Function at 0x4fabd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
push edi
lea edi, [ebp - 0x2c]
mov eax, 0x696fa0
call fcn.0061509c
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov dword [edi], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x178], eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], eax
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0xf0], ecx
mov eax, dword [ebp + 8]
and dword [eax + 8], 0xfffffff7
mov dword [ebp - 0x100], 0x1000
cmp dword [ebp + 0x10], 0
jne 0x4facb5
xor edx, edx
mov dword [ebp - 0x15c], edx
jmp 0x4facbf
mov dword [ebp - 0x15c], 1
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004de9f8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp + 8]
cmp byte [eax + 0x39], 7
je 0x4fad4b
mov edx, dword [ebp + 8]
cmp byte [edx + 0x39], 1
je 0x4fad4b
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x39], 4
je 0x4fad4b
mov eax, dword [ebp + 8]
cmp byte [eax + 0x39], 6
je 0x4fad4b
mov edx, dword [ebp + 8]
cmp byte [edx + 0x39], 0xe
je 0x4fad4b
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x39], 0x17
je 0x4fad4b
mov eax, dword [ebp + 8]
cmp byte [eax + 0x39], 0x11
je 0x4fad4b
mov edx, dword [ebp + 8]
cmp byte [edx + 0x39], 0x14
je 0x4fad4b
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x39], 0x16
je 0x4fad4b
mov eax, dword [ebp + 8]
cmp byte [eax + 0x39], 0x1e
je 0x4fad4b
mov edx, dword [ebp + 8]
cmp byte [edx + 0x39], 0x87
je 0x4fad4b
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x39], 0x86
jne 0x4fad54
mov eax, dword [ebp + 8]
cmp byte [eax + 0x3a], 4
je 0x4fad88
push str.RPART01
push 0x695acc
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push 0x641
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
cmp dword [ebp + 0x10], 1
je 0x4fada8
push 2
push 1
push 0
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e89e8
add esp, 0x18
mov ebx, eax
jmp 0x4fadb4
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [eax]
call dword [edx + 4]
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4fade7
push str.RBOOT01
push 0x695ad9
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
push str.NTFS_Check
push str._s:_Partition_information_n
call fcn.004adfc8
add esp, 8
mov edx, dword [ebp - 0x28]
movzx ecx, word [edx + 0x27]
push ecx
push str.____________Sector_size:__lu_bytes_n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dl, byte [eax + 0x29]
push edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x228]
push eax
push str.____________Cluster_size:__lu_bytes___lu_sector_s___n
call fcn.004adfc8
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x22c]
push ecx
push str.____________File_Record_size:__lu_bytes_n
call fcn.004adfc8
mov eax, dword [ebp - 0x28]
add esp, 8
xor ecx, ecx
movsx edx, byte [eax + 0x60]
mov cl, dl
push ecx
push 1
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x228]
push edx
mov ecx, dword [ebp - 0x28]
movsx eax, byte [ecx + 0x60]
push eax
call fcn.0050b93c
add esp, 0xc
push eax
push str.____________Default_Index_Allocation_size:__lu_bytes__0x_02X__n
call fcn.004adfc8
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x4c]
push eax
push str.____________Beginning_of_MFT:_cluster_0x_lX_n
call fcn.004adfc8
add esp, 8
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x54]
push eax
push str.____________Beginning_of_MFT_mirror:_cluster_0x_lX_n
call fcn.004adfc8
add esp, 8
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x44]
push eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x44]
push eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
push eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
push eax
push str.____________File_system_size:_0x_lX___lu__clusters___0x_lX___lu__sectors_n
call fcn.004adfc8
mov edx, dword [ebp - 0x28]
add esp, 0x14
mov eax, dword [edx + 0x234]
mov edx, dword [ebp - 0x28]
mov ecx, eax
xor eax, eax
mov al, byte [edx + 0x29]
mov edx, dword [ebp - 0x28]
imul ecx, eax
mov eax, dword [edx + 0x44]
cmp ecx, eax
jae 0x4faf1d
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov cl, byte [edx + 0x29]
imul ecx
push eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x44]
pop edx
sub eax, edx
push eax
push str.______________Extra_sectors_in_file_system:__lu_n
call fcn.004adfc8
add esp, 8
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x44]
cmp eax, dword [edx + 0x18]
jae 0x4faf47
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x44]
mov ecx, dword [edx + 0x18]
sub ecx, eax
push ecx
push str.______________Extra_sectors_in_partition:__lu_n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x64]
push eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x68]
xor edx, edx
push eax
push str.____________Serial_number:_0x_08lX__08lX_n
call fcn.004adfc8
add esp, 0xc
cmp dword [ebp + 0x10], 2
jne 0x4faf7c
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x48], 0
jne 0x4faf7a
cmp dword [edx + 0x44], 0x40000
jb 0x4faf94
cmp dword [ebp + 0x10], 3
jne 0x4fafcf
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x48], 0
jne 0x4faf92
cmp dword [ecx + 0x44], 0x80000
jae 0x4fafcf
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x44]
push eax
push str.FCVT101
push 0x695cf7
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push 0x693
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
cmp dword [ebp + 0x10], 2
jne 0x4fb03a
mov eax, dword [0x6a5df4]
push eax
call fcn.005324c4
pop ecx
test al, al
je 0x4fafec
mov eax, 0x800000
jmp 0x4faff1
mov eax, 0x400000
cdq
mov ecx, dword [ebp - 0x28]
cmp edx, dword [ecx + 0x48]
jne 0x4faffd
cmp eax, dword [ecx + 0x44]
jae 0x4fb03a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x44]
push eax
push str.FCVT102
push 0x695d08
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push 0x694
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
cmp dword [ebp + 0x10], 2
jb 0x4fb14d
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x228], 0x8000
jbe 0x4fb090
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x228]
push ecx
push str.FCVT103
push 0x695d19
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push 0x69d
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x234]
shl eax, 2
push eax
mov edx, dword [ebp - 0x28]
push edx
call fcn.004e93e8
mov esi, eax
xor eax, eax
add esi, esi
xor edx, edx
add esi, 0x20
xor ecx, ecx
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x168], edx
xor eax, eax
mov dword [ebp - 0x164], ecx
add esp, 8
xor edx, edx
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x170], edx
call fcn.004fab78
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x3f800
ja 0x4fb0fb
mov dword [ebp - 0x128], 4
jmp 0x4fb14d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x7f800
ja 0x4fb113
mov dword [ebp - 0x128], 8
jmp 0x4fb14d
mov edx, dword [ebp + 8]
cmp dword [edx + 0x18], 0xff800
ja 0x4fb12b
mov dword [ebp - 0x128], 0x10
jmp 0x4fb14d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x1ff800
ja 0x4fb143
mov dword [ebp - 0x128], 0x20
jmp 0x4fb14d
mov dword [ebp - 0x128], 0x40
push str.NTFS_Check
push str._s:_Checking_format_of_reserved_file_entries..._n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9344
pop ecx
push eax
mov eax, 0x130
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jne 0x4fb18f
mov dword [ebp - 0x194], 1
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x198], eax
test eax, eax
je 0x4fb1b0
mov eax, dword [ebp - 0x198]
push eax
call fcn.00532628
pop ecx
jmp 0x4fb1b6
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jne 0x4fb1cf
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x194]
push eax
push 0
mov edx, dword [ebp - 0x18c]
push edx
call fcn.005329e8
add esp, 0xc
push 0x1dc
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.00532834
add esp, 8
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x19c], eax
test eax, eax
je 0x4fb21c
mov edx, dword [ebp - 0x19c]
push edx
call fcn.00532628
pop ecx
jmp 0x4fb222
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x4fb23b
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x190]
push eax
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x22c]
add edx, edx
push edx
call fcn.00613cd0
pop ecx
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x4fb281
mov ebx, 3
jmp 0x500cf9
xor eax, eax
mov dword [ebp - 0xe8], eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x22c]
add ecx, dword [ebp - 0x90]
xor eax, eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x130], eax
mov edx, dword [ebp - 0x130]
mov esi, dword [edx*4 + 0x6958cc]
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
push edi
mov edx, 4
cmp esi, 0xa
jbe 0x4fb2d1
add edx, 0xff
push edx
push esi
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004ef984
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4fb326
push esi
push str.FCSYS01
push 0x695d5b
call fcn.004adfc8
add esp, 0xc
push 0
mov eax, 0x80
test esi, esi
je 0x4fb306
add eax, 0xffffffe0
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
cmp esi, 5
je 0x4fb3a3
cmp esi, 0xb
je 0x4fb3a3
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4fb347
push 0x695d6c
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fb34c
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
cmp dword [eax], 0x454c4946
jne 0x4fb3a3
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fb36b
push 0x695d9a
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fb370
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
test byte [ecx + 0x16], 1
je 0x4fb3a3
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fb38d
push 0x695dc8
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fb392
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
push eax
call fcn.0050b920
pop ecx
test eax, eax
jne 0x4fb3a3
inc dword [ebp - 0xe8]
mov dword [ebp - 0x138], 0xa
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x23c], 3
jb 0x4fb3c3
mov dword [ebp - 0x138], 0xb
cmp esi, dword [ebp - 0x138]
jb 0x4fb3f6
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4fb3e2
push 0x695df6
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fb3e7
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
push eax
call fcn.0050b920
pop ecx
test eax, eax
jne 0x4fb4a3
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x10
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fb45f
cmp ebx, 0x5ed
jne 0x4fb424
mov ebx, 0x664
push str.FCSYS02
push 0x695e24
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x80
test esi, esi
je 0x4fb444
add eax, 0xffffffe0
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fb4a3
push str.FCSYS03
push 0x695e31
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fb4ba
push 0x695e3e
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fb4bf
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
movzx edx, word [ecx + 0x10]
test esi, esi
jne 0x4fb4ce
mov eax, 1
jmp 0x4fb4d0
mov eax, esi
cmp edx, eax
je 0x4fb52e
cmp esi, 0xa
ja 0x4fb52e
push str.FCSYS04
push 0x695e6c
call fcn.004adfc8
add esp, 8
push 0
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fb504
push 0x695e79
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fb509
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
movzx edx, word [ecx + 0x10]
push edx
push esi
push 0x40
push 0x66c
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
cmp esi, dword [ebp - 0x138]
ja 0x4fbaf0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x23c], 3
jb 0x4fb55d
mov edx, dword [edi]
mov ecx, dword [edx + 0x14]
mov eax, ecx
lea ecx, [eax + ecx*4]
lea ecx, [eax + ecx*4]
add ecx, ecx
add ecx, str._MFT
jmp 0x4fb572
mov edx, dword [edi]
mov ecx, dword [edx + 0x14]
mov eax, ecx
lea ecx, [eax + ecx*4]
lea ecx, [eax + ecx*4]
add ecx, ecx
add ecx, 0x69a0a2
push ecx
push str.NTFS_Check
push str._s:___Checking__s_n
call fcn.004adfc8
add esp, 0xc
lea edx, [ebp - 0x40]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x30
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fb5f8
cmp ebx, 0x5ed
jne 0x4fb5b3
mov ebx, 0x663
push str.FCSYS05
push 0x695eba
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x80
test esi, esi
je 0x4fb5d8
cmp esi, 6
je 0x4fb5d8
add eax, 0xffffffe0
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
push 0
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004f2374
add esp, 8
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4fb658
push str.FCSYS06
push 0x695ec7
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x80
test esi, esi
je 0x4fb634
cmp esi, 6
je 0x4fb634
add eax, 0xffffffe0
push eax
push 0x5f2
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
mov eax, dword [ebp - 0x78]
test byte [eax + 0x41], 3
je 0x4fb6fd
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x23c], 3
jb 0x4fb6b6
mov eax, esi
lea ecx, [esi + esi*4]
shl eax, 3
xor edx, edx
sub eax, esi
lea ecx, [esi + ecx*4]
add ecx, ecx
add ecx, 0x69a32e
lea eax, [eax + eax*2]
push ecx
mov dl, byte [eax*2 + 0x69a32d]
push edx
mov ecx, dword [ebp - 0x78]
add ecx, 0x42
xor edx, edx
push ecx
mov eax, dword [ebp - 0x78]
mov dl, byte [eax + 0x40]
push edx
call fcn.0050c020
add esp, 0x10
test eax, eax
setne cl
and ecx, 1
jmp 0x4fb6f9
mov edx, esi
lea eax, [esi + esi*4]
shl edx, 3
xor ecx, ecx
sub edx, esi
lea eax, [esi + eax*4]
add eax, eax
add eax, 0x69a08e
lea edx, [edx + edx*2]
push eax
mov cl, byte [edx*2 + 0x69a08d]
push ecx
mov eax, dword [ebp - 0x78]
add eax, 0x42
xor ecx, ecx
push eax
mov edx, dword [ebp - 0x78]
mov cl, byte [edx + 0x40]
push ecx
call fcn.0050c020
add esp, 0x10
test eax, eax
setne cl
and ecx, 1
test cl, cl
je 0x4fb733
push str.FCSYS07
push 0x695ed4
call fcn.004adfc8
add esp, 8
push 0
push 0x30
push esi
push 0x60
push 0x64b
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x78]
cmp word [eax + 4], 0
jne 0x4fb74d
mov edx, dword [ebp - 0x78]
cmp dword [edx], 5
je 0x4fb78f
mov ecx, dword [ebp - 0x78]
cmp dword [ecx], 0xb
je 0x4fb78f
push str.FCSYS08
push 0x695ee1
call fcn.004adfc8
add esp, 8
push 0
push 0x30
push esi
mov eax, 0x80
test esi, esi
je 0x4fb770
add eax, 0xffffffe0
push eax
push 0x643
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
lea eax, [ebp - 0x44]
mov edx, dword [0x69a01c]
push eax
push 0
push 0xffffffffffffffff
push str._I30
push edx
push 0x90
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
sete al
and eax, 1
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x23c], 3
jb 0x4fb7ff
cmp esi, 9
jne 0x4fb7ff
lea ecx, [ebp - 0x38]
mov eax, dword [0x69a058]
push ecx
push 0
push 0xffffffffffffffff
push str._SDS
push eax
push 0x80
push 3
mov edx, dword [edi]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
jmp 0x4fb81f
lea eax, [ebp - 0x38]
push eax
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 3
mov edx, dword [edi]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
sete al
and eax, 1
cmp esi, 5
mov dword [ebp - 0x150], eax
je 0x4fb84b
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x23c], 3
jb 0x4fb996
cmp esi, 0xb
jne 0x4fb996
cmp dword [ebp - 0x14c], 0
jne 0x4fb88e
push str.FCSYS09
push 0x695eee
call fcn.004adfc8
add esp, 8
mov ecx, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x64d
push ecx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
cmp dword [ebp - 0x150], 0
je 0x4fb8d5
push str.FCSYS10
push 0x695efb
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push esi
push 0x60
push 0x662
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
mov eax, dword [ebp - 0x78]
cmp dword [eax + 0x34], 0
jne 0x4fb8f3
cmp dword [eax + 0x30], 0
jne 0x4fb8f3
mov edx, dword [ebp - 0x78]
cmp dword [edx + 0x2c], 0
jne 0x4fb8f1
cmp dword [edx + 0x28], 0
je 0x4fb92f
push str.FCSYS11
push 0x695f08
call fcn.004adfc8
add esp, 8
push 0
push 0x30
push esi
push 0x40
push 0x673
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
lea ecx, [ebp - 0x38]
mov eax, dword [0x69a01c]
push ecx
push 0
push 0xffffffffffffffff
push str._I30
push eax
push 0xa0
push 1
mov edx, dword [edi]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
jne 0x4fb982
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x10]
test byte [edx + 0xc], 1
je 0x4fb982
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x10]
and dword [eax + 8], 0xf7ffffff
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
jmp 0x4fba78
cmp dword [ebp - 0x150], 0
jne 0x4fb9e9
push str.FCSYS12
push 0x695f15
call fcn.004adfc8
add esp, 8
test esi, esi
mov eax, 0x80
push 0
push esi
je 0x4fb9c5
cmp esi, 6
je 0x4fb9c5
add eax, 0xffffffe0
push eax
push 0x661
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x10]
test byte [edx + 0xc], 1
je 0x4fba2a
push str.FCSYS13
push 0x695f22
call fcn.004adfc8
add esp, 8
mov ecx, dword [0x6c5dd4]
push 0
push esi
push 0x80
push 0x675
push ecx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
jmp 0x500cf9
cmp dword [ebp - 0x14c], 0
je 0x4fba78
push str.FCSYS14
push 0x695f2f
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
mov eax, 0x80
test esi, esi
je 0x4fba59
add eax, 0xffffffe0
push eax
push 0x64c
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
lea eax, [ebp - 0x44]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fbaf0
push str.FCSYS15
push 0x695f3c
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x80
test esi, esi
je 0x4fbad0
cmp esi, 6
je 0x4fbad0
add eax, 0xffffffe0
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
mov ecx, esi
cmp ecx, 0xb
ja case.0x4fbafb.9
jmp dword [ecx*4 + 0x4fbb02]
push str.NTFS_Check
push str._s:_____Comparing_positions_of_MFT_n
call fcn.004adfc8
mov eax, dword [ebp - 0x28]
add esp, 8
mov edx, dword [eax + 0x264]
mov ecx, dword [edx + 0x34]
xor edx, edx
mov eax, dword [ecx + 8]
mov ecx, dword [ebp - 0x28]
cmp edx, dword [ecx + 0x50]
jne 0x4fbb60
cmp eax, dword [ecx + 0x4c]
je 0x4fbbb2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x4c]
push eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x264]
mov eax, dword [ecx + 0x34]
mov edx, dword [eax + 8]
push edx
push str.F000001
push 0x695f6d
call fcn.004adfc8
add esp, 0x10
push 0
push 0x40
push 0x678
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_MFT_Bitmap_size_n
call fcn.004adfc8
add esp, 8
lea eax, [ebp - 0x38]
push eax
push 0
push 0xffffffffffffffff
push 0
push 0
push 0xb0
push 1
mov edx, dword [edi]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fbc17
push str.F000002
push 0x695fa4
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [edi]
push ecx
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efb18
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fbc5f
push str.F000003
push 0x695fb1
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
push 0
push 8
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
call fcn.0061aea8
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], edx
push 0x20
call fcn.004e5968
pop ecx
mov dword [ebp - 0x1a0], eax
test eax, eax
je 0x4fbc9f
mov edx, dword [ebp - 0x1a0]
push edx
call fcn.004998d8
pop ecx
jmp 0x4fbca5
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x4fbcb8
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x474]
push edx
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.0049a4d0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fbd03
push str.F000004
push 0x695fbe
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
push 0x20
call fcn.004e5968
pop ecx
mov dword [ebp - 0x1a4], eax
test eax, eax
je 0x4fbd24
mov edx, dword [ebp - 0x1a4]
push edx
call fcn.004998d8
pop ecx
jmp 0x4fbd2a
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x4fbd3d
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9378
pop ecx
push eax
mov edx, dword [ebp - 0x80]
push edx
call fcn.00499974
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9378
pop ecx
push eax
push 0
mov edx, dword [ebp - 0x80]
push edx
call fcn.00499e04
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000006
push 0x695fcb
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_size_of_MFT_Mirror_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fbe30
push str.F000101
push 0x695ffd
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x22c]
shl eax, 2
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
xor edx, edx
cmp edx, dword [ebp - 0xc0]
jne 0x4fbe6e
cmp eax, dword [ebp - 0xc4]
jbe 0x4fbeb7
mov ecx, dword [ebp - 0x134]
push ecx
mov eax, dword [ebp - 0xc4]
push eax
push str.F000102
push 0x69600a
call fcn.004adfc8
add esp, 0x10
push 0
push 0x40
push 0x655
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x3c]
push eax
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov edx, dword [ebp - 0x34]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fbf10
push str.F000103
push 0x69601f
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Comparing_positions_of_MFT_Mirror_n
call fcn.004adfc8
add esp, 8
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x34]
mov eax, dword [ecx + 8]
xor edx, edx
push edx
push eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x54]
mov edx, dword [ecx + 0x58]
cmp edx, dword [esp + 4]
jne 0x4fbf41
cmp eax, dword [esp]
pop edx
pop eax
je 0x4fbf8f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x54]
push eax
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x34]
mov eax, dword [ecx + 8]
push eax
push str.F000104
push 0x696057
call fcn.004adfc8
add esp, 0x10
push 0
push 0x40
push 0x679
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Comparing_contents_of_MFT_and_MFT_Mirror_n
call fcn.004adfc8
add esp, 8
xor eax, eax
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
push edx
push str.NTFS_Check
push str._s:___Checking_MFT_Mirror_Entry__lu_n
call fcn.004adfc8
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x22c]
imul dword [ebp - 0x134]
xor edx, edx
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x22c]
push eax
mov edx, dword [ebp - 0x90]
push edx
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
mov eax, dword [ebp - 0x3c]
push eax
call fcn.004f27c4
add esp, 0x14
mov ebx, eax
test ebx, ebx
je 0x4fc044
push 0
push str.F000105
push 0x6960c3
call fcn.004adfc8
add esp, 0xc
push 0
push 0x40
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fc10b
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x22c]
push ecx
mov eax, dword [ebp - 0x94]
push eax
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f27c4
add esp, 0x14
mov ebx, eax
test ebx, ebx
je 0x4fc0ac
mov eax, dword [ebp - 0x134]
push eax
push str.F000106
push 0x6960d4
call fcn.004adfc8
add esp, 0xc
push 0
push 0x40
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fc10b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x22c]
push eax
mov edx, dword [ebp - 0x94]
push edx
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.006149cc
add esp, 0xc
test eax, eax
je 0x4fc10b
mov eax, dword [ebp - 0x134]
push eax
push str.F000107
push 0x6960e5
call fcn.004adfc8
add esp, 0xc
push 0
push 0x40
push 0x642
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
inc dword [ebp - 0x134]
cmp dword [ebp - 0x134], 3
jb 0x4fbfa9
test ebx, ebx
je 0x4fc156
push str.F000108
push 0x6960f6
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fc1a0
push str.F000109
push 0x696103
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000110
push 0x696110
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fdbb9
push str.NTFS_Check
push str._s:_____Checking_log_file_size_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fc257
push str.F000201
push 0x69613d
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0xc0], 0
jne 0x4fc280
cmp dword [ebp - 0xc4], 0x2000
jae 0x4fc2c2
mov eax, dword [ebp - 0xc4]
push eax
push str.F000202
push 0x69614a
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push 0x5e0
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
cmp dword [ebp - 0xc0], 0
jne 0x4fc2d5
cmp dword [ebp - 0xc4], 0x100000
jae 0x4fc317
mov eax, dword [ebp - 0xc4]
push eax
push str.F000203
push 0x69615b
call fcn.004adfc8
add esp, 0xc
push 0
push 0x40
push 0x670
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_restart_areas_n
call fcn.004adfc8
add esp, 8
push 0x2000
call fcn.00613cd0
pop ecx
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x4fc347
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x60]
add eax, 0x1000
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x60]
push edx
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f2cc0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fc3ba
cmp ebx, 0x5e6
je case.0x4fbafb.9
push str.F000205
push 0x69618c
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x40
cmp ebx, 0x5e6
je 0x4fc39a
add eax, 0x20
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov ecx, dword [ebp - 0x64]
push ecx
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004f2cc0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fc422
cmp ebx, 0x5e6
je case.0x4fbafb.9
push str.F000206
push 0x696199
call fcn.004adfc8
add esp, 8
push 0
mov eax, 0x40
cmp ebx, 0x5e6
je 0x4fc402
add eax, 0x20
push eax
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov dword [ebp - 0xf8], 8
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x60]
add edx, 0x1e
movzx eax, word [ecx + 4]
add eax, dword [ebp - 0x60]
cmp eax, edx
jne 0x4fc4f2
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0xf8]
inc edx
movzx eax, word [ecx + 6]
cmp eax, edx
jne 0x4fc4f2
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + 0x10], 0x1000
jne 0x4fc4f2
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x14], 0x1000
jne 0x4fc4f2
mov edx, dword [ebp - 0x60]
cmp word [edx + 0x18], 0x20
jb 0x4fc4f2
mov ecx, dword [ebp - 0x60]
cmp word [ecx + 0x18], 0x100
jae 0x4fc4f2
mov eax, dword [ebp - 0x60]
cmp word [eax + 0x1c], 1
jne 0x4fc4f2
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
add eax, 0x1e
movzx ecx, word [edx + 4]
add ecx, dword [ebp - 0x64]
cmp ecx, eax
jne 0x4fc4f2
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0xf8]
inc eax
movzx ecx, word [edx + 6]
cmp ecx, eax
jne 0x4fc4f2
mov edx, dword [ebp - 0x64]
cmp dword [edx + 0x10], 0x1000
jne 0x4fc4f2
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + 0x14], 0x1000
jne 0x4fc4f2
mov eax, dword [ebp - 0x64]
cmp word [eax + 0x18], 0x20
jb 0x4fc4f2
mov edx, dword [ebp - 0x64]
cmp word [edx + 0x18], 0x100
jae 0x4fc4f2
mov ecx, dword [ebp - 0x64]
cmp word [ecx + 0x1c], 1
je 0x4fc52a
push str.F000207
push 0x6961a6
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push 0x5e7
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x60]
movzx edx, word [eax + 0x18]
add edx, dword [ebp - 0x60]
mov dword [ebp - 0x68], edx
mov ecx, dword [ebp - 0x64]
movzx eax, word [ecx + 0x18]
add eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x68]
cmp word [edx + 0x16], 0x28
jb 0x4fc56e
mov ecx, dword [ebp - 0x68]
cmp word [ecx + 0x16], 0x100
jae 0x4fc56e
mov eax, dword [ebp - 0x6c]
cmp word [eax + 0x16], 0x28
jb 0x4fc56e
mov edx, dword [ebp - 0x6c]
cmp word [edx + 0x16], 0x100
jb 0x4fc5a7
push str.F000208
push 0x6961b3
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push 0x5e7
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x68]
movzx edx, word [eax + 0x16]
add edx, dword [ebp - 0x68]
mov dword [ebp - 0x70], edx
mov edx, dword [0x69a064]
mov ecx, dword [ebp - 0x6c]
movzx eax, word [ecx + 0x16]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
push 0x69a068
push edx
mov ecx, dword [ebp - 0x70]
add ecx, 0x20
push ecx
mov eax, dword [ebp - 0x70]
mov edx, dword [eax + 0x1c]
shr edx, 1
push edx
call fcn.0050c020
add esp, 0x10
test eax, eax
jne 0x4fc611
push 0x69a068
mov ecx, dword [0x69a064]
push ecx
mov eax, dword [ebp - 0x74]
add eax, 0x20
push eax
mov edx, dword [ebp - 0x74]
mov ecx, dword [edx + 0x1c]
shr ecx, 1
push ecx
call fcn.0050c020
add esp, 0x10
test eax, eax
je 0x4fc649
push str.F000209
push 0x6961c0
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push 0x5e7
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_for_improperly_dismounted_volume_n
call fcn.004adfc8
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
add esp, 8
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 4]
mov eax, dword [eax]
jne 0x4fc66d
cmp eax, dword [ecx]
jae 0x4fc67b
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x70], edx
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x23c], 3
jb 0x4fc69f
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x23c], 3
jne 0x4fc6ae
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x240], 0
jne 0x4fc6ae
mov ecx, dword [ebp - 0x70]
cmp dword [ecx + 0x14], 1
setne al
and eax, 1
jmp 0x4fc6c9
mov edx, dword [ebp - 0x70]
cmp dword [edx + 0x14], 1
je 0x4fc6c0
mov ecx, dword [ebp - 0x68]
test byte [ecx + 0xe], 2
je 0x4fc6c4
xor eax, eax
jmp 0x4fc6c9
mov eax, 1
test al, al
je 0x4fc70e
xor edx, edx
mov dword [ebp - 0x15c], edx
push str.F000210
push 0x696200
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push 0x5ec
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x60]
push eax
call fcn.00613cc0
pop ecx
xor edx, edx
mov dword [ebp - 0x60], edx
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000211
push 0x69620d
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_label_and_version_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x60
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fc7d1
push str.F000301
push 0x69623e
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jbe 0x4fc824
push 0
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f2374
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x4fc824
mov ecx, dword [ebp - 0x58]
push ecx
mov eax, dword [ebp - 0x134]
shr eax, 1
push eax
call fcn.004fab28
add esp, 8
push eax
push str._______________________Volume_label___s__n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fc86d
push str.F000302
push 0x696275
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x70
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fc8c2
push str.F000303
push 0x696282
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push 0
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f2374
add esp, 8
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4fc90e
mov ecx, dword [ebp - 0x54]
xor eax, eax
mov al, byte [ecx + 9]
push eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x23c]
push ecx
push str._______________________NTFS_Version:__d.__2d_n
call fcn.004adfc8
add esp, 0xc
mov eax, dword [ebp - 0x54]
movzx edx, word [eax + 0xa]
push edx
push str._______________________NTFS_Flags:_0x_02X_n
call fcn.004adfc8
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000304
push 0x6962e8
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:______Checking_attribute_definition_table_size_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 3
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fc9c5
push str.F000401
push 0x696328
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0xc0], 0
jne 0x4fc9ee
cmp dword [ebp - 0xc4], 0x8c0
jae 0x4fca36
mov eax, dword [ebp - 0xc4]
push eax
push str.F000402
push 0x696335
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push esi
push 0x60
push 0x65d
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000403
push 0x696346
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_root_index_structure_n
call fcn.004adfc8
add esp, 8
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fcaac
push 0x69637a
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fcab1
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
test byte [ecx + 0x16], 2
je 0x4fcac0
mov edx, dword [ebp - 0x78]
test byte [edx + 0x3b], 0x10
jne 0x4fcafb
push str.F000501
push 0x6963a8
call fcn.004adfc8
add esp, 8
push 0
push 0x30
push esi
push 0x60
push 0x657
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x44]
mov edx, dword [0x69a01c]
push eax
push 0
push 0xffffffffffffffff
push str._I30
push edx
push 0x90
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fcb5b
push str.F000502
push 0x6963b5
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x44]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x20
jae 0x4fcbb3
push str.F000503
push 0x6963c2
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x134]
push eax
call fcn.00613cd0
pop ecx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x4fcbd3
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x134]
push eax
mov edx, dword [ebp - 0x5c]
push edx
push 0
push 0
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004f27c4
add esp, 0x14
mov ebx, eax
test ebx, ebx
je 0x4fcc2b
push str.F000504
push 0x6963cf
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x5c]
cmp dword [edx + 4], 1
jne 0x4fcc63
mov ecx, dword [ebp - 0x5c]
xor eax, eax
mov al, byte [ecx + 0xc]
xor edx, edx
push edx
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.004f2c24
add esp, 0xc
push edx
push eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4fcc5f
cmp eax, dword [esp]
pop edx
pop eax
je 0x4fcca2
push str.F000505
push 0x6963dc
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x5c]
cmp dword [eax + 0x10], 0x10
jne 0x4fccb9
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [edx + 0x14]
cmp ecx, dword [eax + 0x18]
je 0x4fccf8
push str.F000506
push 0x6963e9
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00613cc0
pop ecx
xor edx, edx
mov dword [ebp - 0x5c], edx
lea ecx, [ebp - 0x44]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000507
push 0x6963f6
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_size_of_volume_bitmap_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fcdb9
push str.F000601
push 0x69642b
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
push 0
push 8
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
call fcn.0061aea8
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x234]
add eax, 0x3f
and eax, 0xffffffc0
xor edx, edx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], edx
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xb0]
cmp edx, dword [ebp - 0xb8]
jne 0x4fce0f
cmp eax, dword [ebp - 0xbc]
jae 0x4fce5c
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb4]
push eax
push str.F000602
push str.__s__lu__lu_
call fcn.004adfc8
add esp, 0x10
push 0
push 0x80
push esi
push 0x80
push 0x65f
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push str.NTFS_Check
push str._s:_____Counting_used_clusters_in_volume_bitmap_n
call fcn.004adfc8
add esp, 8
push 0x20
call fcn.004e5968
pop ecx
mov dword [ebp - 0x1a8], eax
test eax, eax
je 0x4fce8f
mov edx, dword [ebp - 0x1a8]
push edx
call fcn.004998d8
pop ecx
jmp 0x4fce95
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4fceae
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0xbc]
push eax
mov edx, dword [ebp - 0x84]
push edx
call fcn.00499974
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0xbc]
push eax
mov edx, dword [ebp - 0x84]
push edx
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f26e0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fcf1d
push str.F000606
push 0x69647e
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
jmp 0x500cf9
push 0x20
call fcn.004e5968
pop ecx
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x4fcf3e
mov edx, dword [ebp - 0x1ac]
push edx
call fcn.004998d8
pop ecx
jmp 0x4fcf44
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4fcf5d
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0xbc]
push eax
mov edx, dword [ebp - 0x88]
push edx
call fcn.00499974
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0xbc]
push eax
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f26e0
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fcfcc
push str.F000607
push 0x69648b
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
jmp 0x500cf9
push 0xffffffffffffffff
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
dec eax
push eax
push 0
mov edx, dword [ebp - 0x84]
push edx
call fcn.0049a300
add esp, 0x10
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000608
push 0x696498
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_position_of_primary_Boot_record_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fd0a7
push str.F000701
push 0x6964d7
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push 0
lea edx, [ebp - 0xfc]
push edx
lea ecx, [ebp - 0x9c]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004f23a8
add esp, 0x18
mov ebx, eax
test ebx, ebx
je 0x4fd101
push str.F000702
push 0x6964e4
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
cmp dword [ebp - 0x98], 0
jne 0x4fd11c
cmp dword [ebp - 0x9c], 0
jne 0x4fd11c
cmp dword [ebp - 0xfc], 0
je 0x4fd162
mov eax, dword [ebp - 0x9c]
push eax
push str.F000703
push 0x6964f1
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push esi
push 0x60
push 0x64e
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_size_of_primary_Boot_record_n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x38]
push eax
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0xc0], 0
jne 0x4fd19d
cmp dword [ebp - 0xc4], 0x200
jae 0x4fd1e5
mov eax, dword [ebp - 0xc4]
push eax
push str.F000704
push 0x696530
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push esi
push 0x40
push 0x656
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dl, byte [eax + 0x1e]
push edx
mov ecx, dword [ebp - 0x28]
xor eax, eax
mov al, byte [ecx + 0x1d]
push eax
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov cl, byte [edx + 0x1c]
push ecx
push str._______________________Boot_Signature:__02X__02X__02X_n
call fcn.004adfc8
add esp, 0x10
mov eax, dword [ebp - 0x28]
add eax, 0x1f
push eax
push str._______________________Boot_OEM_Name:____.8s__n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000705
push 0x6965a7
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_size_of_Bad_Cluster_file_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fd2d3
push str.F000801
push 0x6965df
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0xc0], 0
jne 0x4fd2f9
cmp dword [ebp - 0xc4], 0
je 0x4fd33c
mov eax, dword [ebp - 0xc4]
push eax
push str.F000802
push 0x6965ec
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push esi
push 0x40
push 0x66d
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fd385
push str.F000803
push 0x6965fd
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea edx, [ebp - 0x38]
mov ecx, dword [0x69a070]
push edx
push 0
push 0xffffffffffffffff
push str._Bad
push ecx
push 0x80
push 1
mov eax, dword [edi]
push eax
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fd3e5
push str.F000804
push 0x69660a
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
cmp dword [ebp + 0x10], 2
jb 0x4fd4a9
mov dword [ebp - 0x144], 0xffffffff
push 0
push 0
push 0
lea edx, [ebp - 0x134]
push edx
lea ecx, [ebp - 0x140]
push ecx
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004f1b4c
add esp, 0x1c
test eax, eax
jne 0x4fd463
cmp dword [ebp - 0x140], 0xffffffff
je 0x4fd431
cmp dword [ebp - 0x140], 0xfffffffe
jne 0x4fd463
push 0
push 0
push 0
lea edx, [ebp - 0x140]
push 0
push edx
mov ecx, dword [ebp - 0x134]
push ecx
mov eax, dword [ebp - 0x38]
push eax
call fcn.004f1b4c
add esp, 0x1c
test eax, eax
jne 0x4fd463
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x144], edx
mov ecx, dword [ebp - 0x144]
cmp ecx, dword [ebp - 0x124]
jae 0x4fd4a9
push str.F000806
push 0x696617
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push 0x69e
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F000807
push 0x696624
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_size_of_Upper_Case_table_n
call fcn.004adfc8
add esp, 8
lea edx, [ebp - 0x38]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 1
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fd560
push str.F001001
push 0x69665c
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
cmp dword [ebp - 0xc0], 0
jne 0x4fd589
cmp dword [ebp - 0xc4], 0x20000
je 0x4fd5ca
push str.F001002
push 0x696669
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push esi
push 0x40
push 0x65a
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_contents_of_Upper_Case_table_n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0xc4]
push eax
call fcn.00613cd0
pop ecx
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x4fd602
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0xc4]
push eax
mov edx, dword [ebp - 0x8c]
push edx
push 0
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f27c4
add esp, 0x14
mov ebx, eax
test ebx, ebx
je 0x4fd65a
push str.F001003
push 0x6966a5
call fcn.004adfc8
add esp, 8
push 0
push 0x40
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
xor edx, edx
mov dword [ebp - 0x114], edx
xor ecx, ecx
mov dword [ebp - 0x118], ecx
xor eax, eax
mov dword [ebp - 0x11c], eax
xor edx, edx
mov dword [ebp - 0x134], edx
push 0
mov cx, word [ebp - 0x134]
push ecx
call fcn.004e0dfc
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x134]
add esp, 8
cmp ax, word [edx + ecx*2]
je 0x4fd6a4
inc dword [ebp - 0x114]
push 1
mov ax, word [ebp - 0x134]
push eax
call fcn.004e0dfc
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x134]
add esp, 8
cmp ax, word [edx + ecx*2]
je 0x4fd6ce
inc dword [ebp - 0x118]
push 2
mov ax, word [ebp - 0x134]
push eax
call fcn.004e0dfc
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x134]
add esp, 8
cmp ax, word [edx + ecx*2]
je 0x4fd6f8
inc dword [ebp - 0x11c]
inc dword [ebp - 0x134]
cmp dword [ebp - 0x134], 0x10000
jb 0x4fd67a
mov eax, dword [ebp - 0x8c]
push eax
call fcn.00613cc0
pop ecx
xor eax, eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x114], 0
jne 0x4fd755
cmp dword [ebp - 0x118], 0
je 0x4fd755
cmp dword [ebp - 0x11c], 0
je 0x4fd755
push str.NTFS_Check
push str._s:_______Upcase_table_has_NT_3.x_format._n
call fcn.004adfc8
add esp, 8
jmp 0x4fd7f2
cmp dword [ebp - 0x114], 0
je 0x4fd784
cmp dword [ebp - 0x118], 0
jne 0x4fd784
cmp dword [ebp - 0x11c], 0
je 0x4fd784
push str.NTFS_Check
push str._s:_______Upcase_table_has_NT_4.x_format._n
call fcn.004adfc8
add esp, 8
jmp 0x4fd7f2
cmp dword [ebp - 0x114], 0
je 0x4fd7b3
cmp dword [ebp - 0x118], 0
je 0x4fd7b3
cmp dword [ebp - 0x11c], 0
jne 0x4fd7b3
push str.NTFS_Check
push str._s:_______Upcase_table_has_NT_5.x_format._n
call fcn.004adfc8
add esp, 8
jmp 0x4fd7f2
push str.F001004
push 0x696733
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push esi
push 0x40
push 0x65b
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je case.0x4fbafb.9
push str.F001005
push 0x696740
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x23c], 3
jb case.0x4fbafb.9
push str.NTFS_Check
push str._s:_____Checking_extended_index_structure_n
call fcn.004adfc8
add esp, 8
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4fd878
push 0x696778
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fd87d
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 2
jne 0x4fd8bf
push str.F001101
push 0x6967a6
call fcn.004adfc8
add esp, 8
push 0
push 0x30
push esi
push 0x60
push 0x657
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x38]
mov edx, dword [0x69a01c]
push eax
push 0
push 0xffffffffffffffff
push str._I30
push edx
push 0x90
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fd91f
push str.F001102
push 0x6967b3
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f1334
pop ecx
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x20
jae 0x4fd977
push str.F001103
push 0x6967c0
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x134]
push eax
call fcn.00613cd0
pop ecx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x4fd997
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x134]
push eax
mov edx, dword [ebp - 0x5c]
push edx
push 0
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f27c4
add esp, 0x14
mov ebx, eax
test ebx, ebx
je 0x4fd9ef
push str.F001104
push 0x6967cd
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x5c]
cmp dword [edx + 4], 1
jne 0x4fda27
mov ecx, dword [ebp - 0x5c]
xor eax, eax
mov al, byte [ecx + 0xc]
xor edx, edx
push edx
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004f2c24
add esp, 0xc
push edx
push eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 8]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4fda23
cmp eax, dword [esp]
pop edx
pop eax
je 0x4fda66
push str.F001105
push 0x6967da
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fdaac
push str.F001106
push 0x6967e7
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov edx, dword [ebp - 0x5c]
cmp dword [edx + 0x10], 0x10
jne 0x4fdac3
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x14]
cmp eax, dword [edx + 0x18]
je 0x4fdaff
push str.F001107
push 0x6967f4
call fcn.004adfc8
add esp, 8
push 0
push 0x90
push esi
push 0x60
push 0x658
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp case.0x4fbafb.9
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00613cc0
pop ecx
xor edx, edx
mov dword [ebp - 0x5c], edx
push esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x474]
push eax
call fcn.0049a038
add esp, 8
test al, al
je 0x4fdb5a
push str.FBSYS01
push 0x696801
call fcn.004adfc8
add esp, 8
mov edx, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x646
push edx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fdb9c
push str.FCSYS16
push 0x69680e
call fcn.004adfc8
add esp, 8
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
push 0x20
inc esi
push esi
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532934
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
inc dword [ebp - 0x130]
cmp dword [ebp - 0x130], 0x10
jb 0x4fb2a6
xor eax, eax
xor edx, edx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], edx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xd4], ecx
xor edx, edx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], edx
xor esi, esi
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
push edi
mov edx, 4
cmp esi, 0xa
jbe 0x4fdc14
add edx, 0xff
push edx
push esi
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004ef984
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4fdc5d
push esi
push str.FFSYS01
push 0x69681b
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fe7e1
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fdc74
push 0x69682c
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fdc79
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
cmp dword [ecx], 0x454c4946
jne 0x4fe77f
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fdc9c
push 0x69685a
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fdca1
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
push eax
call fcn.0050b920
pop ecx
test eax, eax
jne 0x4fe77f
lea edx, [ebp - 0x120]
push edx
lea ecx, [ebp - 0x110]
push ecx
lea eax, [ebp - 0x154]
push eax
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0xf4]
push ecx
push 0
mov eax, dword [ebp - 0x88]
push eax
mov edx, dword [edi]
push edx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
cmp dword [ebp - 0x154], 0
je 0x4fdcf8
inc dword [ebp - 0xf0]
test ebx, ebx
je 0x4fe74d
push esi
push str.FFSYS02
push 0x696888
call fcn.004adfc8
add esp, 0xc
mov eax, ebx
sub eax, 0x5fe
je 0x4fdd2a
sub eax, 0x60
je 0x4fe406
jmp 0x4fe6eb
mov edx, dword [edi]
push edx
call fcn.0050a6b4
pop ecx
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x4fdda7
xor ecx, ecx
mov dword [ebp - 0x134], ecx
jmp 0x4fdd7c
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 8]
add edx, dword [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.00499fb4
add esp, 8
test al, al
je 0x4fdd76
mov ebx, 0x1f5
jmp 0x4fdd8d
inc dword [ebp - 0x134]
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp - 0x134]
ja 0x4fdd4c
cmp ebx, 0x1f5
je 0x4fdda7
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx]
mov dword [ebp - 0x188], eax
test eax, eax
jne 0x4fdd42
cmp ebx, 0x1f5
jne 0x4fe124
push esi
push str.FFSYS03
push 0x696899
call fcn.004adfc8
add esp, 0xc
cmp dword [ebp - 0x180], 0
je 0x4fdddc
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4fddfd
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4fde1f
cmp dword [ebp - 0x17c], 0
je 0x4fde1f
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x58
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x4fde61
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4fde40
dec edx
push edx
push 0x60
push ebx
mov ecx, dword [ebp - 0x120]
push ecx
push esi
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x1b0]
push edx
call fcn.005046f0
add esp, 0x1c
jmp 0x4fde67
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4fde80
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop ecx
test eax, eax
je 0x4fded0
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fdf1a
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4fdfec
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1b4], eax
test eax, eax
je 0x4fdf79
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x1b8], ecx
mov eax, dword [ebp - 0x1b4]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x1b4]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x1b8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x1b4]
jmp 0x4fdf7f
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4fdf98
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x1bc], eax
mov edx, dword [ebp - 0x1bc]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4fdfd5
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4fdff4
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4fe738
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fe738
mov eax, dword [edi]
push eax
call fcn.0050a6b4
pop ecx
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x4fe0bf
xor edx, edx
mov dword [ebp - 0x134], edx
jmp 0x4fe094
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx + 8]
add eax, dword [ebp - 0x134]
push eax
mov edx, dword [ebp - 0x84]
push edx
call fcn.00499fb4
add esp, 8
test al, al
je 0x4fe08e
mov ebx, 0x1f5
jmp 0x4fe0a5
inc dword [ebp - 0x134]
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp - 0x134]
ja 0x4fe064
cmp ebx, 0x1f5
je 0x4fe0bf
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx]
mov dword [ebp - 0x188], eax
test eax, eax
jne 0x4fe05a
push esi
push str.FFSYS04
push 0x6968aa
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4fe102
cmp ebx, 0x6a4
jge 0x4fe102
push 0
mov ecx, dword [0x6c5dd4]
mov edx, dword [ebp - 0x120]
push edx
push esi
push 0x60
push ebx
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4fe117
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fe7e1
cmp dword [ebp - 0x180], 0
je 0x4fe13a
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4fe15b
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4fe17d
cmp dword [ebp - 0x17c], 0
je 0x4fe17d
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x54
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1c0], eax
test eax, eax
je 0x4fe1bf
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4fe19e
dec edx
push edx
push 0x60
push ebx
push esi
mov ecx, dword [ebp - 0x88]
push ecx
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x1c0]
push edx
call fcn.005045ac
add esp, 0x1c
jmp 0x4fe1c5
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4fe1de
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop ecx
test eax, eax
je 0x4fe22e
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fe278
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4fe34a
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1c4], eax
test eax, eax
je 0x4fe2d7
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x1c8], ecx
mov eax, dword [ebp - 0x1c4]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x1c4]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1c8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x1c4]
jmp 0x4fe2dd
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4fe2f6
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0x1cc]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4fe333
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4fe352
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4fe738
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fe738
push esi
push str.FFSYS05
push 0x6968bb
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4fe3e3
cmp ebx, 0x6a4
jge 0x4fe3e3
push 0
mov edx, dword [0x6c5dd4]
mov eax, dword [ebp - 0x120]
push eax
push esi
push 0x60
push ebx
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4fe3f9
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fe7e1
cmp dword [ebp - 0x180], 0
je 0x4fe41c
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4fe43d
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4fe45f
cmp dword [ebp - 0x17c], 0
je 0x4fe45f
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x50
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1d0], eax
test eax, eax
je 0x4fe49a
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4fe480
dec edx
push edx
push 0x60
push ebx
push esi
mov ecx, dword [ebp - 0x28]
push ecx
mov eax, dword [ebp - 0x1d0]
push eax
call fcn.00504460
add esp, 0x18
jmp 0x4fe4a0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4fe4b9
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x120]
push eax
push esi
mov edx, dword [ebp - 0x17c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x4fe513
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fe55d
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4fe62f
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1d4], eax
test eax, eax
je 0x4fe5bc
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x1d8], ecx
mov eax, dword [ebp - 0x1d4]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x1d4]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1d8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x1d4]
jmp 0x4fe5c2
mov edx, dword [ebp - 0x1d4]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4fe5db
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x1dc], eax
mov edx, dword [ebp - 0x1dc]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4fe618
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4fe637
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4fe738
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4fe738
push esi
push str.FFSYS06
push 0x6968cc
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4fe6c8
cmp ebx, 0x6a4
jge 0x4fe6c8
push 0
mov edx, dword [0x6c5dd4]
mov eax, dword [ebp - 0x120]
push eax
push esi
push 0x60
push ebx
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4fe6de
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x4fe7e1
xor eax, eax
cmp ebx, 0x640
mov dword [ebp - 0x158], eax
jl 0x4fe723
cmp ebx, 0x6a4
jge 0x4fe723
push 0
mov ecx, dword [0x6c5dd4]
mov edx, dword [ebp - 0x120]
push edx
push esi
push 0x60
push ebx
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4fe738
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
cmp dword [ebp - 0x158], 0
je 0x4fe7e1
cmp esi, 5
jne 0x4fe760
mov edx, dword [ebp - 0xf4]
add dword [ebp - 0xdc], edx
jmp 0x4fe77f
cmp esi, 8
jne 0x4fe773
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0xd4], ecx
jmp 0x4fe77f
mov eax, dword [ebp - 0xf4]
add dword [ebp - 0xe0], eax
push 0x20
lea edx, [esi + 0x11]
push edx
mov ecx, dword [ebp - 0x190]
push ecx
call fcn.00532934
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fe7e1
push esi
push str.FFSYS07
push 0x6968dd
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
inc esi
cmp esi, 0x10
jb 0x4fdbf6
push str.NTFS_Check
push 0x6968ee
call fcn.004adfc8
add esp, 8
push str.NTFS_Check
push str._s:_Checking_user_file_entries..._n
call fcn.004adfc8
add esp, 8
mov edx, dword [ebp - 0x190]
push edx
call fcn.00532a74
pop ecx
push 3
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
xor edx, edx
mov dword [ebp - 0x190], edx
test ebx, ebx
jne 0x500cf9
push 0x13
mov ecx, dword [ebp - 0x194]
push ecx
mov eax, dword [ebp - 0x18c]
push eax
call fcn.005329e8
add esp, 0xc
push 0x1dd
mov edx, dword [ebp - 0x18c]
push edx
call fcn.00532834
add esp, 8
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x1e0], eax
test eax, eax
je 0x4fe88c
mov edx, dword [ebp - 0x1e0]
push edx
call fcn.00532628
pop ecx
jmp 0x4fe892
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x4fe8ab
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x190]
push eax
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
xor eax, eax
xor edx, edx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xec], 1
mov dword [ebp - 0xd8], edx
cmp dword [ebp - 0x80], 0
je 0x4fe8f4
push 5
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00499dc0
add esp, 8
mov esi, 0x10
jmp 0x5000f7
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
push edi
push 0x103
push esi
mov edx, dword [ebp - 0x28]
push edx
call fcn.004ef984
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4fe959
push esi
push str.FUSER01
push 0x69691e
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fe970
push 0x69692f
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4fe975
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
cmp dword [ecx], 0x454c4946
jne 0x4fe99f
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4fe994
push 0x69695d
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fe999
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 1
jne 0x4fea01
push esi
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x474]
push ecx
call fcn.00499fb4
add esp, 8
test al, al
je 0x50007e
push esi
push str.FUSER02
push 0x69698b
call fcn.004adfc8
add esp, 0xc
mov eax, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x648
push eax
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push esi
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00499eb8
add esp, 8
jmp 0x50007e
push esi
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x474]
push ecx
call fcn.0049a038
add esp, 8
test al, al
je 0x4fea4d
push esi
push str.FUSER03
push 0x69699c
call fcn.004adfc8
add esp, 0xc
mov eax, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x647
push eax
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [edi]
cmp dword [eax + 0x3c], 0
jne 0x4fea64
push 0x6969ad
call fcn.004adfc8
pop ecx
xor edx, edx
jmp 0x4fea69
mov ecx, dword [edi]
mov edx, dword [ecx + 0x34]
cmp word [edx + 0x24], 0
je 0x4feaac
push esi
push str.FUSER04
push 0x6969db
call fcn.004adfc8
add esp, 0xc
push 0
push 0
push esi
push 0x60
push 0x601
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
mov eax, dword [edi]
cmp dword [eax + 0x3c], 0
jne 0x4feac3
push 0x6969ec
call fcn.004adfc8
pop ecx
xor edx, edx
jmp 0x4feac8
mov ecx, dword [edi]
mov edx, dword [ecx + 0x34]
push edx
call fcn.0050b920
pop ecx
test eax, eax
je 0x4febca
lea eax, [ebp - 0x30]
push eax
push 4
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4feaf4
push 0x696a1a
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4feaf9
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
mov edx, dword [eax + 0x20]
push edx
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004ef984
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4feb44
push esi
push str.FUSER07
push 0x696a48
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
mov edx, dword [edi]
test byte [edx + 0x18], 0x20
je 0x4feba8
push esi
push str.FUSER08
push 0x696a59
call fcn.004adfc8
add esp, 0xc
push 0
push 0x20
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4feb7a
push 0x696a6a
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4feb7f
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
mov edx, dword [eax + 0x20]
push edx
push 0x60
push 0x608
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
push esi
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00499eb8
add esp, 8
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004efbc0
add esp, 8
jmp 0x50007e
lea eax, [ebp - 0x120]
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x154]
push ecx
lea eax, [ebp - 0x10c]
push eax
lea edx, [ebp - 0xf4]
push edx
cmp dword [ebp + 0x10], 2
jb 0x4fec15
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4fec0a
push 0x696a98
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4fec0f
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 4
je 0x4fec19
xor edx, edx
jmp 0x4fec1e
mov edx, 1
push edx
mov ecx, dword [ebp - 0x88]
push ecx
mov eax, dword [edi]
push eax
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
cmp dword [ebp - 0x154], 0
je 0x4fec42
inc dword [ebp - 0xf0]
test ebx, ebx
je 0x4ff748
push esi
push str.FUSER09
push 0x696ac6
call fcn.004adfc8
add esp, 0xc
mov eax, ebx
sub eax, 0x5fe
je 0x4fec74
sub eax, 0x60
je 0x4ff350
jmp 0x4ff635
mov edx, dword [edi]
push edx
call fcn.0050a6b4
pop ecx
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x4fecf1
xor ecx, ecx
mov dword [ebp - 0x134], ecx
jmp 0x4fecc6
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 8]
add edx, dword [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.00499fb4
add esp, 8
test al, al
je 0x4fecc0
mov ebx, 0x1f5
jmp 0x4fecd7
inc dword [ebp - 0x134]
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp - 0x134]
ja 0x4fec96
cmp ebx, 0x1f5
je 0x4fecf1
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx]
mov dword [ebp - 0x188], eax
test eax, eax
jne 0x4fec8c
cmp ebx, 0x1f5
jne 0x4ff06e
push esi
push str.FUSER10
push 0x696ad7
call fcn.004adfc8
add esp, 0xc
cmp dword [ebp - 0x180], 0
je 0x4fed26
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4fed47
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4fed69
cmp dword [ebp - 0x17c], 0
je 0x4fed69
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x58
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1e4], eax
test eax, eax
je 0x4fedab
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4fed8a
dec edx
push edx
push 0x60
push ebx
mov ecx, dword [ebp - 0x120]
push ecx
push esi
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x1e4]
push edx
call fcn.005046f0
add esp, 0x1c
jmp 0x4fedb1
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4fedca
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop ecx
test eax, eax
je 0x4fee1a
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4fee64
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4fef36
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1e8], eax
test eax, eax
je 0x4feec3
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x1ec], ecx
mov eax, dword [ebp - 0x1e8]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x1e8]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x1e8]
mov eax, dword [ebp - 0x1ec]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x1e8]
jmp 0x4feec9
mov edx, dword [ebp - 0x1e8]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4feee2
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x1f0], eax
mov edx, dword [ebp - 0x1f0]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4fef1f
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4fef3e
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4ff733
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4ff733
mov eax, dword [edi]
push eax
call fcn.0050a6b4
pop ecx
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
je 0x4ff009
xor edx, edx
mov dword [ebp - 0x134], edx
jmp 0x4fefde
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx + 8]
add eax, dword [ebp - 0x134]
push eax
mov edx, dword [ebp - 0x84]
push edx
call fcn.00499fb4
add esp, 8
test al, al
je 0x4fefd8
mov ebx, 0x1f5
jmp 0x4fefef
inc dword [ebp - 0x134]
mov eax, dword [ebp - 0x188]
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp - 0x134]
ja 0x4fefae
cmp ebx, 0x1f5
je 0x4ff009
mov ecx, dword [ebp - 0x188]
mov eax, dword [ecx]
mov dword [ebp - 0x188], eax
test eax, eax
jne 0x4fefa4
push esi
push str.FUSER11
push 0x696ae8
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4ff04c
cmp ebx, 0x6a4
jge 0x4ff04c
push 0
mov ecx, dword [0x6c5dd4]
mov edx, dword [ebp - 0x120]
push edx
push esi
push 0x60
push ebx
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4ff061
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add al, byte [eax]
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp - 0x180], 0
je 0x4ff084
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4ff0a5
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4ff0c7
cmp dword [ebp - 0x17c], 0
je 0x4ff0c7
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x54
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1f4], eax
test eax, eax
je 0x4ff109
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4ff0e8
dec edx
push edx
push 0x60
push ebx
push esi
mov ecx, dword [ebp - 0x88]
push ecx
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x1f4]
push edx
call fcn.005045ac
add esp, 0x1c
jmp 0x4ff10f
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4ff128
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
pop ecx
test eax, eax
je 0x4ff178
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4ff1c2
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4ff294
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x1f8], eax
test eax, eax
je 0x4ff221
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x1fc], ecx
mov eax, dword [ebp - 0x1f8]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x1f8]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x1fc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x1f8]
jmp 0x4ff227
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4ff240
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x200], eax
mov edx, dword [ebp - 0x200]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4ff27d
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4ff29c
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4ff733
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4ff733
push esi
push str.FUSER12
push 0x696af9
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4ff32d
cmp ebx, 0x6a4
jge 0x4ff32d
push 0
mov edx, dword [0x6c5dd4]
mov eax, dword [ebp - 0x120]
push eax
push esi
push 0x60
push ebx
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4ff343
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp - 0x180], 0
je 0x4ff366
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x4ff387
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x4ff3a9
cmp dword [ebp - 0x17c], 0
je 0x4ff3a9
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x50
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x204], eax
test eax, eax
je 0x4ff3e4
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x4ff3ca
dec edx
push edx
push 0x60
push ebx
push esi
mov ecx, dword [ebp - 0x28]
push ecx
mov eax, dword [ebp - 0x204]
push eax
call fcn.00504460
add esp, 0x18
jmp 0x4ff3ea
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x4ff403
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x120]
push eax
push esi
mov edx, dword [ebp - 0x17c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x4ff45d
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x4ff4a7
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov ecx, dword [ebp - 0x180]
cmp dword [ecx], 0
je 0x4ff579
push 0x10
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x208], eax
test eax, eax
je 0x4ff506
mov edx, dword [ebp - 0x180]
mov ecx, dword [edx]
mov dword [ebp - 0x20c], ecx
mov eax, dword [ebp - 0x208]
push eax
call fcn.0052e278
pop ecx
mov edx, dword [ebp - 0x208]
mov dword [edx], 0x696fb4
mov ecx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x20c]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x208]
jmp 0x4ff50c
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0
jne 0x4ff525
mov ebx, 3
jmp 0x500cf9
mov eax, dword [ebp - 0x184]
push eax
call fcn.0052357c
pop ecx
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
add edx, 0x40
mov ecx, dword [edx]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x184], 0
je 0x4ff562
push 3
mov eax, dword [ebp - 0x184]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
xor eax, eax
mov dword [ebp - 0x180], eax
jmp 0x4ff581
xor edx, edx
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 1
jne 0x4ff733
lea ecx, [ebp - 0x120]
push ecx
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebp - 0xf4]
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa7ac
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4ff733
push esi
push str.FUSER13
push 0x696b0a
call fcn.004adfc8
add esp, 0xc
cmp ebx, 0x640
jl 0x4ff612
cmp ebx, 0x6a4
jge 0x4ff612
push 0
mov edx, dword [0x6c5dd4]
mov eax, dword [ebp - 0x120]
push eax
push esi
push 0x60
push ebx
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x4ff628
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
xor eax, eax
xor edx, edx
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x13c], 0x60
mov dword [ebp - 0x174], edx
cmp dword [ebp + 0x10], 2
jb 0x4ff685
cmp ebx, 0x690
jl 0x4ff685
cmp ebx, 0x6a4
jge 0x4ff685
mov ecx, dword [ebx*4 + 0x693ecc]
mov dword [ebp - 0x13c], ecx
cmp dword [ebp - 0x13c], 0x60
sete al
and eax, 1
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x13c], 0x40
jne 0x4ff6e3
push 0
push 0x16d
mov edx, dword [0x68bfe8]
push edx
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push ebx
call fcn.0050c094
pop ecx
push eax
mov ecx, dword [0x68bfe8]
push ecx
call fcn.004c6c0c
add esp, 8
push eax
mov eax, dword [0x67939c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x4ff6df
mov ebx, 7
jmp 0x500cf9
xor ebx, ebx
jmp 0x4ff733
cmp ebx, 0x640
jl 0x4ff711
cmp ebx, 0x6a4
jge 0x4ff711
push 0
mov edx, dword [0x6c5dd4]
mov eax, dword [ebp - 0x120]
push eax
push esi
push 0x60
push ebx
push edx
call fcn.00523d64
add esp, 0x18
jmp 0x4ff733
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
cmp dword [ebp - 0x174], 0
je 0x4ff733
mov ebx, 7
test ebx, ebx
jne 0x500cf9
cmp dword [ebp - 0x158], 0
je 0x5000f6
lea eax, [ebp - 0x38]
push eax
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x10
push 0
mov edx, dword [edi]
push edx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4ff7ab
cmp ebx, 0x5ed
jne 0x4ff776
mov ebx, 0x664
push esi
push str.FUSER14
push 0x696b1b
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
push 0
mov edx, dword [ebp - 0x38]
push edx
call fcn.004f2374
add esp, 8
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x28]
xor eax, eax
mov al, byte [ecx + 0x29]
cmp eax, 1
jbe 0x4ff842
cmp dword [ebp + 0x10], 2
jb 0x4ff842
cmp dword [ebp - 0x170], 0
jne 0x4ff842
mov edx, dword [ebp - 0x50]
test byte [edx + 0x20], 0x10
jne 0x4ff842
mov ecx, dword [ebp - 0x50]
cmp dword [ecx + 0x24], 0
je 0x4ff842
mov dword [ebp - 0x170], 1
push 0
push 0x16d
mov eax, dword [0x68bfe8]
push eax
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push 0x16c
mov edx, dword [0x68bfe8]
push edx
call fcn.004c6c0c
add esp, 8
mov ecx, dword [0x67939c]
push eax
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x4ff842
mov ebx, 7
jmp 0x500cf9
lea eax, [ebp - 0x38]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
lea ecx, [ebp - 0x40]
push ecx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x30
push 0
mov eax, dword [edi]
push eax
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x4ff8b4
cmp ebx, 0x5ed
jne 0x4ff87f
mov ebx, 0x663
push esi
push str.FUSER15
push 0x696b2c
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
push 0
mov edx, dword [ebp - 0x40]
push edx
call fcn.004f2374
add esp, 8
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x4ff90d
cmp ebx, 0x5ed
jne 0x4ff8d8
mov ebx, 0x663
push esi
push str.FUSER16
push 0x696b3d
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp + 0x10], 2
jb 0x4ffa5e
push 8
mov edx, dword [ebp - 0x78]
push edx
lea ecx, [ebp - 0xa4]
push ecx
call fcn.00614680
mov eax, dword [ebp - 0x78]
add esp, 0xc
mov dl, byte [eax + 0x41]
mov byte [ebp - 0x145], dl
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x48], eax
push edx
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4ff95c
push 0x696b4e
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4ff961
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
push eax
mov edx, dword [edi]
push edx
call fcn.004eb1a4
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x4ffa5e
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0x30
jne 0x4ffa5e
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0xa4]
movzx ecx, word [edx + 0x14]
add ecx, dword [ebp - 0x48]
mov dword [ebp - 0x78], ecx
push 8
push eax
mov edx, dword [ebp - 0x78]
push edx
call fcn.006149cc
add esp, 0xc
test eax, eax
jne 0x4ff9bb
test byte [ebp - 0x145], 1
je 0x4ff9ef
mov ecx, dword [ebp - 0x48]
test byte [ecx + 0xc], 1
je 0x4ff9ef
push str.FCVT401
push 0x696b7c
call fcn.004adfc8
add esp, 8
mov eax, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x695
push eax
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
lea eax, [ebp - 0x48]
push eax
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x4ffa0a
push 0x696b89
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x4ffa0f
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [edi]
push edx
call fcn.004eb1a4
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x4ffa5e
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0x30
jne 0x4ffa5e
push str.FCVT402
push 0x696bb7
call fcn.004adfc8
add esp, 8
mov edx, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x695
push edx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [edi]
cmp dword [eax + 0x3c], 0
jne 0x4ffa75
push 0x696bc4
call fcn.004adfc8
pop ecx
xor edx, edx
jmp 0x4ffa7a
mov ecx, dword [edi]
mov edx, dword [ecx + 0x34]
test byte [edx + 0x16], 2
jne 0x4ffaa2
lea eax, [ebp - 0x44]
push eax
push 0
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 0x90
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
jmp 0x4ffaca
lea eax, [ebp - 0x44]
mov edx, dword [0x69a01c]
push eax
push 0
push 0xffffffffffffffff
push str._I30
push edx
push 0x90
push 0
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
lea edx, [ebp - 0x38]
sete al
and eax, 1
mov dword [ebp - 0x14c], eax
push edx
push 0
push 0xffffffffffffffff
push 0
push 0
push 0x80
push 3
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
sete al
and eax, 1
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x4ffc3d
cmp dword [ebp + 0x10], 2
jb 0x4ffc3d
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x10]
cmp byte [ecx + 8], 0
jne 0x4ffb47
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x10]
mov ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e93e8
add esp, 8
add dword [ebp - 0x124], eax
jmp 0x4ffba5
cmp dword [ebp + 0x10], 2
jne 0x4ffba5
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x10]
mov eax, dword [ecx + 0x30]
add eax, 0x1ff
dec eax
shr eax, 9
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x128]
dec eax
xor edx, edx
div dword [ebp - 0x128]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x128]
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x10c]
add dword [ebp - 0x124], eax
cmp dword [ebp - 0x164], 0
jne 0x4ffc3d
lea edx, [ebp - 0x3c]
push edx
push 0
push 0xffffffffffffffff
push 0
push 0xfffffffffffffffe
push 0x80
push 3
mov ecx, dword [edi]
push ecx
call fcn.0050a858
add esp, 0x20
mov ebx, eax
test ebx, ebx
jne 0x4ffc3d
lea eax, [ebp - 0x3c]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
mov ecx, dword [0x68bfe8]
mov dword [ebp - 0x164], 1
push 0
push 0x16d
push ecx
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push 0x16a
mov eax, dword [0x68bfe8]
push eax
call fcn.004c6c0c
add esp, 8
mov edx, dword [0x67939c]
push eax
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x4ffc3d
mov ebx, 7
jmp 0x500cf9
mov eax, dword [edi]
cmp dword [eax + 0x3c], 0
jne 0x4ffc54
push 0x696bf2
call fcn.004adfc8
pop ecx
xor edx, edx
jmp 0x4ffc59
mov ecx, dword [edi]
mov edx, dword [ecx + 0x34]
test byte [edx + 0x16], 0xa
je 0x4ffd73
cmp dword [ebp - 0x14c], 0
jne 0x4ffca6
push esi
push str.FUSER17
push 0x696c20
call fcn.004adfc8
add esp, 0xc
mov eax, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x64d
push eax
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp - 0x150], 0
je 0x4ffcee
push esi
push str.FUSER18
push 0x696c31
call fcn.004adfc8
add esp, 0xc
push 0
push 0x80
push esi
push 0x60
push 0x662
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
mov eax, dword [ebp - 0x78]
cmp dword [eax + 0x34], 0
jne 0x4ffd0c
cmp dword [eax + 0x30], 0
jne 0x4ffd0c
mov edx, dword [ebp - 0x78]
cmp dword [edx + 0x2c], 0
jne 0x4ffd0a
cmp dword [edx + 0x28], 0
je 0x4ffd49
push esi
push str.FUSER19
push 0x696c42
call fcn.004adfc8
add esp, 0xc
push 0
push 0x30
push esi
push 0x40
push 0x673
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp - 0x80], 0
je 0x4ffd5c
push esi
mov eax, dword [ebp - 0x80]
push eax
call fcn.00499dc0
add esp, 8
mov edx, dword [ebp - 0xf4]
add dword [ebp - 0xdc], edx
inc dword [ebp - 0xec]
jmp 0x4ffe4f
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4ffd8a
push 0x696c53
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4ffd8f
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 4
jne 0x4ffe4f
cmp dword [ebp - 0x150], 0
jne 0x4ffddd
push esi
push str.FUSER20
push 0x696c81
call fcn.004adfc8
add esp, 0xc
mov edx, dword [0x6c5dd4]
push 0
push esi
push 0x60
push 0x661
push edx
call fcn.00523cb8
add esp, 0x14
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp - 0x14c], 0
je 0x4ffe25
push esi
push str.FUSER21
push 0x696c92
call fcn.004adfc8
add esp, 0xc
push 0
push 0x90
push esi
push 0x60
push 0x64c
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
mov eax, dword [ebp - 0xf4]
add dword [ebp - 0xd8], eax
mov edx, dword [ebp - 0x10c]
add dword [ebp - 0x104], edx
mov ecx, dword [ebp - 0x110]
add dword [ebp - 0x108], ecx
inc dword [ebp - 0xe4]
lea eax, [ebp - 0x44]
push eax
mov edx, dword [edi]
push edx
call fcn.0050aa50
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
push eax
call fcn.0050aa50
add esp, 8
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [edi]
push ecx
call fcn.0050aa50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4ffeb7
push esi
push str.FUSER22
push 0x696ca3
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x5000f6
cmp dword [ebp + 0x10], 2
jb 0x50007e
cmp dword [ebp - 0x16c], 0
jne 0x50007e
lea edx, [ebp - 0x48]
push edx
mov ecx, dword [edi]
cmp dword [ecx + 0x3c], 0
jne 0x4ffee9
push 0x696cb4
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x4ffeee
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
push eax
mov edx, dword [edi]
push edx
call fcn.00507e34
add esp, 0xc
mov ebx, eax
jmp 0x500065
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0x20
jne 0x4fffca
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [edi]
push ecx
call fcn.00508584
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4fffb0
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
push edx
call fcn.004faad0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4fff97
mov dword [ebp - 0x16c], 1
push 0
push 0x16d
mov eax, dword [0x68bfe8]
push eax
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push ebx
call fcn.0050c094
pop ecx
push eax
mov edx, dword [0x68bfe8]
push edx
call fcn.004c6c0c
add esp, 8
mov ecx, dword [0x67939c]
push eax
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x500075
mov ebx, 7
jmp 0x500cf9
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [edi]
push edx
call fcn.0050853c
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4fff26
mov eax, dword [edi]
push eax
call fcn.005085f4
pop ecx
cmp ebx, 0x13
jne 0x4fffc0
xor ebx, ebx
test ebx, ebx
jne 0x500cf9
jmp 0x500037
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
push edx
call fcn.004faad0
pop ecx
mov ebx, eax
test ebx, ebx
je 0x500037
mov dword [ebp - 0x16c], 1
push 0
push 0x16d
mov eax, dword [0x68bfe8]
push eax
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push ebx
call fcn.0050c094
pop ecx
push eax
mov edx, dword [0x68bfe8]
push edx
call fcn.004c6c0c
add esp, 8
mov ecx, dword [0x67939c]
push eax
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x500075
mov ebx, 7
jmp 0x500cf9
lea eax, [ebp - 0x48]
push eax
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x500052
push 0x696ce2
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x500057
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
push ecx
mov edx, dword [edi]
push edx
call fcn.004eb1a4
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500075
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0xffffffff
jne 0x4fff01
mov edx, dword [edi]
push edx
call fcn.0050806c
pop ecx
test esi, 0xff
jne 0x5000b3
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004e9344
pop ecx
sub eax, 0x10
push eax
mov eax, esi
sub eax, 0xf
push eax
mov edx, dword [ebp - 0x190]
push edx
call fcn.00532934
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x5000f6
push esi
push str.FUSER23
push 0x696d10
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
inc esi
mov edx, dword [ebp - 0x28]
push edx
call fcn.004e9344
pop ecx
cmp esi, eax
jb 0x4fe8fe
push str.NTFS_Check
push 0x696d21
call fcn.004adfc8
add esp, 8
push str.NTFS_Check
push str._s:_Checking_for_orphan_clusters..._n
call fcn.004adfc8
add esp, 8
mov ecx, dword [ebp - 0x190]
push ecx
call fcn.00532a74
pop ecx
push 3
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
xor edx, edx
mov dword [ebp - 0x190], edx
test ebx, ebx
jne 0x500cf9
push 0x14
push 0x13
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.005329e8
add esp, 0xc
push 0x1db
mov eax, dword [ebp - 0x18c]
push eax
call fcn.00532834
add esp, 8
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x5001a5
mov edx, dword [ebp - 0x214]
push edx
call fcn.00532628
pop ecx
jmp 0x5001ab
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x5001c4
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x190]
push eax
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x44]
cmp eax, dword [edx + 0x18]
jne 0x50023f
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ecx + 0x10]
xor ecx, ecx
mov esi, dword [eax + 0x18]
mov eax, dword [ebp - 0x28]
shr esi, 1
mov cl, byte [eax + 0x29]
mov eax, esi
div ecx
mov esi, eax
push esi
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.00499fb4
add esp, 8
test al, al
je 0x50023f
push esi
push str.NTFS_Check
push str._s:___Center_cluster__cluster_0x_lX__marked_used_but_is_not_in_any_file._n
call fcn.004adfc8
add esp, 0xc
push esi
mov eax, dword [ebp - 0x88]
push eax
call fcn.00499eb8
add esp, 8
push 0xffffffffffffffff
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
dec eax
push eax
push 0
mov edx, dword [ebp - 0x88]
push edx
call fcn.0049a300
add esp, 0x10
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x50047f
mov ecx, dword [ebp - 0x218]
push ecx
push str.NTFS_Lost_Clusters_Found:_Count___d_n
call fcn.004adfc8
add esp, 8
push 0
mov eax, dword [ebp - 0x88]
push eax
call fcn.0049a0bc
add esp, 8
mov dword [ebp - 0x21c], eax
jmp 0x50046a
mov edx, dword [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.0049a13c
mov esi, eax
mov eax, dword [ebp - 0x28]
add esp, 8
mov eax, dword [eax + 0x234]
cmp esi, eax
jbe 0x5002d0
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
mov esi, eax
dec esi
push esi
mov eax, dword [ebp - 0x21c]
push eax
push str.__NTFS_Lost_Cluster_Range:_Clusters__d_through__d_n
call fcn.004adfc8
add esp, 0xc
cmp dword [ebp - 0x180], 0
je 0x5002fc
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x50031d
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x50033f
cmp dword [ebp - 0x17c], 0
je 0x50033f
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x54
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x220], eax
test eax, eax
je 0x500385
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x500360
dec edx
push edx
push 0x60
push 0x649
push esi
mov ecx, dword [ebp - 0x21c]
push ecx
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x220]
push edx
call fcn.0050463c
add esp, 0x1c
jmp 0x50038b
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x5003a4
mov ebx, 3
jmp 0x500cf9
push esi
mov eax, dword [ebp - 0x21c]
push eax
mov edx, dword [ebp - 0x17c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x500401
push 0
push 0x60
push 0x7d5
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x50044b
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
test ebx, ebx
jne 0x500cf9
inc esi
push esi
mov eax, dword [ebp - 0x88]
push eax
call fcn.0049a0bc
add esp, 8
mov dword [ebp - 0x21c], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
cmp eax, dword [ebp - 0x21c]
ja 0x5002a0
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
mov esi, eax
jmp 0x50051d
push esi
mov eax, dword [ebp - 0x88]
push eax
call fcn.0049a038
add esp, 8
test al, al
je 0x50051c
mov dword [ebp - 0x134], esi
jmp 0x5004b1
inc dword [ebp - 0x134]
mov edx, dword [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0x88]
push ecx
call fcn.0049a038
add esp, 8
test al, al
je 0x5004d9
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x134]
ja 0x5004ab
push str.CLUST02
push 0x696df6
call fcn.004adfc8
add esp, 8
mov ecx, dword [0x6c5dd4]
push 0
mov edx, dword [ebp - 0x134]
dec edx
push edx
push esi
push 0x40
push 0x64a
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
test ebx, ebx
jne 0x500cf9
mov esi, dword [ebp - 0x134]
inc esi
mov eax, dword [ebp - 0xbc]
cmp esi, eax
jb 0x50048f
push 0x64
mov edx, dword [ebp - 0x190]
push edx
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push str.NTFS_Check
push 0x696e03
call fcn.004adfc8
add esp, 8
push str.NTFS_Check
push str._s:_Checking_index_structure..._n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532a74
pop ecx
push 3
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
xor edx, edx
mov dword [ebp - 0x190], edx
test ebx, ebx
jne 0x500cf9
push 0x64
push 0x14
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.005329e8
add esp, 0xc
push 0x1da
mov eax, dword [ebp - 0x18c]
push eax
call fcn.00532834
add esp, 8
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x224], eax
test eax, eax
je 0x5005e2
mov edx, dword [ebp - 0x224]
push edx
call fcn.00532628
pop ecx
jmp 0x5005e8
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x500601
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x190]
push eax
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
xor esi, esi
jmp 0x500ab6
push edi
mov eax, 0x104
cmp esi, 0xa
jbe 0x50062f
dec eax
push eax
push esi
mov edx, dword [ebp - 0x28]
push edx
call fcn.004ef984
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x500678
push esi
push str.INDEX01
push 0x696e31
call fcn.004adfc8
add esp, 0xc
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
jmp 0x500ab5
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x50068f
push 0x696e42
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x500694
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
cmp dword [ecx], 0x454c4946
jne 0x500a4b
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x5006b7
push 0x696e70
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x5006bc
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 1
je 0x500a4b
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x5006dd
push 0x696e9e
call fcn.004adfc8
pop ecx
xor ecx, ecx
jmp 0x5006e2
mov eax, dword [edi]
mov ecx, dword [eax + 0x34]
push ecx
call fcn.0050b920
pop ecx
test eax, eax
jne 0x500a4b
mov edx, dword [edi]
cmp dword [edx + 0x3c], 0
jne 0x500708
push 0x696ecc
call fcn.004adfc8
pop ecx
xor eax, eax
jmp 0x50070d
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test byte [eax + 0x16], 2
je 0x500a4b
cmp dword [ebp + 0x10], 2
jb 0x500725
lea edx, [ebp - 0x12c]
jmp 0x500727
xor edx, edx
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x178]
push ecx
mov eax, dword [ebp - 0x7c]
push eax
mov edx, dword [ebp - 0x80]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004fa2b8
add esp, 0x18
mov ebx, eax
cmp dword [ebp + 0x10], 2
jb 0x5007c7
cmp esi, 5
jne 0x50078b
sub dword [ebp - 0x12c], 0x300
cmp dword [ebp - 0x58], 0
je 0x50076d
add dword [ebp - 0x12c], 0x20
cmp dword [ebp + 0x10], 2
jne 0x500792
cmp dword [ebp - 0x12c], 0x4000
jae 0x500792
mov dword [ebp - 0x12c], 0x4000
jmp 0x500792
add dword [ebp - 0x12c], 0x40
mov eax, dword [ebp - 0x12c]
push eax
mov edx, dword [ebp - 0x28]
push edx
call fcn.004e93e8
add esp, 8
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
push ecx
push esi
call fcn.004fab90
add esp, 8
mov eax, dword [ebp - 0x12c]
add dword [ebp - 0x124], eax
test ebx, ebx
je 0x500a4b
push esi
push str.INDEX02
push str.__s__lu_
call fcn.004adfc8
add esp, 0xc
mov edx, ebx
sub edx, 0x644
jne 0x500950
cmp dword [ebp - 0x180], 0
je 0x500806
mov ecx, dword [ebp - 0x180]
push ecx
call fcn.004e598c
pop ecx
push 4
call fcn.004e5968
pop ecx
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jne 0x500827
mov ebx, 3
jmp 0x500cf9
cmp dword [ebp - 0x17c], 0
je 0x500849
cmp dword [ebp - 0x17c], 0
je 0x500849
push 3
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx]
add esp, 8
push 0x54
call fcn.0052e2b0
pop ecx
mov dword [ebp - 0x228], eax
test eax, eax
je 0x50088b
cmp dword [ebp - 0x15c], 1
mov edx, 1
je 0x50086a
dec edx
push edx
push 0x60
push ebx
mov ecx, dword [ebp - 0x178]
push ecx
push esi
mov eax, dword [ebp - 0x28]
push eax
mov edx, dword [ebp - 0x228]
push edx
call fcn.00504520
add esp, 0x1c
jmp 0x500891
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x5008aa
mov ebx, 3
jmp 0x500cf9
push 0x90
push esi
mov eax, dword [ebp - 0x17c]
push eax
mov edx, dword [eax]
call dword [edx + 0x10]
add esp, 0xc
test eax, eax
je 0x500902
push 0
push 0x60
push ebx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push 0
push 0x80
push 0x2e9
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
jmp 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, dword [0x6c5dd4]
push ecx
call fcn.00523a38
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x500a43
cmp dword [ebp - 0x180], 0
je 0x500cf9
mov eax, dword [ebp - 0x180]
push eax
call fcn.004e598c
pop ecx
xor edx, edx
mov dword [ebp - 0x180], edx
jmp 0x500cf9
mov dword [ebp - 0x13c], 0x60
xor ecx, ecx
mov dword [ebp - 0x174], ecx
cmp dword [ebp + 0x10], 2
jb 0x500998
cmp ebx, 0x690
jl 0x500998
cmp ebx, 0x6a4
jge 0x500998
mov eax, dword [ebx*4 + 0x693ecc]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x60
sete dl
and edx, 1
mov dword [ebp - 0x174], edx
cmp dword [ebp - 0x13c], 0x40
jne 0x5009f6
push 0
push 0x16d
mov ecx, dword [0x68bfe8]
push ecx
call fcn.004c6c0c
add esp, 8
push eax
push 0x400c
push ebx
call fcn.0050c094
pop ecx
push eax
mov eax, dword [0x68bfe8]
push eax
call fcn.004c6c0c
add esp, 8
mov edx, dword [0x67939c]
push eax
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
add esp, 0x14
cmp eax, 5
jne 0x5009f2
mov ebx, 7
jmp 0x500cf9
xor ebx, ebx
jmp 0x500a43
cmp ebx, 0x640
jl 0x500a21
cmp ebx, 0x6a4
jge 0x500a21
push 0
push 0x90
push esi
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523d64
add esp, 0x18
jmp 0x500a35
push 0
push 0x60
push ebx
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523bf8
add esp, 0x10
cmp dword [ebp - 0x174], 0
je 0x500a43
mov ebx, 7
test ebx, ebx
jne 0x500cf9
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9344
pop ecx
push eax
lea edx, [esi + 1]
push edx
mov ecx, dword [ebp - 0x190]
push ecx
call fcn.00532934
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push edi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004efbc0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x500ab5
push str.INDEX03
push 0x696f0b
call fcn.004adfc8
add esp, 8
push 0
push 0x60
push ebx
mov eax, dword [0x6c5dd4]
push eax
call fcn.00523bf8
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x500cf9
inc esi
mov edx, dword [ebp - 0x28]
push edx
call fcn.004e9344
pop ecx
cmp esi, eax
jb 0x500623
push str.NTFS_Check
push 0x696f18
call fcn.004adfc8
add esp, 8
mov ecx, dword [ebp - 0x190]
push ecx
call fcn.00532a74
pop ecx
push 3
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
xor edx, edx
mov dword [ebp - 0x190], edx
test ebx, ebx
jne 0x500cf9
push 0x64
push 0x63
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.005329e8
add esp, 0xc
push 0x142
mov eax, dword [ebp - 0x18c]
push eax
call fcn.00532834
add esp, 8
push 0x2a
call fcn.004e5968
pop ecx
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x500b52
mov edx, dword [ebp - 0x22c]
push edx
call fcn.00532628
pop ecx
jmp 0x500b58
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jne 0x500b71
mov ebx, 3
jmp 0x500cf9
push 0
mov eax, dword [ebp - 0x190]
push eax
call fcn.005328bc
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x500cf9
push str.NTFS_Check
push str._s:_Checking_for_orphan_FRSs..._n
call fcn.004adfc8
add esp, 8
mov esi, 0x10
jmp 0x500c34
push esi
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00499fb4
add esp, 8
test al, al
je 0x500c33
mov dword [ebp - 0x134], esi
jmp 0x500bc7
inc dword [ebp - 0x134]
mov edx, dword [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.00499fb4
add esp, 8
test al, al
je 0x500bf0
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9378
pop ecx
cmp eax, dword [ebp - 0x134]
ja 0x500bc1
push str.MFTMAP1
push 0x696f46
call fcn.004adfc8
add esp, 8
mov ecx, dword [0x6c5dd4]
push 0
mov edx, dword [ebp - 0x134]
dec edx
push edx
push esi
push 0x60
push 0x677
push ecx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
mov esi, dword [ebp - 0x134]
test ebx, ebx
jne 0x500cf9
inc esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004e9378
pop ecx
cmp esi, eax
jb 0x500ba8
mov edx, dword [ebp - 0x190]
push edx
call fcn.00532a74
pop ecx
push 3
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
xor edx, edx
mov dword [ebp - 0x190], edx
test ebx, ebx
jne 0x500cf9
cmp dword [ebp + 0x10], 2
jb 0x500ce7
mov ecx, dword [ebp - 0x108]
add ecx, 0x20
add dword [ebp - 0x124], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x234]
sub eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x124]
jae 0x500ce7
push str.FCVT801
push str.__s_
call fcn.004adfc8
add esp, 8
push 0
mov edx, dword [ebp - 0x124]
push edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x234]
sub eax, dword [ebp - 0xd0]
push eax
push 0x60
push 0x69b
mov edx, dword [0x6c5dd4]
push edx
call fcn.00523d64
add esp, 0x18
mov ebx, eax
jmp 0x500cf9
push str.NTFS_Check
push str._s:_...__OK_n
call fcn.004adfc8
add esp, 8
mov eax, dword [ebp - 0x8c]
push eax
call fcn.00613cc0
pop ecx
mov edx, dword [ebp - 0x5c]
push edx
call fcn.00613cc0
pop ecx
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00613cc0
pop ecx
mov eax, dword [ebp - 0x90]
push eax
call fcn.00613cc0
cmp dword [ebp - 0x190], 0
pop ecx
je 0x500d54
test ebx, ebx
jne 0x500d43
mov edx, dword [ebp - 0x190]
push edx
call fcn.00532a74
pop ecx
mov ebx, eax
push 3
mov eax, dword [ebp - 0x190]
push eax
call fcn.00532700
add esp, 8
cmp dword [ebp - 0x18c], 0
je 0x500d81
test ebx, ebx
jne 0x500d70
mov edx, dword [ebp - 0x18c]
push edx
call fcn.00532a74
pop ecx
mov ebx, eax
push 3
mov eax, dword [ebp - 0x18c]
push eax
call fcn.00532700
add esp, 8
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004efbc0
add esp, 8
test ebx, ebx
lea eax, [ebp - 0x34]
push eax
mov edx, dword [ebp - 0x28]
push edx
call fcn.004efbc0
add esp, 8
test ebx, ebx
push edi
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.004efbc0
add esp, 8
test ebx, ebx
push 3
mov eax, dword [ebp - 0x84]
push eax
call fcn.00499928
add esp, 8
push 3
mov edx, dword [ebp - 0x88]
push edx
call fcn.00499928
add esp, 8
push 3
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00499928
add esp, 8
push 3
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00499928
add esp, 8
mov edx, dword [ebp - 0x180]
push edx
call fcn.004e598c
cmp dword [ebp - 0x17c], 0
pop ecx
je 0x500e18
push 3
mov ecx, dword [ebp - 0x17c]
push ecx
mov eax, dword [ecx]
call dword [eax]
add esp, 8
test ebx, ebx
je 0x500e47
cmp ebx, 7
jne 0x500e35
mov edx, dword [0x6c5dd4]
add edx, 4
push edx
call fcn.0052e200
pop ecx
test eax, eax
je 0x500e47
cmp dword [ebp + 0x10], 2
je 0x500e47
mov ecx, dword [ebp + 8]
or dword [ecx + 8], 8
jmp 0x501039
cmp dword [ebp - 0x28], 0
je 0x50101d
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 0xd8]
call fcn.0061aea8
push edx
push eax
mov eax, dword [ebp - 0x104]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
mov ecx, dword [ebp + 0xc]
pop eax
pop edx
mov dword [ecx], eax
mov dword [ecx + 4], edx
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x104]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 0xdc]
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 0xe0]
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 0xd0]
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x228]
xor edx, edx
push edx
push eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x234]
sub eax, dword [ebp - 0xd0]
xor edx, edx
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 0xd4]
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [eax + 0x228]
push edx
push eax
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x234]
call fcn.0061aea8
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xd8]
mov dword [eax + 0x40], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xdc]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xe0]
mov dword [edx + 0x48], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x108]
mov dword [eax + 0x4c], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd0]
mov dword [ecx + 0x50], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
mov edx, dword [ebp + 0xc]
sub eax, dword [ebp - 0xd0]
mov dword [edx + 0x54], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd4]
mov dword [ecx + 0x58], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x234]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xe4]
mov dword [ecx + 0x60], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xe8]
mov dword [edx + 0x64], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xf0]
mov dword [eax + 0x6c], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xec]
mov dword [ecx + 0x68], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x100]
mov dword [edx + 0x70], ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov cl, byte [edx + 0x29]
mov eax, dword [eax + 0x234]
imul ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x267], eax
lea eax, [ebp - 0x28]
push eax
call fcn.004dec3c
pop ecx
mov eax, ebx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret