byte [rsp + 0xc0140], 1
mov byte [rsp + 0xc0141], 2
mov byte [rsp + 0xc0142], 4
mov byte [rsp + 0xc0143], 8
mov byte [rsp + 0xc0144], 0x10
mov byte [rsp + 0xc0145], 0x20
mov byte [rsp + 0xc0146], 0x40
mov byte [rsp + 0xc0147], 0x80
call fcn.18002cca0
mov qword [rsp + 0xc05b0], rax
mov ecx, 0x40000
call fcn.180004750
mov qword [rsp + 0xc0198], rax
cmp qword [rsp + 0xc0198], 0
jne 0x180017c66
lea r9, [0x18003b340]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
xor eax, eax
jmp 0x180019331
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0178]
mov r8d, 0x200
mov rdx, qword [rsp + 0xc0198]
mov rax, qword [rsp + 0xc0608]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xc0138], eax
cmp dword [rsp + 0xc0138], 0
je 0x180017cd2
cmp dword [rsp + 0xc0178], 0x200
je 0x180017d35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x200
lea r8, [rsp + 0xc01a0]
mov edx, eax
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rax, [rsp + 0xc01a0]
mov qword [rsp + 0x20], rax
lea r9, [0x18003b380]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0198]
movabs rcx, 0x202020205346544e
cmp qword [rax + 3], rcx
je 0x180017d7d
lea r9, str.This_is_not_an_NTFS_disk__different_cookie_.
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0608]
mov dword [rax + 0x108], 1
mov rax, qword [rsp + 0xc0198]
movzx eax, word [rax + 0xb]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0198]
movzx eax, byte [rax + 0xd]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc0198]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xc0198]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xc0198]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xc0198]
mov eax, dword [rax + 0x40]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0x80
jb 0x180017e43
mov eax, 0x100
sub eax, dword [rsp + 0x98]
mov ecx, 1
mov qword [rsp + 0xc05d0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xc05d0]
shl rax, cl
mov qword [rsp + 0xe8], rax
jmp 0x180017e64
mov eax, dword [rsp + 0x98]
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xc0198]
mov eax, dword [rax + 0x44]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0608]
mov qword [rcx + 0x1a0], rax
cmp qword [rsp + 0xc8], 0
jbe 0x180017ec3
xor edx, edx
mov rax, qword [rsp + 0xd0]
div qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0608]
mov qword [rcx + 0x198], rax
lea r9, str.This_is_an_NTFS_disk.
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0198]
mov rax, qword [rax + 3]
mov qword [rsp + 0x20], rax
lea r9, str.__Disk_cookie:__I64X
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x18003ad88]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, str.__TotalSectors:__I64u
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [0x18003abe8]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0198]
movzx eax, word [rax + 0x18]
mov dword [rsp + 0x20], eax
lea r9, [0x18003b500]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0198]
movzx eax, word [rax + 0x1a]
mov dword [rsp + 0x20], eax
lea r9, [0x18003b530]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, str.__MftStartLcn:__I64u
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, str.__Mft2StartLcn:__I64u
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x20], rax
lea r9, str.__BytesPerMftRecord:__I64u
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, str.__ClustersPerIndexRecord:__I64u
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0198]
movzx eax, byte [rax + 0x15]
mov dword [rsp + 0x20], eax
lea r9, [0x18003ae58]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0198]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rax
lea r9, str.__VolumeSerialNumber:__I64X
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
xor edx, edx
div qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0608]
mov qword [rcx + 0x110], rax
mov rax, qword [rsp + 0xd8]
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov qword [rsp + 0xc0168], rax
mov eax, dword [rsp + 0xc0168]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xc016c]
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0178]
mov r8d, dword [rsp + 0xe8]
mov rdx, qword [rsp + 0xc0198]
mov rax, qword [rsp + 0xc0608]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xc0138], eax
cmp dword [rsp + 0xc0138], 0
je 0x18001819d
mov eax, dword [rsp + 0xc0178]
cmp rax, qword [rsp + 0xe8]
je 0x180018200
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x200
lea r8, [rsp + 0xc01a0]
mov edx, eax
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rax, [rsp + 0xc01a0]
mov qword [rsp + 0x20], rax
lea r9, str.Error_while_reading_first_MFT_record:__s
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0198]
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0608]
mov rcx, qword [rsp + 0xc0600]
call fcn.180015f20
test eax, eax
jne 0x18001824a
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
xor eax, eax
jmp 0x180019331
mov qword [rsp + 0x60], 0
mov qword [rsp + 0xc0190], 0
mov qword [rsp + 0xc0158], 0
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0198]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0158]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0190]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0608]
mov rcx, qword [rsp + 0xc0600]
call fcn.180017290
mov dword [rsp + 0xc0138], eax
cmp dword [rsp + 0xc0138], 0
je 0x18001832e
cmp qword [rsp + 0xc0190], 0
je 0x18001832e
cmp qword [rsp + 0x60], 0
je 0x18001832e
cmp qword [rsp + 0xa0], 0
je 0x18001832e
cmp qword [rsp + 0xc0158], 0
jne 0x180018390
lea r9, str.Fatal_error__cannot_process_this_disk.
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0158]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str.MftDataBytes___I64u__MftBitmapBytes___I64u
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
lea r9, [0x18003b760]
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov qword [rsp + 0xc0180], 0
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc05a8], rax
jmp 0x18001841d
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xc05a8], rax
cmp qword [rsp + 0xc05a8], 0
je 0x18001848e
mov rax, qword [rsp + 0xc05a8]
cmp qword [rax], 0xffffffffffffffff
je 0x180018475
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0xc0180]
mov rax, qword [rax + 8]
sub rax, rcx
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0180], rax
jmp 0x180018409
mov rax, qword [rsp + 0xc0158]
cmp qword [rsp + 0xb0], rax
jae 0x1800184b0
mov rax, qword [rsp + 0xc0158]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xb0]
call fcn.180004750
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x180018532
lea r9, [0x18003b658]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov r8, qword [rsp + 0xc0158]
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.1800038a0
mov qword [rsp + 0xc0180], 0
mov qword [rsp + 0x90], 0
lea r9, str.Reading__MFT::_BITMAP_into_memory
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc05a8], rax
jmp 0x1800185a3
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xc05a8], rax
cmp qword [rsp + 0xc05a8], 0
je 0x180018880
mov rax, qword [rsp + 0xc05a8]
cmp qword [rax], 0xffffffffffffffff
je 0x180018867
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0xc0180]
mov rax, qword [rax + 8]
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [0x18003b850]
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax]
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov qword [rsp + 0xc0168], rax
mov eax, dword [rsp + 0xc0168]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xc016c]
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0xc0180]
mov rax, qword [rax + 8]
sub rax, rcx
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc05a8]
mov rdx, qword [rsp + 0xc0180]
mov rcx, qword [rcx + 8]
sub rcx, rdx
mov rdx, qword [rsp + 0xc05a8]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.____Reading__I64u_clusters___I64u_bytes__from_LCN_I64u
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0xc0180]
mov rax, qword [rax + 8]
sub rax, rcx
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x90]
imul rcx, qword [rsp + 0xc0]
imul rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xa8]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xc0178]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0xc0608]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xc0138], eax
cmp dword [rsp + 0xc0138], 0
je 0x18001879b
mov eax, dword [rsp + 0xc0178]
mov rcx, qword [rsp + 0xc05a8]
mov rdx, qword [rsp + 0xc0180]
mov rcx, qword [rcx + 8]
sub rcx, rdx
imul rcx, qword [rsp + 0xc0]
imul rcx, qword [rsp + 0xc8]
cmp rax, rcx
je 0x18001883d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x200
lea r8, [rsp + 0xc01a0]
mov edx, eax
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rax, [rsp + 0xc01a0]
mov qword [rsp + 0x20], rax
lea r9, str.___s
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xa8]
call fcn.180004b4c
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
sub rax, qword [rsp + 0xc0180]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0180], rax
jmp 0x18001858f
mov rax, qword [rsp + 0xc0158]
shl rax, 3
mov qword [rsp + 0xc0150], rax
xor edx, edx
mov rax, qword [rsp + 0x60]
div qword [rsp + 0xe8]
cmp qword [rsp + 0xc0150], rax
jbe 0x1800188c4
xor edx, edx
mov rax, qword [rsp + 0x60]
div qword [rsp + 0xe8]
mov qword [rsp + 0xc0150], rax
mov rax, qword [rsp + 0xc0150]
shl rax, 3
mov rcx, rax
call fcn.180004750
mov qword [rsp + 0xc0188], rax
cmp qword [rsp + 0xc0188], 0
jne 0x18001894d
lea r9, [0x18003b930]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0188]
mov rcx, qword [rsp + 0xc0608]
mov rcx, qword [rcx + 0x120]
mov qword [rax], rcx
mov qword [rsp + 0xc0160], 1
jmp 0x180018988
mov rax, qword [rsp + 0xc0160]
inc rax
mov qword [rsp + 0xc0160], rax
mov rax, qword [rsp + 0xc0150]
cmp qword [rsp + 0xc0160], rax
jae 0x1800189b4
mov rax, qword [rsp + 0xc0188]
mov rcx, qword [rsp + 0xc0160]
mov qword [rax + rcx*8], 0
jmp 0x180018975
mov rax, qword [rsp + 0xc0190]
mov qword [rsp + 0xc05a8], rax
mov qword [rsp + 0xc0130], 0
mov qword [rsp + 0xc0180], 0
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x218], 0
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x210], 0
lea rcx, [rsp + 0xc05c0]
call fcn.1800049b8
mov rax, qword [rsp + 0xc05c0]
imul rax, rax, 0x3e8
movzx ecx, word [rsp + 0xc05c8]
add rax, rcx
mov qword [rsp + 0xc05a0], rax
mov qword [rsp + 0xc0160], 1
jmp 0x180018a5e
mov rax, qword [rsp + 0xc0160]
inc rax
mov qword [rsp + 0xc0160], rax
mov rax, qword [rsp + 0xc0150]
cmp qword [rsp + 0xc0160], rax
jae 0x180018ae3
mov rax, qword [rsp + 0xc0160]
shr rax, 3
mov rcx, qword [rsp + 0xa8]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc05d8], eax
xor edx, edx
mov rax, qword [rsp + 0xc0160]
mov ecx, 8
div rcx
mov rax, rdx
movzx eax, byte [rsp + rax + 0xc0140]
mov ecx, dword [rsp + 0xc05d8]
and ecx, eax
mov eax, ecx
test eax, eax
jne 0x180018abd
jmp 0x180018a4b
mov rax, qword [rsp + 0xc0608]
mov rax, qword [rax + 0x210]
inc rax
mov rcx, qword [rsp + 0xc0608]
mov qword [rcx + 0x210], rax
jmp 0x180018a4b
mov qword [rsp + 0xc0160], 1
jmp 0x180018b04
mov rax, qword [rsp + 0xc0160]
inc rax
mov qword [rsp + 0xc0160], rax
mov rax, qword [rsp + 0xc0150]
cmp qword [rsp + 0xc0160], rax
jae 0x18001917e
mov rax, qword [rsp + 0xc0608]
mov rax, qword [rax + 8]
cmp dword [rax], 0
je 0x180018b30
jmp 0x18001917e
mov rax, qword [rsp + 0xc0160]
shr rax, 3
mov rcx, qword [rsp + 0xa8]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc05dc], eax
xor edx, edx
mov rax, qword [rsp + 0xc0160]
mov ecx, 8
div rcx
mov rax, rdx
movzx eax, byte [rsp + rax + 0xc0140]
mov ecx, dword [rsp + 0xc05dc]
and ecx, eax
mov eax, ecx
test eax, eax
jne 0x180018ba9
mov rax, qword [rsp + 0xc0160]
mov qword [rsp + 0x20], rax
lea r9, str.Inode__I64u_is_not_in_use.
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
jmp 0x180018af1
mov rax, qword [rsp + 0xc0608]
mov rax, qword [rax + 0x218]
inc rax
mov rcx, qword [rsp + 0xc0608]
mov qword [rcx + 0x218], rax
mov rax, qword [rsp + 0xc0130]
cmp qword [rsp + 0xc0160], rax
jb 0x18001902a
mov rdx, qword [rsp + 0xc0608]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SlowDown_struct_DefragDataStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0160]
mov qword [rsp + 0xc0148], rax
xor edx, edx
mov eax, 0x40000
div qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0148]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc0130], rax
mov rax, qword [rsp + 0xc0158]
shl rax, 3
cmp qword [rsp + 0xc0130], rax
jbe 0x180018c57
mov rax, qword [rsp + 0xc0158]
shl rax, 3
mov qword [rsp + 0xc0130], rax
cmp qword [rsp + 0xc05a8], 0
je 0x180018db8
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
sub rax, qword [rsp + 0xc0180]
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
xor edx, edx
div qword [rsp + 0xe8]
mov qword [rsp + 0xc05b8], rax
mov rax, qword [rsp + 0xc0160]
cmp qword [rsp + 0xc05b8], rax
jbe 0x180018cc3
jmp 0x180018db8
lea r9, str.Skipping_to_next_extent
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc05a8]
cmp qword [rax], 0xffffffffffffffff
je 0x180018d17
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
sub rax, qword [rsp + 0xc0180]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0180], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xc05a8], rax
cmp qword [rsp + 0xc05a8], 0
jne 0x180018d4c
jmp 0x180018d5e
mov rax, qword [rsp + 0xc05a8]
cmp qword [rax], 0xffffffffffffffff
je 0x180018cc3
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0xc0180]
mov rax, qword [rax + 8]
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc05a8]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
jmp 0x180018c57
cmp qword [rsp + 0xc05a8], 0
jne 0x180018dc8
jmp 0x18001917e
mov rax, qword [rsp + 0xc05b8]
cmp qword [rsp + 0xc0130], rax
jb 0x180018dea
mov rax, qword [rsp + 0xc05b8]
mov qword [rsp + 0xc0130], rax
mov rax, qword [rsp + 0xc05a8]
mov rcx, qword [rsp + 0x90]
mov rax, qword [rax]
sub rax, rcx
imul rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0148]
imul rcx, qword [rsp + 0xe8]
add rax, rcx
mov qword [rsp + 0xc0168], rax
mov eax, dword [rsp + 0xc0168]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0xc016c]
mov dword [rsp + 0x7c], eax
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0xc0]
imul rax, qword [rsp + 0xc8]
mov qword [rsp + 0xc05e0], rax
xor edx, edx
mov rax, qword [rsp + 0xc0168]
mov rcx, qword [rsp + 0xc05e0]
div rcx
mov rcx, qword [rsp + 0xc0148]
mov rdx, qword [rsp + 0xc0130]
sub rdx, rcx
mov rcx, rdx
imul rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xc0148]
mov r8, qword [rsp + 0xc0130]
sub r8, rdx
mov rdx, r8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
lea r9, str.Reading_block_of__I64u_Inodes_from_MFT_into_memory___u_bytes_from_LCN_I64u
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rax, qword [rsp + 0xc0148]
mov rcx, qword [rsp + 0xc0130]
sub rcx, rax
mov rax, rcx
imul rax, qword [rsp + 0xe8]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xc0178]
mov r8d, eax
mov rdx, qword [rsp + 0xc0198]
mov rax, qword [rsp + 0xc0608]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0xc0138], eax
cmp dword [rsp + 0xc0138], 0
je 0x180018f6b
mov eax, dword [rsp + 0xc0178]
mov rcx, qword [rsp + 0xc0148]
mov rdx, qword [rsp + 0xc0130]
sub rdx, rcx
mov rcx, rdx
imul rcx, qword [rsp + 0xe8]
cmp rax, rcx
je 0x18001902a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x200
lea r8, [rsp + 0xc01a0]
mov edx, eax
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rax, qword [rsp + 0xc0130]
dec rax
lea rcx, [rsp + 0xc01a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0160]
mov qword [rsp + 0x20], rax
lea r9, str.Error_while_reading_Inodes__I64u_to__I64u:__s
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
mov rcx, qword [rsp + 0xc0188]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0148]
mov rcx, qword [rsp + 0xc0160]
sub rcx, rax
mov rax, rcx
imul rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0198]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0608]
mov rcx, qword [rsp + 0xc0600]
call fcn.180015f20
test eax, eax
jne 0x1800190c3
mov rax, qword [rsp + 0xc0150]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0160]
mov qword [rsp + 0x20], rax
lea r9, str.The_error_occurred_while_processing_Inode__I64u__max__I64u_
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
jmp 0x180018af1
mov rax, qword [rsp + 0xc0148]
mov rcx, qword [rsp + 0xc0160]
sub rcx, rax
mov rax, rcx
imul rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0198]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0158]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xc0190]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0150]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0160]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0188]
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0608]
mov rcx, qword [rsp + 0xc0600]
call fcn.180017290
mov dword [rsp + 0xc0138], eax
jmp 0x180018af1
lea rcx, [rsp + 0xc05c0]
call fcn.1800049b8
mov rax, qword [rsp + 0xc05c0]
imul rax, rax, 0x3e8
movzx ecx, word [rsp + 0xc05c8]
add rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xc05a0]
cmp qword [rsp + 0x88], rax
jle 0x18001920a
mov rax, qword [rsp + 0xc0150]
imul rax, rax, 0x3e8
mov rcx, qword [rsp + 0xc05a0]
mov rdx, qword [rsp + 0x88]
sub rdx, rcx
mov rcx, rdx
xor edx, edx
div rcx
mov qword [rsp + 0x20], rax
lea r9, str.__Analysis_speed:__I64u_items_per_second
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0xc05b0]
call fcn.18002bd00
mov rcx, qword [rsp + 0xc0198]
call fcn.180004b4c
cmp qword [rsp + 0xa8], 0
je 0x18001922f
mov rcx, qword [rsp + 0xa8]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rax, qword [rax + 8]
cmp dword [rax], 0
je 0x180019286
mov rcx, qword [rsp + 0xc0188]
call fcn.180004b4c
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::DeleteItemTree_struct_ItemStruct____ptr64____ptr64
mov rax, qword [rsp + 0xc0608]
mov qword [rax + 0x120], 0
xor eax, eax
jmp 0x180019331
mov rax, qword [rsp + 0xc0608]
mov rdx, qword [rax + 0x120]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_struct_ItemStruct____ptr64___cdecl_JKDefragLib::TreeSmallest_struct_ItemStruct____ptr64____ptr64
mov qword [rsp + 0xc0170], rax
jmp 0x1800192cf
mov rdx, qword [rsp + 0xc0170]
mov rax, qword [rsp + 0xc0600]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_struct_ItemStruct____ptr64___cdecl_JKDefragLib::TreeNext_struct_ItemStruct____ptr64____ptr64
mov qword [rsp + 0xc0170], rax
cmp qword [rsp + 0xc0170], 0
je 0x18001931f
mov rax, qword [rsp + 0xc0170]
mov rax, qword [rax + 0x68]
mov rcx, qword [rsp + 0xc0170]
mov rdx, qword [rsp + 0xc0188]
mov rax, qword [rdx + rax*8]
mov qword [rcx + 0x70], rax
mov rax, qword [rsp + 0xc0170]
cmp qword [rax + 0x68], 5
jne 0x18001931d
mov rax, qword [rsp + 0xc0170]
mov qword [rax + 0x70], 0
jmp 0x1800192af
mov rcx, qword [rsp + 0xc0188]
call fcn.180004b4c
mov eax, 1
mov rcx, qword [rsp + 0xc05e8]
xor rcx, rsp
call fcn.1800033c0
add rsp, 0xc05f8
ret