Function at 0x1400de420
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6e0
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rsp + 0x728], rbx
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + Ordinal_1750], rax
mov dword [rsp + 0x84], r9d
mov r13, r8
mov qword [rsp + 0xb0], r8
mov r12, rdx
mov qword [rsp + 0x88], rdx
mov rbx, rcx
call fcn.14010fd90
mov rcx, rax
mov qword [rsp + 0xa8], rax
mov rax, qword [rax + 8]
test rax, rax
je 0x1400df40d
mov rcx, qword [rcx + 0x10]
sub rcx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400df40d
xor r15d, r15d
mov esi, r15d
mov rdi, r15
mov rcx, rbx
call fcn.1400dc680
test rax, rax
je 0x1400de536
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400de4ee
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
cmp rdi, rax
jb 0x1400de4f4
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbx + 8]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call fcn.1400d9520
cmp rax, r12
je 0x1400de521
add esi, 1
add rdi, 1
mov rcx, rbx
call fcn.1400dc680
mov ecx, esi
cmp rcx, rax
jb 0x1400de4d5
jmp 0x1400de536
mov rdx, r13
mov rcx, rbp
call fcn.1400da580
mov eax, 1
jmp 0x1400df4f8
mov ebp, r15d
mov rsi, r15
mov rcx, rbx
call fcn.1400dc680
test rax, rax
je 0x1400de5a2
nop
nop
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400de569
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
cmp rsi, rax
jb 0x1400de56f
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rbx + 8]
mov rdi, qword [rax + rsi*8]
test rdi, rdi
je 0x1400de58c
mov rcx, rdi
call fcn.1400d9920
mov rcx, rdi
call sub.MFC80U.DLL_Ordinal_776
add ebp, 1
add rsi, 1
mov rcx, rbx
call fcn.1400dc680
mov ecx, ebp
cmp rcx, rax
jb 0x1400de550
mov rsi, qword [rbx + 0x10]
cmp qword [rbx + 8], rsi
jbe 0x1400de5b2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
jbe 0x1400de5c2
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp rdi, rsi
je 0x1400de5f6
mov rax, qword [rbx + 0x10]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
lea rbp, [rdx + rdi]
test rax, rax
jle 0x1400de5f2
mov r9, rdx
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.MSVCR80.dll_memmove_s]
mov qword [rbx + 0x10], rbp
mov esi, dword [rbx + 0x20]
xor edx, edx
mov r8d, Ordinal_280
lea rcx, [rsp + 0x120]
call sub.ntdll.dll_memset
mov dword [rsp + 0x120], Ordinal_280
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x124], 6
jae 0x1400de6d5
mov word [rsp + 0x250], r15w
xor eax, eax
mov qword [rsp + 0x252], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_602], rax
mov qword [rsp + 0x262], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_618], rax
mov qword [rsp + 0x272], rax
mov qword [rsp + 0x27a], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_642], rax
mov dword [rsp + 0x28a], eax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_654], ax
mov r8d, esi
lea rdx, str..PhysicalDrive_d
lea rcx, [rsp + 0x250]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
jmp 0x1400de73c
call fcn.1400494c0
mov rdi, qword [rax]
mov edx, esi
mov rcx, rax
call qword [rdi + 0x18]
test eax, eax
js 0x1400df32d
mov r9d, esi
mov r8d, eax
lea rdx, [0x1402e0fe0]
lea rcx, [rsp + 0x290]
call qword [sym.imp.MSVCR80.dll__swprintf]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400df32d
mov r8d, dword [rbx + 0x78]
mov edi, dword [rbx + 0x7c]
mov eax, r8d
shl eax, 0xb
xor edx, edx
div edi
mov dword [rsp + 0x80], eax
imul r8, r12
movzx ecx, word [0x14043d650]
imul ecx, edi
mov rax, r8
cqo
idiv rcx
mov r14, rax
call fcn.14010fd90
mov rbp, rax
mov r12d, r15d
mov r13, r15
mov rcx, rax
call fcn.1400dc6a0
test rax, rax
je 0x1400df24c
mov rdi, r15
nop
nop
mov rax, qword [rbp + 8]
test rax, rax
je 0x1400de7d0
mov rcx, qword [rbp + 0x10]
sub rcx, rax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r13, rdx
jb 0x1400de7d6
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rbp + 8]
mov rcx, qword [rdi + rsi + 8]
cmp r14, rcx
jl 0x1400de7ee
add rcx, qword [rdi + rsi + 0x10]
cmp r14, rcx
jl 0x1400de810
add r12d, 1
add r13, 1
add rdi, 0x18
mov rcx, rbp
call fcn.1400dc6a0
mov ecx, r12d
cmp rcx, rax
jae 0x1400df24c
jmp 0x1400de7a0
mov r12, qword [rsp + 0xa8]
mov r14, qword [r12 + 8]
cmp r14, qword [r12 + 0x10]
jbe 0x1400de82a
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_576], r12
mov qword [rsp + 0x248], r14
nop
nop
mov rbp, qword [r12 + 0x10]
cmp qword [r12 + 8], rbp
jbe 0x1400de852
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp r14, rbp
je 0x1400de89e
cmp r14, qword [r12 + 0x10]
jb 0x1400de864
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rdi + rsi]
cmp qword [r14], rax
jne 0x1400de883
mov rax, qword [rdi + rsi + 8]
cmp qword [r14 + 8], rax
jne 0x1400de883
mov rax, qword [rdi + rsi + 0x10]
cmp qword [r14 + 0x10], rax
je 0x1400de89e
cmp r14, qword [r12 + 0x10]
jb 0x1400de890
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add r14, 0x18
mov qword [rsp + 0x248], r14
jmp 0x1400de840
mov r13d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x48], r15d
mov ebp, r15d
mov dword [rsp + 0x44], r15d
mov byte [rsp + 0x2d0], bpl
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_721]
call sub.ntdll.dll_memset
movaps xmm5, xmmword [rsp + reloc.MFC80U.DLL_Ordinal_576]
movdqa xmmword [rsp + 0xc0], xmm5
mov rsi, qword [rsp + 0xc0]
nop
nop
mov rdi, qword [r12 + 0x10]
cmp qword [r12 + 8], rdi
jbe 0x1400de902
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp r14, rdi
je 0x1400df238
mov edi, dword [rsp + 0x80]
cmp r13d, edi
jge 0x1400df238
cmp r14, qword [r12 + 0x10]
jb 0x1400de928
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rcx, [rsp + 0x90]
mov rax, qword [r14]
mov qword [rcx], rax
mov rax, qword [r14 + 8]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x10]
mov qword [rcx + 0x10], rax
test rsi, rsi
je 0x1400de950
cmp rsi, r12
je 0x1400de956
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
movzx r9d, word [0x14043d650]
cmp qword [rsp + 0xc8], r14
jne 0x1400de9bf
mov eax, dword [rbx + 0x78]
imul rax, qword [rsp + 0x88]
movzx ecx, r9w
imul ecx, dword [rbx + 0x7c]
cqo
idiv rcx
mov r8, rax
mov rcx, rax
sub rcx, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
add r12, rcx
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
mov qword [rsp + 0xa0], rdx
jmp 0x1400de9d7
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
movzx r10d, r9w
imul r12, r10
add r12, qword [rbx + 0x28]
mov eax, edi
sub eax, r13d
movsxd rsi, eax
imul rdx, r10
cmp rdx, rsi
cmovl rsi, rdx
mov qword [rsp + 0x58], rsi
mov rcx, r8
imul rcx, r10
mov rax, rcx
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400dea28
mov edi, dword [rbx + 0x7c]
cmp edi, reloc.MFC80U.DLL_Ordinal_512
jne 0x1400dea28
mov qword [rsp + 0x68], 0xffffffffffffffff
jmp 0x1400dea48
mov edi, dword [rbx + 0x7c]
mov rax, rdi
imul rax, rcx
mov ecx, dword [rbx + 0x78]
cqo
idiv rcx
mov qword [rsp + 0x68], rax
test rax, rax
jns 0x1400dec57
test ebp, ebp
je 0x1400dec57
lea rcx, [r8 + 1]
imul rcx, r10
mov rax, rcx
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400dea7b
cmp edi, reloc.MFC80U.DLL_Ordinal_512
jne 0x1400dea7b
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x68], rdi
jmp 0x1400dea91
mov eax, edi
imul rax, rcx
mov ecx, dword [rbx + 0x78]
cqo
idiv rcx
mov rdi, rax
mov qword [rsp + 0x68], rax
mov r9d, 1
mov r8, r12
lea rdx, [rsp + 0x4d0]
mov rcx, qword [rsp + 0x50]
call fcn.1400dc2d0
mov ecx, 0x4078
call sub.MFC80U.DLL_Ordinal_774
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400deae6
mov ecx, dword [0x14043d654]
mov dword [rsp + 0x20], ecx
movzx r9d, word [0x14043d650]
mov r8, qword [rbx + 0x28]
mov edx, dword [rbx + 0x20]
mov rcx, rax
call fcn.1400d9890
mov rbp, rax
jmp 0x1400deae9
mov rbp, r15
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x2d0]
mov rcx, rbp
call fcn.1400dab50
lea r13, [rdi - 1]
mov rdx, r13
mov rcx, rbp
call fcn.1400d9830
mov r11, qword [rbx + 8]
test r11, r11
jne 0x1400deb29
mov rcx, r15
jmp 0x1400deb34
mov rcx, qword [rbx + 0x10]
sub rcx, r11
sar rcx, 3
test r11, r11
je 0x1400deb5d
mov rax, qword [rbx + 0x18]
sub rax, r11
sar rax, 3
cmp rcx, rax
jae 0x1400deb5d
mov rax, qword [rbx + 0x10]
mov qword [rax], rbp
add rax, 8
mov qword [rbx + 0x10], rax
jmp 0x1400dec0a
mov rdi, qword [rbx + 0x10]
cmp r11, rdi
jbe 0x1400deb6c
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rdi
mov rsi, qword [rbx + 8]
test rsi, rsi
je 0x1400deba9
mov rcx, qword [rbx + 0x10]
mov rax, rcx
sub rax, rsi
sar rax, 3
je 0x1400deba9
cmp rsi, rcx
jbe 0x1400deba0
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rsi
sar rdi, 3
jmp 0x1400debac
mov rdi, r15
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r9, [rsp + 0x78]
mov r8d, 1
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.140061590
mov rsi, qword [rbx + 8]
cmp rsi, qword [rbx + 0x10]
jbe 0x1400debe8
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rsi + rdi*8]
cmp rax, qword [rbx + 0x10]
ja 0x1400debf8
cmp rax, qword [rbx + 8]
jae 0x1400dec05
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x58]
jmp 0x1400dec0a
mov rsi, qword [rsp + 0x58]
cmp r13, qword [rsp + 0x88]
jne 0x1400dec2c
mov rdx, qword [rsp + 0xb0]
mov rcx, rbp
call fcn.1400da580
mov dword [rsp + 0x48], 1
add r12, 1
sub rsi, 1
mov qword [rsp + 0x58], rsi
mov ebp, r15d
mov dword [rsp + 0x44], r15d
mov r13d, dword [rsp + 0x40]
add r13d, 2
mov dword [rsp + 0x40], r13d
mov r9w, word [0x14043d650]
mov rax, rsi
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
je 0x1400deca2
cmp dword [rbx + 0x7c], reloc.MFC80U.DLL_Ordinal_512
jne 0x1400deca2
cmp r9w, 1
jne 0x1400deca2
sub rsi, 1
mov qword [rsp + 0x58], rsi
mov ebp, 1
mov dword [rsp + 0x44], ebp
lea r8, [rsi + r12]
mov r9, rbp
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x50]
call fcn.1400dc2d0
mov ecx, dword [rbx + 0x7c]
imul rcx, rsi
call sub.MFC80U.DLL_Ordinal_265
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400df140
mov r8d, dword [rbx + 0x7c]
imul r8, rsi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov r9, rsi
mov r8, r12
mov rdx, rdi
mov r12, qword [rsp + 0x50]
mov rcx, r12
call fcn.1400dc2d0
test eax, eax
je 0x1400df04f
mov eax, dword [rbx + 0x7c]
imul rax, rsi
mov ecx, dword [rbx + 0x78]
cqo
idiv rcx
mov rsi, rax
mov qword [rsp + 0x78], rax
mov r12d, r15d
test eax, eax
jle 0x1400deef7
mov ecx, 0x4078
call sub.MFC80U.DLL_Ordinal_774
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400ded4b
mov ecx, dword [0x14043d654]
mov dword [rsp + 0x20], ecx
movzx r9d, word [0x14043d650]
mov r8, qword [rbx + 0x28]
mov edx, dword [rbx + 0x20]
mov rcx, rax
call fcn.1400d9890
mov rbp, rax
jmp 0x1400ded4e
mov rbp, r15
mov qword [rsp + 0x60], rbp
mov edx, dword [rbx + 0x78]
mov ecx, edx
imul ecx, r12d
add rcx, rdi
call fcn.1400d94a0
test eax, eax
je 0x1400ded91
mov ecx, dword [rbx + 0x78]
mov edx, ecx
imul edx, r12d
add rdx, rdi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, ecx
mov rcx, rbp
call fcn.1400dab50
test eax, eax
je 0x1400def3d
jmp 0x1400dedb0
mov ecx, dword [rbx + 0x78]
mov edx, ecx
imul edx, r12d
add rdx, rdi
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, ecx
mov rcx, rbp
call fcn.1400dab50
movsxd r13, r12d
mov rcx, qword [rsp + 0x68]
add r13, rcx
mov rdx, r13
mov rcx, rbp
call fcn.1400d9830
mov r11, qword [rbx + 8]
test r11, r11
jne 0x1400dedd4
mov rcx, r15
jmp 0x1400deddf
mov rcx, qword [rbx + 0x10]
sub rcx, r11
sar rcx, 3
test r11, r11
je 0x1400dee08
mov rax, qword [rbx + 0x18]
sub rax, r11
sar rax, 3
cmp rcx, rax
jae 0x1400dee08
mov rax, qword [rbx + 0x10]
mov qword [rax], rbp
add rax, 8
mov qword [rbx + 0x10], rax
jmp 0x1400deebf
mov rdi, qword [rbx + 0x10]
cmp r11, rdi
jbe 0x1400dee17
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rdi
mov rsi, qword [rbx + 8]
test rsi, rsi
je 0x1400dee54
mov rcx, qword [rbx + 0x10]
mov rax, rcx
sub rax, rsi
sar rax, 3
je 0x1400dee54
cmp rsi, rcx
jbe 0x1400dee4b
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rsi
sar rdi, 3
jmp 0x1400dee57
mov rdi, r15
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x100], xmm0
lea r9, [rsp + 0x60]
mov r8d, 1
lea rdx, [rsp + 0x100]
mov rcx, rbx
call fcn.140061590
mov rsi, qword [rbx + 8]
cmp rsi, qword [rbx + 0x10]
jbe 0x1400dee93
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea rax, [rsi + rdi*8]
cmp rax, qword [rbx + 0x10]
ja 0x1400deea3
cmp rax, qword [rbx + 8]
jae 0x1400deeb5
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x1400deebf
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
cmp r13, qword [rsp + 0x88]
jne 0x1400deee1
mov rdx, qword [rsp + 0xb0]
mov rcx, rbp
call fcn.1400da580
mov dword [rsp + 0x48], 1
add r12d, 1
cmp r12d, esi
jl 0x1400ded11
mov ebp, dword [rsp + 0x44]
mov r13d, dword [rsp + 0x40]
mov rcx, rdi
call sub.MFC80U.DLL_Ordinal_266
add r13d, dword [rsp + 0x58]
mov dword [rsp + 0x40], r13d
cmp dword [rsp + 0x84], 0
jne 0x1400df238
mov r12, qword [rsp + 0xa8]
cmp r14, qword [r12 + 0x10]
jb 0x1400def2c
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add r14, 0x18
mov rsi, qword [rsp + 0xc0]
jmp 0x1400de8f0
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400df003
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, reloc.MFC80U.DLL_Ordinal_334
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400defc0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400deff0
mov r15, rbx
mov rax, qword [rsi]
movsxd r9, r12d
add r9, qword [rsp + 0x68]
mov r8, r15
lea rdx, str._s:_Initialize_MftFile_failed._FILE_Record_Number:__I64d
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
call sub.MFC80U.DLL_Ordinal_266
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x1400df048
mov rcx, rbp
call fcn.1400d9920
mov rcx, rbp
call sub.MFC80U.DLL_Ordinal_776
xor eax, eax
jmp 0x1400df4f8
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400df113
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, Ordinal_320
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400df0d2
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400df100
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_Read_sector_failed.
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
call sub.MFC80U.DLL_Ordinal_266
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400df4f8
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400df213
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0x137
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400df1d0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400df200
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_No_sufficient_memory.
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400df4f8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x1400df4f8
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400df313
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], r15b
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0xd1
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400df2d0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400df300
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_Failed_to_get_the_data_run.
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400df4f8
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
je 0x1400df3f3
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], r15b
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0xc7
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400df3b0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400df3e0
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_Failed_to_open_disk.
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400df4f8
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x14043d190]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str...mft.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x1400df44e
xor r15d, r15d
jmp 0x1400df4e3
mov byte [rsp + reloc.MFC80U.DLL_Ordinal_576], 0
xor eax, eax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_577], rax
mov word [rsp + 0x249], ax
mov byte [rsp + 0x24b], al
mov r8d, 0xad
lea rdx, [0x1402dfd08]
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400df4a0
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_576]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400df4d0
mov r15, rbx
mov rax, qword [rsi]
mov r8, r15
lea rdx, str._s:_The_data_run_list_of__MFT_is_not_initialization.
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x728]
add rsp, 0x6e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret