Function at 0x1000f0dd
Capabilities:
Check for time delay via gettickcount
Get disk information

Disassembly:
push 0xd84
mov eax, 0x10043ebd
call fcn.1002e47a
mov eax, dword [ebp + 0xc]
movsx bx, byte [ebp + 8]
mov dword [ebp - 0xd88], eax
push 0x3a
pop eax
mov word [ebp - 0x22], ax
push 0x5c
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
mov word [ebp - 0x24], bx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push 0xfe
mov word [ebp - 0x164], ax
xor edi, edi
lea eax, [ebp - 0x162]
push edi
push eax
mov esi, ecx
call fcn.10031290
add esp, 0xc
xor eax, eax
push 0x3e
mov word [ebp - 0x64], ax
lea eax, [ebp - 0x62]
push edi
push eax
call fcn.10031290
add esp, 0xc
mov dword [ebp - method.MemoryHolder_wchar_t_const__.virtual_0], vtable.MemoryHolder_wchar_t_const__.0
mov dword [ebp - 0xd80], edi
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
pop ecx
cdq
idiv ecx
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xd7c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002cf22
mov dword [ebp - 0xd80], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xd70], eax
test eax, eax
je 0x1000f1ef
and dword [ebp - 0xd68], edi
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
cmp edi, eax
jb 0x1000f1bf
call fcn.1002d8f8
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0xd68]
cmp dword [eax + 0x18], 8
jb 0x1000f1d3
mov eax, dword [eax + 4]
jmp 0x1000f1d6
add eax, 4
mov ecx, dword [ebp - 0xd80]
add dword [ebp - 0xd68], 0x1c
mov dword [ecx + edi*4], eax
inc edi
cmp edi, dword [ebp - 0xd70]
jne 0x1000f1aa
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x20
mov dword [ebp - 0xd8c], eax
lea eax, [ebp - 0x64]
push eax
xor esi, esi
push esi
push esi
push esi
push 0x80
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1000f421
push str.ntfs
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000f408
mov dword [ebp - 0xd68], esi
mov esi, ebx
call fcn.1000e746
mov esi, eax
test esi, esi
jne 0x1000f25f
mov dword [ebp - 0xd68], 3
jmp 0x1000f3c3
call fcn.1000e877
or eax, edx
je 0x1000f3b4
lea eax, [ebp - 0xd90]
push eax
mov eax, esi
call fcn.1000ef59
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0xd78], 0
cmp dword [esi + 0xc], 0
mov edi, eax
mov eax, dword [esi + 0x248]
jbe 0x1000f3be
mov dword [ebp - 0xd74], eax
test byte [eax + 6], 1
je 0x1000f38e
mov eax, dword [eax]
test eax, eax
je 0x1000f38e
call fcn.1000f094
test eax, eax
jne 0x1000f38e
and dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd70], eax
je 0x1000f38e
mov eax, dword [ebp - 0xd74]
push dword [eax]
mov eax, dword [ebp - 0xd80]
mov ecx, dword [ebp - 0xd6c]
mov ebx, dword [eax + ecx*4]
call fcn.100158fd
test eax, eax
jne 0x1000f307
inc dword [ebp - 0xd6c]
mov eax, dword [ebp - 0xd6c]
cmp eax, dword [ebp - 0xd70]
jne 0x1000f2d3
mov eax, dword [ebp - 0xd70]
cmp dword [ebp - 0xd6c], eax
je 0x1000f38e
xor eax, eax
mov word [ebp - 0xd64], ax
lea eax, [ebp - 0xd64]
push eax
mov eax, dword [ebp - 0xd78]
push esi
call fcn.1000efcf
pop ecx
pop ecx
test eax, eax
je 0x1000f38e
cmp word [eax], 0
je 0x1000f38e
push 0x200
push eax
lea eax, [ebp - 0x564]
xor ecx, ecx
push eax
mov word [ebp - 0x564], cx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0xd74]
push dword [eax]
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x564], 0
je 0x1000f38e
push dword [ebp - 0xd88]
lea eax, [ebp - 0x564]
push eax
call fcn.1000a822
test eax, eax
je 0x1000f3be
inc dword [ebp - 0xd78]
mov eax, dword [ebp - 0xd74]
mov ecx, dword [ebp - 0xd78]
add eax, 0x10
mov dword [ebp - 0xd74], eax
cmp ecx, dword [esi + 0xc]
jb 0x1000f2a0
jmp 0x1000f3be
mov dword [ebp - 0xd68], 4
call fcn.1000e7a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
sub edi, dword [ebp - 0xd8c]
push eax
movsx eax, byte [ebp + 8]
push edi
push dword [ebp - 0xd68]
push eax
push str.NSFindFile_finished_:_c__status:__d___parse_mft_cost__d_ms__find_cost__d_ms_n
call fcn.10026a66
add esp, 0x14
cmp dword [ebp - 0xd80], 0
je 0x1000f400
push dword [ebp - 0xd80]
call fcn.1002dcf2
pop ecx
mov eax, dword [ebp - 0xd68]
jmp 0x1000f438
cmp dword [ebp - 0xd80], esi
je 0x1000f41c
push dword [ebp - 0xd80]
call fcn.1002dcf2
pop ecx
push 2
pop eax
jmp 0x1000f438
cmp dword [ebp - 0xd80], esi
je 0x1000f435
push dword [ebp - 0xd80]
call fcn.1002dcf2
pop ecx
xor eax, eax
inc eax
call fcn.1002e4fd
ret 8