Function at 0x5cd0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3ac], esi
mov dword [ebp - 0x3a8], edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x10c], 0
lea ecx, [ebp - 0x94]
lea edx, [ebp - 0xac]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cefdb
mov byte [ebp - 8], 0
mov eax, dword [0x7cefc0]
call fcn.004157e0
lea ecx, [ebp - 0xbc]
lea edx, [ebp - 0xd4]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cefb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x70]
mov eax, dword [eax + 4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x70]
call fcn.0058b8e0
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0xa0]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x80]
mov dword [ebp - 0x80], edx
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x68]
cmp eax, 0x400
jae 0x5cd223
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe4], 0x400
mov dword [ebp - 0xe8], 0
lea eax, [ebp - 0x80]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], 0x11
lea eax, [ebp - 0xf0]
push eax
push 2
mov eax, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_bufSize___MinRecordSize___d____d___currOfs_d
mov edx, 2
call fcn.00579da0
jmp 0x5cefd6
lea ecx, [ebp - 0xe4]
lea edx, [ebp - 0x108]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5ceede
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
jmp 0x5ceed3
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10c]
call fcn.00404c10
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0xc]
mov cl, 1
mov edx, 3
call fcn.00408720
mov eax, dword [ebp - 0x10c]
mov edx, 0x773c2c
call fcn.00408880
test eax, eax
jne 0x5cedda
mov byte [ebp - 8], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x18], eax
and eax, 0x1ff
jne 0x5ced97
mov eax, dword [ebp - 0x18]
test eax, eax
jbe 0x5ced97
mov eax, dword [ebp - 0x18]
cmp eax, 0x10000
ja 0x5ced97
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov edx, 0
push edx
push eax
mov edx, dword [ebp - 0x68]
mov eax, 0
push eax
push edx
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xc]
call fcn.005dbf90
test al, al
je 0x5ced1e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xec], eax
mov byte [ebp - 0x3a4], 1
mov eax, dword [ebp - 0xec]
mov dx, word [eax + 4]
mov word [ebp - 0x124], dx
and edx, 0xffff
mov eax, 0
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x130]
lea edx, [ebp - 0x148]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd3a0
mov eax, dword [ebp - 0xec]
test eax, eax
jne 0x5cd37c
mov dword [ebp - 0x118], 0
jmp 0x5cd403
mov eax, dword [ebp - 0xec]
mov edx, 0
add eax, dword [ebp - 0x120]
adc edx, dword [ebp - 0x11c]
jae 0x5cd39a
call fcn.0040e9b0
mov dword [ebp - 0x118], eax
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd40b
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x154]
lea edx, [ebp - 0x16c]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd3de
mov dword [ebp - 0x118], 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd3f7
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cd40b
call fcn.0040d3b0
pop eax
jmp 0x5cd40b
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0x114], edx
mov edx, dword [ebp - 0x10]
shr edx, 9
inc edx
mov ecx, 0
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0xec]
mov cx, word [edx + 6]
mov word [ebp - 0x12c], cx
and ecx, 0xffff
mov edx, 0
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], edx
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
cmp edx, dword [ebp - 0x11c]
jl 0x5cd475
jg 0x5cd483
cmp ecx, dword [ebp - 0x120]
jae 0x5cd483
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x124]
jmp 0x5cd48f
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0xf0], edx
shl edx, 1
mov ecx, edx
sar ecx, 0x1f
push ecx
push edx
mov ecx, dword [ebp - 0x10]
mov edx, 0
push edx
push ecx
mov edx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x118]
mov eax, ecx
call fcn.005dbf90
test al, al
je 0x5cd76f
mov edx, dword [ebp - 0xf0]
test edx, edx
jle 0x5cd76f
mov edx, dword [ebp - 0xf0]
cmp edx, 0x10000
jg 0x5cd76f
mov edx, dword [ebp - 0xf0]
dec edx
mov ebx, edx
mov dword [ebp - 0x110], 1
cmp ebx, dword [ebp - 0x110]
jl 0x5cd76f
dec dword [ebp - 0x110]
inc dword [ebp - 0x110]
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x170]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd55f
mov edx, dword [ebp - 0x114]
test edx, edx
jne 0x5cd542
mov esi, 0
jmp 0x5cd5bd
mov ecx, dword [ebp - 0x114]
mov edx, 0
add ecx, 0x1fe
adc edx, 0
jae 0x5cd55d
call fcn.0040e9b0
mov esi, ecx
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd5c5
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x158]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd598
mov esi, 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd5b1
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cd5c5
call fcn.0040d3b0
pop eax
jmp 0x5cd5c5
mov edx, dword [ebp - 0x110]
shl edx, 1
mov ecx, edx
sar ecx, 0x1f
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], ecx
lea ecx, [ebp - 0x12c]
lea edx, [ebp - 0x170]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd632
mov edx, dword [ebp - 0x118]
test edx, edx
jne 0x5cd612
mov edi, 0
jmp 0x5cd690
mov edx, dword [ebp - 0x118]
mov ecx, 0
add edx, dword [ebp - 0x120]
adc ecx, dword [ebp - 0x11c]
jae 0x5cd630
call fcn.0040e9b0
mov edi, edx
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd698
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x13c]
lea edx, [ebp - 0x158]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd66b
mov edi, 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd684
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cd698
call fcn.0040d3b0
pop eax
jmp 0x5cd698
mov dx, word [edi]
mov word [esi], dx
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x170]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd6f8
mov edx, dword [ebp - 0x114]
test edx, edx
jne 0x5cd6d7
mov dword [ebp - 0x114], 0
jmp 0x5cd75b
mov ecx, dword [ebp - 0x114]
mov edx, 0
add ecx, 0x200
adc edx, 0
jae 0x5cd6f2
call fcn.0040e9b0
mov dword [ebp - 0x114], ecx
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd763
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x158]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cd736
mov dword [ebp - 0x114], 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cd74f
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cd763
call fcn.0040d3b0
pop eax
jmp 0x5cd763
cmp ebx, dword [ebp - 0x110]
jg 0x5cd508
lea ecx, [ebp - 0x118]
lea edx, [ebp - 0x130]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cecf7
push dword [ebp - 0x10]
mov edx, dword [ebp - 4]
push dword [edx + 0x58]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push 0xc
mov ecx, dword [ebp - 0xc]
mov edx, 0x778cdc
mov esi, 0
mov ebx, 0x778cdc
mov eax, esi
call dword [ebx + 0x6c]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x140]
lea edx, [ebp - 0x158]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cec29
lea edx, [ebp - 0x80]
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x190], 0x11
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x188], 0
mov edx, dword [ebp - 0x28]
mov eax, edx
call fcn.005e35c0
mov dl, al
and edx, 0xff
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x180], 0
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x178], 0xb
lea edx, [ebp - 0x190]
push edx
push 3
mov ebx, dword [ebp - 4]
mov ecx, str.ntfs_rec___d__recSize_d__isValid_d__name_s
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], 1
mov edx, dword [ebp - 0x28]
mov eax, edx
call fcn.005e35c0
test al, al
je 0x5cebc8
mov byte [ebp - 0x54], 1
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov edx, dword [ebp - 0x194]
mov eax, edx
call fcn.005dc1b0
test al, al
je 0x5ce4a1
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], 0
mov byte [ebp - 0x54], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
test edx, edx
jne 0x5cd9b3
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, 0x773c74
mov eax, ecx
call fcn.00408880
test eax, eax
jne 0x5cd9b3
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0x2c], edx
test edx, edx
je 0x5ce496
mov edx, dword [ebp - 0x2c]
mov eax, edx
call fcn.005e5720
test al, al
jne 0x5ce496
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x38]
mov ebx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.005e7dd0
test al, al
je 0x5ce496
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xffffffff
jg 0x5cd990
jl 0x5ce496
cmp edx, 0xffffffff
jbe 0x5ce496
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x80]
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x34], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x38]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x34]
mov dword [ecx + 0x3c], edx
jmp 0x5ce496
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
cmp edx, 1
ja 0x5cda7f
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, 0x773c84
mov eax, ecx
call fcn.00408880
test eax, eax
jne 0x5cda7f
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0x30], edx
test edx, edx
je 0x5ce496
mov edx, dword [ebp - 0x30]
mov eax, edx
call fcn.005e5720
test al, al
jne 0x5ce496
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x38]
mov ebx, dword [ebp - 0x30]
mov eax, ebx
call fcn.005e7dd0
test al, al
je 0x5ce496
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
cmp edx, 0xffffffff
jg 0x5cda5c
jl 0x5ce496
cmp ecx, 0xffffffff
jbe 0x5ce496
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x80]
mov dword [ecx + 0x40], edx
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x44], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x38]
mov dword [ecx + 0x48], edx
mov edx, dword [ebp - 0x34]
mov dword [ecx + 0x4c], edx
jmp 0x5ce496
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x28]
cmp edx, 5
ja 0x5ce496
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, 0x773c98
mov eax, ecx
call fcn.00408880
test eax, eax
jne 0x5ce496
mov byte [ebp - 0x54], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x80]
mov dword [ecx + 0x50], edx
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x54], edx
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x50], 0
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x34], 0
je 0x5cdfb5
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
push dword [edx + 0x11c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x48]
mov eax, edx
call fcn.005842f0
mov ecx, eax
mov edx, 0x771e3c
mov ebx, 0
mov eax, ebx
call fcn.005c6430
mov ecx, eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], ecx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x5c]
lea edx, [ebp - 0x294]
mov eax, ecx
call fcn.00405e50
lea edx, [ebp - 0x294]
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x190], 4
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x188], 0xb
lea edx, [ebp - 0x190]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_creating_volume_for_reconstruction__detectvol_ptr_s__name_s
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x34]
mov edx, dword [edx + 0x38]
mov dword [ebp - 0x70], edx
mov edx, dword [ebp - 0x28]
mov edx, dword [edx + 0x34]
mov edx, dword [edx + 0x34]
mov dword [ebp - 0x74], edx
test edx, edx
jne 0x5cdbba
mov dword [ebp - 0x74], 0x1000
mov edx, dword [ebp - 0x70]
test edx, edx
jne 0x5cdbc8
mov dword [ebp - 0x70], 1
mov eax, dword [ebp - 0x74]
mov edx, 0
div dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x78]
cmp edx, 0x200
jb 0x5cdc25
sub edx, 0x200
je 0x5cdc21
sub edx, 0x200
je 0x5cdc21
sub edx, 0x400
je 0x5cdc21
sub edx, 0x800
je 0x5cdc21
sub edx, 0x1000
je 0x5cdc21
sub edx, 0x2000
je 0x5cdc21
sub edx, 0x4000
je 0x5cdc21
sub edx, 0x8000
jne 0x5cdc25
mov dl, 1
jmp 0x5cdc27
mov dl, 0
test dl, dl
jne 0x5cdc36
mov dword [ebp - 0x78], 0x10000
mov byte [ebp - 0x50], 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], 0xb
lea edx, [ebp - 0x164]
push edx
push 0
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_trying_to_find_a_valid_parameter_combination_for_volume__s...
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x48]
mov eax, edx
call fcn.005842f0
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebx]
mov eax, ecx
call dword [edx + 0x64]
mov ecx, eax
push edx
push ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ebx, dword [edx + 0x84]
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x74]
mov eax, ebx
call fcn.005d3810
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x84]
mov edx, dword [edx + 0x21c]
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 0x5c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x5c]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0x64]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ebx, dword [edx + 0x84]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x38]
mov dword [ebx + 0x238], ecx
mov edx, dword [edx + 0x3c]
mov dword [ebx + 0x23c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x48]
mov dword [ebx + 0x240], edx
mov edx, dword [ecx + 0x4c]
mov dword [ebx + 0x244], edx
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x30]
mov edx, dword [edx + 0x34]
test edx, edx
ja 0x5cdd12
jb 0x5cdd74
test ecx, ecx
jbe 0x5cdd74
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x38]
mov edx, dword [edx + 0x3c]
test edx, edx
ja 0x5cdd25
jb 0x5cdd74
test ecx, ecx
jbe 0x5cdd74
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
push dword [edx + 0x3c]
push dword [edx + 0x38]
mov edx, dword [ebp - 0x78]
mov ecx, 0
push ecx
push edx
mov edx, 0
mov eax, edx
call fcn.00407f10
mov esi, eax
mov ecx, dword [ebx + 0x30]
sub ecx, esi
mov esi, ecx
mov ecx, dword [ebx + 0x34]
sbb ecx, edx
mov edx, ecx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x44]
or ecx, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov dword [edx + 0x44], ecx
jmp 0x5cdd97
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x44]
and ecx, 0xfffffffe
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
test edx, edx
jg 0x5cddaf
jl 0x5cdf8d
test ecx, ecx
jb 0x5cdf8d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x48]
mov eax, edx
call fcn.005842f0
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebx]
mov eax, ecx
call dword [edx + 0x64]
mov ecx, eax
cmp edx, dword [ebp - 0x3c]
jg 0x5cdde0
jl 0x5cdf8d
cmp ecx, dword [ebp - 0x40]
jbe 0x5cdf8d
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov eax, edx
call fcn.00580970
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x5c]
mov dl, 1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x5c]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0x78]
mov byte [ebp - 0x4c], al
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
test edx, edx
jne 0x5cdeca
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
push edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x28]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x28]
mov edx, dword [edx]
mov eax, ecx
call dword [edx + 0x70]
mov edx, eax
mov ecx, 0
push ecx
push edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
push dword [edx + 0x24]
push dword [edx + 0x20]
call fcn.00407fd0
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
lea edx, [ebp - 0x188]
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x190], 0x10
lea edx, [ebp - 0x190]
mov ecx, 0
mov ebx, str.NTFS_BS_rebuilt_at_block__d
mov eax, ebx
call fcn.0041b420
mov eax, dword [ebp - 0x194]
call fcn.00408320
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x5c]
lea edx, [ebx + 0x2c]
mov eax, edx
call fcn.00404c10
mov edx, dword [ebp - 0x194]
mov dword [ebx + 0x2c], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x1c0], edx
mov dword [ebp - 0x1c4], 0xb
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x5c]
lea edx, [ebp - 0x394]
mov eax, ecx
call fcn.00405e50
lea edx, [ebp - 0x394]
mov dword [ebp - 0x1b8], edx
mov dword [ebp - 0x1bc], 4
lea edx, [ebp - 0x40]
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x1b4], 0x10
mov edx, dword [ebp - 4]
add edx, 0x38
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 0x1ac], 0x11
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 0x1a4], 0
movzx edx, byte [ebp - 0x4c]
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x19c], 0
lea edx, [ebp - 0x1c4]
push edx
push 5
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_volname_s__ptr_s__diskOfs_d__MFTClus_d__calcBytesPerClus_d__mount_result_d__1success_
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov dl, byte [ebp - 0x4c]
test dl, dl
jne 0x5cdf8d
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov eax, edx
call fcn.005c73f0
mov dl, byte [ebp - 0x50]
test dl, dl
jne 0x5cdf9d
mov dword [ebp - 0x78], 0x10000
jmp 0x5cdfa0
shr dword [ebp - 0x78], 1
mov byte [ebp - 0x50], 1
cmp byte [ebp - 0x4c], 0
jne 0x5cdfb5
mov edx, dword [ebp - 0x78]
test edx, edx
jne 0x5cdc6c
mov byte [ebp - 0x5c], 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x44]
or ecx, 0x10
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov dword [edx + 0x44], ecx
cmp byte [ebp - 0x4c], 0
je 0x5ce1f3
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
add edx, 0x20
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x3a0], 0x10
lea edx, [ebp - 0x3a0]
push edx
push 0
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_successfull_mounted_at_diskOffset_d_with_these_parameters:
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x84]
mov eax, edx
call fcn.005d39b0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x5c]
test edx, edx
jbe 0x5ce093
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ebx, dword [edx + 0x84]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x5c]
shl edx, 3
mov eax, dword [ebx + 0x21c]
mul edx
mov edx, eax
mov ecx, 0
mov dword [ebx + 0x228], edx
mov dword [ebx + 0x22c], ecx
lea edx, [ebx + 0x228]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1a0]
push edx
push 0
mov esi, ebx
mov ecx, str.DetectAndSaveFileRecords:_reconstructed_volume_size_d_bytes
mov edx, 4
mov eax, esi
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x84]
add edx, 0x228
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b8], 0x10
mov edx, dword [ebp - 4]
add edx, 0x68
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1b0], 0x11
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x5c]
shl edx, 3
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x84]
add edx, 0x230
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1b8]
push edx
push 3
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_other_params:_totalBytes_d__sectorBitmapSize_d__clusBitmapSize8_d__countOfClusters_d
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x14]
mov ecx, dword [edx + 0x44]
or ecx, 2
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x14]
mov dword [edx + 0x44], ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov eax, edx
call fcn.005c74d0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ebx, dword [edx + 0x14]
mov edx, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x5c]
mov ecx, dword [ecx + 0x14]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0xa8]
test al, al
je 0x5ce1a2
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x14]
mov dl, 1
mov eax, ecx
call fcn.0057e4f0
mov edx, eax
test edx, edx
jbe 0x5ce1a2
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x44]
and ecx, 0xffffffef
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov dword [edx + 0x44], ecx
jmp 0x5ce207
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0xb
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
add edx, 0x20
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_volume___s__diskofs_d_has_empty_root
mov edx, 4
mov eax, ebx
call fcn.00579da0
jmp 0x5ce207
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_no_valid_mount_parameter_combination_detected
mov edx, 2
mov eax, ebx
call fcn.00579e90
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp - 4]
mov eax, ebx
call fcn.005cf030
test al, al
je 0x5ce2de
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x70]
mov edx, dword [ebp - 0x24]
mov eax, ecx
call fcn.005d3e20
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0xb
mov edx, dword [ebp - 0x88]
add edx, 0x20
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_same_volume___s__at_diskOfs_d_already_exists_in_list.
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x44]
and edx, 0x10
jne 0x5ce2da
mov edx, dword [ebp - 0x88]
mov edx, dword [edx + 0x44]
and edx, 0x10
jbe 0x5ce2da
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_same_volume_contains_no_root._Replacing_with_detectVol.
mov edx, 4
mov eax, ebx
call fcn.00579e90
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x70]
mov edx, dword [ebp - 0x24]
mov eax, ecx
call fcn.005d3d20
mov edx, dword [ebp - 0x88]
mov eax, edx
call fcn.0040c5c0
mov byte [ebp - 0x5c], 1
jmp 0x5ce2de
mov byte [ebp - 0x5c], 0
cmp byte [ebp - 0x5c], 0
je 0x5ce42a
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x44]
and edx, 0x10
jne 0x5ce3c6
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0xb
lea edx, [ebp - 0x1a0]
push edx
push 0
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_adding_volume___s___rebuilt_from_sysfilelist__to_reconstructedVolumes_list
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [edx + 0x44]
or ecx, 0x200a0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov dword [edx + 0x44], ecx
mov edx, dword [ebp - 4]
add edx, 0x84
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x5c]
mov eax, ecx
call fcn.005c7dd0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x5ce380
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x5c]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0xc]
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov esi, dword [esi + 8]
mov eax, ebx
call esi
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x70]
mov eax, ecx
call fcn.005d3c10
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x5c]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x10]
mov edx, 4
mov eax, ebx
call fcn.0059d530
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x54]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov eax, ecx
call fcn.0059d920
jmp 0x5ce48f
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0xb
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
add edx, 0x20
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_adding_volume_with_empty_root___s__diskofs_d_to_reconstructedVolumes
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x70]
mov eax, ecx
call fcn.005d3c10
jmp 0x5ce48f
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
je 0x5ce48f
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
mov edx, dword [edx + 0x2c]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0xb
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x5c]
add edx, 0x20
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_detectVol_contains_less_information_than_sameVol._Freeing_detectVol_name_s__ofs_d.
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
add edx, 0x5c
mov eax, edx
call fcn.004209a0
mov edx, dword [ebp - 4]
mov byte [edx + 0x24], 1
mov edx, dword [ebp - 4]
inc dword [edx + 0x28]
jmp 0x5ce560
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, str.System_Volume_Information
mov eax, ecx
call fcn.00408880
test eax, eax
je 0x5ce55c
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, str.MountPointManagerRemoteDatabase
mov eax, ecx
call fcn.00408880
test eax, eax
je 0x5ce55c
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, str.tracking.log
mov eax, ecx
call fcn.00408880
test eax, eax
jne 0x5ce560
mov byte [ebp - 0x54], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0xe8]
mov edx, dword [edx + 0xec]
and ecx, 0x100000
mov edx, 0
test edx, edx
jne 0x5ce585
test ecx, ecx
je 0x5ce59e
mov edx, dword [ebp - 0x28]
mov eax, edx
call fcn.005e1ee0
mov ecx, eax
test edx, edx
jne 0x5ce59a
cmp ecx, 5
je 0x5ce59e
mov byte [ebp - 0x54], 0
cmp byte [ebp - 0x54], 0
je 0x5cebc8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0xe8]
mov edx, dword [edx + 0xec]
and ecx, 1
mov edx, 0
test edx, edx
jne 0x5cebc8
test ecx, ecx
jne 0x5cebc8
push dword [ebp - 0x10]
mov edx, dword [ebp - 4]
push dword [edx + 0x58]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push 0xd
mov ecx, dword [ebp - 0xc]
mov edx, 0x779328
mov esi, 0
mov ebx, 0x779328
mov eax, esi
call dword [ebx + 0x6c]
mov dword [ebp - 0x84], eax
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x84]
mov eax, ecx
call fcn.005e1fc0
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1c0], 0xb
mov edx, dword [ebp - 0x84]
add edx, 0x18
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b8], 0x11
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], edx
lea edx, [ebp - 0x1c8]
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1b0], 0x11
mov edx, dword [ebp - 0x84]
add edx, 0x20
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0x10
lea edx, [ebp - 0x80]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x11
lea edx, [ebp - 0x1c0]
push edx
push 4
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_examining_rec__s__MFTNo_d__ParentMFTNo_d__MFTofs_d__diskOfs_d
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e35c0
test al, al
je 0x5ceba7
mov edx, dword [ebp - 0x84]
mov dx, word [edx + 0x10]
or dx, 0x80
mov ecx, dword [ebp - 0x84]
mov word [ecx + 0x10], dx
mov edx, dword [ebp - 0x84]
cmp dword [edx + 0x44], 0
je 0x5ce762
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x44]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
test edx, edx
ja 0x5ce72c
jb 0x5cebc8
test ecx, ecx
jbe 0x5cebc8
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x44]
push dword [edx + 0xc]
push dword [edx + 8]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x80]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x80]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0x84]
jmp 0x5cebc8
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov ecx, eax
test edx, edx
ja 0x5ce783
jb 0x5ceb4c
test ecx, ecx
jbe 0x5ceb4c
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x84]
mov eax, ecx
call fcn.005e1fc0
mov ecx, dword [ebp - 0x194]
mov edx, 0x773c98
mov eax, ecx
call fcn.00408880
test eax, eax
jne 0x5ce7d7
mov edx, dword [ebp - 0x84]
mov dword [edx + 0x18], 5
mov dword [edx + 0x1c], 0
mov edx, dword [ebp - 0x84]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
test edx, edx
jne 0x5ce875
test ecx, ecx
jne 0x5ce875
mov edx, dword [ebp - 0x84]
cmp dword [edx + 0x34], 0
je 0x5ce875
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x34]
mov eax, edx
call fcn.005e95d0
test al, al
je 0x5ce875
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x34]
mov eax, edx
call fcn.005e9e10
test al, al
jne 0x5ce875
mov ebx, dword [ebp - 4]
mov ecx, str.rec.ReInitAllNonResidentAttr
mov edx, 5
mov eax, ebx
call fcn.00579e90
mov ecx, dword [ebp - 0x84]
mov edx, 0
mov eax, ecx
call fcn.005e24c0
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x34]
cmp dword [edx + 0x28], 0
je 0x5ce875
mov edx, dword [ebp - 0x84]
mov edx, dword [edx + 0x34]
mov ecx, dword [edx + 0x28]
mov dl, 1
mov eax, ecx
call fcn.005e5680
cmp byte [ebp - 0x54], 0
je 0x5cea7c
mov edx, dword [ebp - 0x84]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
test edx, edx
ja 0x5ce895
jb 0x5ce8bd
test ecx, ecx
jbe 0x5ce8bd
mov edx, dword [ebp - 0x84]
push dword [edx + 0x1c]
push dword [edx + 0x18]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x7c]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0x84]
mov edx, dword [ebp - 0x84]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
test edx, edx
jne 0x5ce8d2
cmp ecx, 5
je 0x5ce8ff
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov ecx, eax
push edx
push ecx
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x78]
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x78]
mov ecx, dword [ecx]
mov eax, ebx
call dword [ecx + 0x84]
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x84]
mov eax, ecx
call fcn.005e1fc0
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 0x1c0], 0xb
mov edx, dword [ebp - 0x84]
add edx, 0x18
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b8], 0x11
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], edx
lea edx, [ebp - 0x1c8]
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1b0], 0x11
mov edx, dword [ebp - 0x84]
add edx, 0x20
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0x10
lea edx, [ebp - 0x80]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x11
lea edx, [ebp - 0x1c0]
push edx
push 4
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_rec_added_to_pool:__s__MFTNo_d__ParentMFTNo_d__MFTofs_d__diskOfs_d
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x78]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x1c]
and ecx, 0xfff
mov edx, 0
test edx, edx
jne 0x5cea51
test ecx, ecx
jne 0x5cea51
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x78]
add edx, 0x18
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1b0], 0x10
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x7c]
add edx, 0x18
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0x10
lea edx, [ebp - 0x80]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x11
lea edx, [ebp - 0x1b0]
push edx
push 2
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_recordPoolPMFTNo.count_d__recordPoolSMFTNo.count_d__currOfs_d
mov edx, 4
mov eax, ebx
call fcn.00579da0
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x5cebc8
mov edx, dword [ebp - 4]
mov esi, dword [edx + 0xc]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx + 8]
mov eax, esi
call ebx
jmp 0x5cebc8
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x194]
mov ecx, dword [ebp - 0x84]
mov eax, ecx
call fcn.005e1fc0
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b8], 0xb
mov edx, dword [ebp - 0x84]
add edx, 0x18
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1b0], 0x11
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], edx
lea edx, [ebp - 0x1c0]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0x11
mov edx, dword [ebp - 0x84]
add edx, 0x20
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x10
lea edx, [ebp - 0x1b8]
push edx
push 3
mov ebx, dword [ebp - 4]
mov ecx, str.__s___MFTNo_d__parentMFTNo_d____d_tagged_as_part_of_a_valid_volume
mov edx, 5
mov eax, ebx
call fcn.00579da0
lea edx, [ebp - 0x84]
mov eax, edx
call fcn.004209a0
jmp 0x5cebc8
mov edx, dword [ebp - 0x84]
mov eax, edx
call fcn.005e1ee0
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1a4], edx
lea edx, [ebp - 0x1a8]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x11
lea edx, [ebp - 0x1a0]
push edx
push 0
mov ebx, dword [ebp - 4]
mov ecx, str.record_has_invalid_ParentMFTNo_d
mov edx, 5
mov eax, ebx
call fcn.00579da0
lea edx, [ebp - 0x84]
mov eax, edx
call fcn.004209a0
jmp 0x5cebc8
mov ebx, dword [ebp - 4]
mov ecx, str.record_validation_failed
mov edx, 5
mov eax, ebx
call fcn.00579e90
lea edx, [ebp - 0x84]
mov eax, edx
call fcn.004209a0
mov edx, dword [ebp - 4]
cmp byte [edx + 0x24], 0
je 0x5cec29
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], 0
mov dword [edx + 0x4c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cecf7
mov eax, 0x6dc92c
call fcn.0040d580
test eax, eax
je 0x5cecf2
mov dword [ebp - 0x19c], eax
lea ecx, [ebp - 0x1a8]
lea edx, [ebp - 0x1c0]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5ceccd
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx + 4]
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x3a0], 0xb
call fcn.00421c70
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x398], 5
lea edx, [ebp - 0x80]
mov dword [ebp - 0x38c], edx
mov dword [ebp - 0x390], 0x11
lea edx, [ebp - 0x3a0]
push edx
push 2
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_EXCEPTION_occured:__s_at_address:__p__currOfs_d
mov edx, 2
mov eax, ebx
call fcn.00579da0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cece6
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cecf7
call fcn.0040d520
call fcn.0040d3b0
cmp dword [ebp - 0x28], 0
je 0x5ced0c
lea edx, [ebp - 0x28]
mov eax, edx
call fcn.004209a0
pop eax
test eax, eax
je 0x5ced19
dec eax
test eax, eax
call fcn.0040d520
jmp 0x5cedda
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ebx, edx
mov esi, 0
mov edx, dword [ebp - 0x60]
mov ecx, 0
sub ebx, edx
sbb esi, ecx
mov ecx, dword [ebp - 0x68]
mov edx, 0
sub ebx, ecx
sbb esi, edx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], esi
lea edx, [ebp - 0x1b0]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_PCheck_error:_afilerecordSize_exceeds_bufbufsize_by__d_bytes__increase_PreferredBlockSize__recordSize_d
mov edx, 2
mov eax, ebx
call fcn.00579da0
jmp 0x5cedda
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], 0
lea edx, [ebp - 0x80]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x1a0], 0x11
lea edx, [ebp - 0x1a8]
push edx
push 1
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_readRecordSize_d___d_is_invalid._Skipping_rec.
mov edx, 5
mov eax, ebx
call fcn.00579da0
mov ecx, dword [ebp - 0x10]
mov edx, 0
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], edx
lea ecx, [ebp - 0x1ac]
lea edx, [ebp - 0x3a0]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cee3c
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x5cee1f
mov ebx, 0
jmp 0x5cee9a
mov ecx, dword [ebp - 0xc]
mov edx, 0
add ecx, dword [ebp - 0x1a0]
adc edx, dword [ebp - 0x19c]
jae 0x5cee3a
call fcn.0040e9b0
mov ebx, ecx
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5ceea2
mov eax, 0xffffffff
call fcn.0040d580
lea ecx, [ebp - 0x1bc]
lea edx, [ebp - 0x388]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cee75
mov ebx, 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cee8e
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5ceea2
call fcn.0040d3b0
pop eax
jmp 0x5ceea2
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x60]
sub ecx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
sub ecx, edx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov esi, 0
mov ecx, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
add ecx, edx
adc ebx, esi
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ebx
mov edx, dword [ebp - 0x1c]
test edx, edx
jg 0x5cd260
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cefb0
mov eax, 0x6dc92c
call fcn.0040d580
test eax, eax
je 0x5cefab
mov dword [ebp - 0x19c], eax
lea ecx, [ebp - 0x1a8]
lea edx, [ebp - 0x1c0]
mov eax, 1
call fcn.0040d0e0
call fcn.0040f290
push eax
test eax, eax
jne 0x5cef86
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx + 4]
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x3a0], 0xb
call fcn.00421c70
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x398], 5
lea edx, [ebp - 0x80]
mov dword [ebp - 0x38c], edx
mov dword [ebp - 0x390], 0x11
lea edx, [ebp - 0x3a0]
push edx
push 2
mov ebx, dword [ebp - 4]
mov ecx, str.DetectAndSaveFileRecords:_EXCEPTION_2_occured:__s_at_address:__p__currOfs_d
mov edx, 2
mov eax, ebx
call fcn.00579da0
mov byte [ebp - 8], 0
call fcn.0040d3b0
pop eax
test eax, eax
je 0x5cef9f
call fcn.0040d490
call fcn.0040d5e0
call fcn.0040d520
call fcn.0040d3f0
call fcn.0040d5e0
jmp 0x5cefb0
call fcn.0040d520
call fcn.0040d3b0
mov edx, dword [0x7cefc0]
mov eax, edx
call fcn.004157f0
pop eax
test eax, eax
je 0x5cefdb
sub eax, 1
je 0x5cefd1
sub eax, 1
je 0x5cefdb
call fcn.0040d520
pop eax
push 2
jmp 0x5cefb0
call fcn.0040d3b0
lea edx, [ebp - 0x194]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x194], 0
lea edx, [ebp - 0x10c]
mov eax, edx
call fcn.00404c10
mov dword [ebp - 0x10c], 0
pop eax
test eax, eax
je 0x5cf018
call fcn.0040d520
mov al, byte [ebp - 8]
mov ebx, dword [ebp - 0x3b0]
mov esi, dword [ebp - 0x3ac]
mov edi, dword [ebp - 0x3a8]
leave
ret