Function at 0x1003e610
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100628cd
mov eax, dword fs:[0]
push eax
mov eax, 0xca2c
call sub.ntdll.dll__chkstk
mov eax, dword [0x100dd9d4]
xor eax, esp
mov dword [esp + 0xca28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100dd9d4]
xor eax, esp
push eax
lea eax, [esp + 0xca40]
mov dword fs:[0], eax
mov esi, dword [esp + 0xca50]
xor ebp, ebp
push 0x7fe
lea eax, [esp + 0x4242]
mov edi, ecx
push ebp
push eax
mov dword [esp + 0x80], edi
mov dword [esp + 0x88], esi
mov word [esp + 0x4248], bp
call sub.ntdll.dll_memset
lea ecx, [edi + 0x2a]
push ecx
lea edx, [esp + 0x424c]
push str.The__s_has_too_much_file_fragment__please_defragment_at_first_or_reserve_free_space_of_2GB_or_more_for_the_partition__and_retry_
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x18
mov dword [esp + 0x78], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0xca48], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [esp + 0x98], eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
call fcn.1002eb20
test eax, eax
jbe 0x1003f276
jmp 0x1003e6e0
cmp dword [edi + 0x134], ebp
je 0x1003e7f5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x98]
cmp eax, 0x3e8
jb 0x1003e7f5
mov ecx, dword [esp + 0x7c]
call fcn.1002eb20
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x50]
add esi, 1
adc ebx, 0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe8], ebx
fild qword [esp + 0xe4]
mov dword [esp + 0xa0], 0
fild qword [esp + 0x9c]
fdivp st(1)
fmul qword [0x10064600]
call fcn.100594f0
push 0xc6
mov ebp, eax
lea eax, [esp + 0x417a]
push 0
push eax
mov word [esp + 0x4180], 0
call sub.ntdll.dll_memset
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0xa8]
push ebp
push ecx
push edx
push ebx
push esi
mov esi, dword [sym.imp.MSVCR80.dll__swprintf]
lea eax, [esp + 0x4194]
push str.Analyzing_partition:__I64d__I64d___d__.
push eax
call esi
mov ecx, dword [edi + 0x130]
mov edx, dword [ecx]
mov edx, dword [edx + 0x38]
add esp, 0x28
lea eax, [esp + 0x4174]
push eax
call edx
push ebp
lea eax, [esp + 0x4178]
push str.Status:_d
push eax
call esi
add esp, 0xc
push ebp
mov ecx, edi
call fcn.100391d0
mov ecx, dword [edi + 0x130]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
lea eax, [esp + 0x4174]
push eax
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x98], eax
xor ebp, ebp
mov ecx, dword [edi + 0x130]
mov eax, dword [ecx]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
jne 0x1003f302
mov esi, dword [esp + 0x7c]
mov ecx, dword [esi + 4]
cmp ecx, ebp
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x80], ebp
je 0x1003e82c
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 3
cmp ebx, eax
jb 0x1003e832
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 4]
mov esi, dword [eax + ebx*8]
cmp esi, 7
mov ebx, dword [eax + ebx*8 + 4]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
jne 0x1003e851
cmp ebx, ebp
je 0x1003f248
cmp esi, 1
jne 0x1003e866
cmp ebx, ebp
je 0x1003f248
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x130]
call fcn.1002edf0
push ebp
lea eax, [esp + 0x120]
push eax
push ebx
push esi
lea ecx, [edi + 0x1e0]
mov byte [esp + 0xca58], 1
call fcn.100329c0
test eax, eax
je 0x1003f36d
push 0x3fff
lea ecx, [esp + 0x4a41]
push ebp
push ecx
mov byte [esp + 0x4a48], 0
call sub.ntdll.dll_memset
push 0x3fff
lea edx, [esp + 0x8a4d]
push ebp
push edx
mov byte [esp + 0x8a54], 0
call sub.ntdll.dll_memset
mov eax, dword [edi + 0x42ac]
add esp, 0x18
push eax
lea ecx, [esp + 0x120]
call fcn.1002ea60
push eax
lea ecx, [esp + 0x4a44]
push ecx
call sub.ntdll.dll_memcpy
mov edx, dword [edi + 0x42ac]
push edx
lea eax, [esp + 0x4a4c]
push eax
lea ecx, [esp + 0x8a50]
push ecx
call sub.ntdll.dll_memcpy
movzx esi, word [esp + 0x4a68]
push esi
lea edx, [esp + 0x4a58]
push edx
lea eax, [esp + 0x8a5c]
push eax
mov dword [esp + 0x6c], esi
call sub.ntdll.dll_memcpy
add esp, 0x24
mov dword [esp + 0x8a54], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
lea ecx, [esp + 0x11c]
mov byte [esp + 0xca48], 2
mov dword [esp + 0x94], ebp
call fcn.1002ea30
lea ecx, [esp + 0x11c]
call fcn.1002fa70
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x30], ebx
je 0x1003ef6c
cmp byte [ebx + 8], 0
jne 0x1003e9c2
mov ecx, dword [ebx + 4]
push ecx
lea eax, [esp + esi + 0x8a40]
push ebx
push eax
call sub.ntdll.dll_memcpy
mov ebx, dword [ebx + 4]
add dword [esp + 0x8a60], ebx
add esi, ebx
add esp, 0xc
lea ecx, [esp + 0x11c]
mov dword [esp + 0x48], esi
call fcn.1002f6d0
mov ebx, eax
mov dword [esp + 0x30], ebx
jmp 0x1003ef5b
lea ecx, [esp + 0xac]
call fcn.100306a0
push ebx
lea ecx, [esp + 0xb0]
mov byte [esp + 0xca4c], 3
call fcn.10030760
test eax, eax
je 0x1003f3db
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
lea ecx, [esp + 0xac]
mov byte [esp + 0xca48], 4
mov dword [esp + 0x90], ebp
call fcn.10030d80
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x84], ecx
jbe 0x1003edcf
jmp 0x1003ea30
push ecx
lea ecx, [esp + 0xb0]
call fcn.100305b0
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov esi, edx
and esi, ecx
cmp esi, 0xffffffff
jne 0x1003ea7b
mov edx, dword [eax + 0x10]
or ecx, esi
lea eax, [esp + 0x10c]
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], ecx
push eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x118], edx
call fcn.1003bda0
jmp 0x1003edb0
mov edi, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov ebp, dword [esp + 0x74]
mov ebx, dword [ebp + 0x1d8]
mov ebp, dword [ebp + 0x1dc]
mov dword [esp + 0xa4], edi
add edi, edx
mov dword [esp + 0xa8], esi
adc esi, ecx
cmp esi, ebp
jl 0x1003ed7d
jg 0x1003eab5
cmp edi, ebx
jbe 0x1003ed7d
cmp ecx, ebp
mov esi, 1
mov dword [esp + 0x90], esi
mov dword [esp + 0x80], esi
jl 0x1003eaf0
jg 0x1003ead2
cmp edx, ebx
jb 0x1003eaf0
mov esi, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], ecx
jmp 0x1003eb37
mov esi, edx
mov edi, ecx
sub esi, ebx
sbb edi, ebp
add esi, dword [eax + 0x10]
mov dword [esp + 0x100], ecx
mov ecx, dword [eax + 0x10]
adc edi, dword [eax + 0x14]
sub ecx, esi
mov dword [esp + 0xfc], edx
lea edx, [esp + 0xfc]
mov dword [esp + 0x104], ecx
push edx
lea ecx, [esp + 0x58]
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebp
call fcn.1003bda0
xor ebp, ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], ebp
cmp dword [esp + 0x78], ebp
mov byte [esp + 0xca48], 5
jne 0x1003ec22
mov ebx, dword [esp + 0x74]
push ebp
lea eax, [esp + 0x68]
push eax
push edi
push esi
lea ecx, [ebx + 0x140]
call fcn.10057690
test eax, eax
jne 0x1003ec6c
mov ecx, dword [ebx + 0x130]
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
lea edx, [esp + 0x423c]
push edx
call eax
call fcn.10059c60
mov edi, eax
mov esi, dword [edi]
push 0x44f
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
mov ecx, dword [esi]
push eax
push str._s:_Too_much_file_fragment__please_defragment.
push edi
call ecx
mov ecx, dword [ebx + 0x130]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 0x10
push 0xd7
call eax
mov eax, dword [esp + 0x68]
cmp eax, ebp
je 0x1003ebd7
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x58]
cmp eax, ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebp
je 0x1003ebf4
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0xac]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
mov byte [esp + 0xca48], 2
call fcn.100309d0
lea ecx, [esp + 0x14]
call fcn.1003e200
jmp 0x1003f3b7
mov ecx, dword [esp + 0x58]
cmp ecx, ebp
je 0x1003ec4c
mov eax, dword [esp + 0x5c]
sub eax, ecx
sar eax, 4
je 0x1003ec4c
add eax, 0xffffffff
push eax
lea ecx, [esp + 0x58]
call fcn.10039570
push eax
lea ecx, [esp + 0x68]
call fcn.1003bda0
mov ebx, dword [esp + 0x74]
push 1
lea ecx, [esp + 0x68]
push ecx
push edi
push esi
lea ecx, [ebx + 0x140]
call fcn.10057690
test eax, eax
je 0x1003f4be
lea ecx, [esp + 0x64]
xor ebx, ebx
call fcn.1005c7d0
test eax, eax
jbe 0x1003ecc4
mov dword [esp + 0x44], ebp
nop
mov ecx, dword [esp + 0x68]
cmp ecx, ebp
je 0x1003ec95
mov eax, dword [esp + 0x6c]
sub eax, ecx
sar eax, 4
cmp ebx, eax
jb 0x1003ec9f
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x44]
add ecx, edx
push ecx
lea ecx, [esp + 0x58]
call fcn.1003bda0
add dword [esp + 0x44], 0x10
lea ecx, [esp + 0x64]
add ebx, 1
call fcn.1005c7d0
cmp ebx, eax
jb 0x1003ec80
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xe0], ebp
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x64]
mov dword [esp + 0xc8], ecx
push edx
lea ecx, [esp + 0xd8]
mov byte [esp + 0xca4c], 6
mov dword [esp + 0xc8], eax
mov dword [esp + 0xd0], esi
mov dword [esp + 0xd4], edi
call fcn.1003bc60
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x18]
call fcn.1003e580
mov eax, dword [esp + 0xd8]
cmp eax, ebp
je 0x1003ed41
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x68]
cmp eax, ebp
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xe0], ebp
mov byte [esp + 0xca48], 4
je 0x1003ed6f
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], ebp
jmp 0x1003eda6
mov dword [esp + 0xf0], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xec], edx
lea edx, [esp + 0xec]
mov dword [esp + 0xf4], ecx
push edx
lea ecx, [esp + 0x58]
call fcn.1003bda0
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x74]
xor ebp, ebp
mov ecx, dword [esp + 0x84]
add ecx, 1
cmp ecx, dword [esp + 0x24]
mov dword [esp + 0x84], ecx
jb 0x1003ea30
mov esi, dword [esp + 0x48]
cmp dword [edi + 0x425c], ebp
jg 0x1003ee30
jl 0x1003ede1
cmp dword [edi + 0x4258], ebp
jae 0x1003ee30
mov eax, dword [esp + 0x28]
or eax, dword [esp + 0x2c]
jne 0x1003ee30
cmp dword [ebx], 0x80
jne 0x1003ee30
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x1003ee30
mov ecx, dword [esp + 0x5c]
sub ecx, eax
sar ecx, 4
je 0x1003ee30
cmp ecx, ebp
ja 0x1003ee14
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x58]
mov ecx, dword [eax]
mov dword [edi + 0x4258], ecx
mov edx, dword [eax + 4]
mov dword [edi + 0x425c], edx
mov dword [esp + 0x94], 1
cmp dword [esp + 0x90], ebp
jne 0x1003ee63
mov ecx, dword [ebx + 4]
push ecx
lea eax, [esp + esi + 0x8a40]
push ebx
push eax
call sub.ntdll.dll_memcpy
mov ebx, dword [ebx + 4]
add esi, ebx
add esp, 0xc
add dword [esp + 0x8a54], ebx
mov dword [esp + 0x48], esi
jmp 0x1003ef18
push 0x80000
call sub.MSVCR80.dll_void____cdecl_operator_new___unsigned_int_
push 0x80000
mov esi, eax
push ebp
push esi
call sub.ntdll.dll_memset
add esp, 0x10
lea edx, [esp + 0x54]
push edx
mov ecx, edi
call fcn.1003cc50
push esi
lea eax, [esp + 0x58]
push eax
push ebx
mov ecx, edi
call fcn.10039ac0
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x8a54]
mov ecx, dword [esp + 0x48]
add edx, eax
cmp edx, dword [edi + 0x42ac]
lea ecx, [esp + ecx + 0x8a3c]
ja 0x1003eec4
push eax
push esi
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
jmp 0x1003eefd
call fcn.10059c60
mov ecx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x2c]
mov ebx, dword [ebp]
push eax
push ecx
push 0x498
mov ecx, str..._ntfsresize.cpp
add ebx, 8
call fcn.100386c0
mov edx, dword [ebx]
add esp, 4
push eax
push str._s:_File_fragments__FrNumber:_I64d.
push ebp
call edx
add esp, 0x14
xor ebp, ebp
mov eax, dword [esi + 4]
add dword [esp + 0x48], eax
add dword [esp + 0x8a54], eax
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
mov esi, dword [esp + 0x4c]
add esp, 4
lea ecx, [esp + 0x11c]
call fcn.1002f6d0
mov ebx, eax
mov eax, dword [esp + 0x58]
cmp eax, ebp
mov dword [esp + 0x30], ebx
je 0x1003ef3b
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0xac]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
mov byte [esp + 0xca48], 2
call fcn.100309d0
cmp ebx, ebp
jne 0x1003e980
cmp dword [esp + 0x80], ebp
jne 0x1003ef97
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x1003f228
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x28]
push edx
jmp 0x1003f220
mov ecx, dword [esp + 0x8a54]
add ecx, 8
cmp ecx, dword [edi + 0x42ac]
lea eax, [esp + esi + 0x8a3c]
ja 0x1003efb9
mov dword [eax], 0xffffffff
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x8a54]
mov esi, dword [edi + 0x42ac]
add eax, 8
cmp eax, esi
mov dword [esp + 0x8a54], eax
ja 0x1003f0ec
cmp dword [edi + 0x134], ebp
mov dword [esp + 0x78], ebp
jne 0x1003f1fe
push 0x3fff
lea edx, [esp + 0x4a41]
push ebp
push edx
mov byte [esp + 0x4a48], 0
call sub.ntdll.dll_memset
push esi
lea eax, [esp + 0x8a4c]
push eax
lea ecx, [esp + 0x4a50]
push ecx
call sub.ntdll.dll_memcpy
movzx edx, word [esp + 0x4a5a]
sub edx, 1
add esp, 0x18
xor eax, eax
test edx, edx
jle 0x1003f075
lea ecx, [esp + 0x4c3a]
movzx edx, word [esp + 0x4a40]
mov si, word [ecx]
lea edx, [esp + edx + 0x4a3e]
mov word [edx + eax*2], si
movzx edx, word [esp + 0x4a40]
mov dx, word [esp + edx + 0x4a3c]
mov word [ecx], dx
movzx edx, word [esp + 0x4a42]
add eax, 1
sub edx, 1
add ecx, 0x200
cmp eax, edx
jl 0x1003f034
mov eax, dword [edi + 0x42ac]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x4a40]
push ecx
push edx
push eax
lea ecx, [edi + 0x1e0]
call fcn.10031c90
test eax, eax
je 0x1003f56b
cmp dword [esp + 0xca58], ebp
jne 0x1003f2cd
xor ebp, ebp
xor ebx, ebx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1003f1eb
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 5
cmp ebp, eax
jae 0x1003f1eb
lea eax, [ecx + ebx]
push eax
mov ecx, edi
call fcn.100396c0
mov esi, eax
test esi, esi
jne 0x1003f627
add ebp, 1
add ebx, 0x20
jmp 0x1003f0b2
cmp dword [esp + 0x78], ebp
jne 0x1003f4fe
or eax, 0xffffffff
cmp dword [esp + 0x94], ebp
je 0x1003f10e
mov dword [edi + 0x4258], eax
mov dword [edi + 0x425c], eax
add dword [esp + 0x4c], eax
mov dword [esp + 0x78], 1
mov dword [esp + 0x44], ebp
adc dword [esp + 0x50], eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x1003f130
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x1003f228
mov edx, dword [esp + 0x1c]
mov eax, edx
sub eax, esi
sar eax, 5
cmp ecx, eax
jae 0x1003f1d3
mov edx, dword [esp + 0x44]
xor ebx, ebx
lea esi, [esi + edx + 0x10]
xor ebp, ebp
jmp 0x1003f160
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003f1be
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 4
cmp ebx, eax
jae 0x1003f1be
test ecx, ecx
je 0x1003f183
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 4
cmp ebx, eax
jb 0x1003f189
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esi + 4]
mov edx, dword [eax + ebp + 4]
mov ecx, dword [eax + ebp]
add eax, ebp
mov dword [esp + 0xb0], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
push edx
push ecx
lea ecx, [edi + 0x140]
mov dword [esp + 0xc0], eax
call fcn.10056b90
add ebx, 1
add ebp, 0x10
jmp 0x1003f160
add dword [esp + 0x30], 1
add dword [esp + 0x44], 0x20
mov ecx, dword [esp + 0x30]
xor ebp, ebp
jmp 0x1003f130
mov ecx, dword [esp + 0x24]
push ecx
lea eax, [esp + 0x18]
push eax
push edx
push esi
call fcn.1003e1a0
mov ecx, dword [esp + 0x28]
push ecx
jmp 0x1003f220
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.10038840
xor ebp, ebp
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
je 0x1003f228
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push edx
push ecx
call fcn.1003e1a0
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
lea ecx, [esp + 0x11c]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xca48], 0
call fcn.1002f120
add dword [esp + 0x4c], 1
mov esi, dword [esp + 0x50]
mov ecx, dword [esp + 0x7c]
adc esi, ebp
mov dword [esp + 0x50], esi
call fcn.1002eb20
xor ecx, ecx
cmp esi, ecx
jl 0x1003e6e0
jg 0x1003f276
cmp dword [esp + 0x4c], eax
jb 0x1003e6e0
cmp dword [edi + 0x134], ebp
jne 0x1003f761
cmp dword [esp + 0xca58], ebp
je 0x1003f761
xor ebp, ebp
xor esi, esi
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x1003f74e
mov eax, dword [esp + 0x3c]
sub eax, ecx
sar eax, 5
cmp ebp, eax
jae 0x1003f74e
lea eax, [ecx + esi]
push eax
mov ecx, edi
call fcn.100396c0
mov ebx, eax
test ebx, ebx
jne 0x1003f6e2
add ebp, 1
add esi, 0x20
jmp 0x1003f293
xor esi, esi
xor ebx, ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
je 0x1003f228
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 5
cmp esi, eax
jae 0x1003f202
add ecx, ebx
push ecx
lea ecx, [esp + 0x38]
call fcn.1003e580
add esi, 1
add ebx, 0x20
jmp 0x1003f2d1
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
push 0x17
mov ecx, edi
call eax
call fcn.10059c60
mov edi, eax
mov esi, dword [edi]
push 0x3e6
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
mov ecx, dword [esi]
push eax
push 0x10064608
push edi
call ecx
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x1003f366
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
call fcn.1003e1a0
mov eax, dword [esp + 0x48]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor eax, eax
jmp 0x1003f7a9
call fcn.10059c60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
mov ebx, eax
mov esi, dword [ebx]
push edx
push 0x3f6
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
add esp, 4
push eax
mov eax, dword [esi]
push str._s:_Failed_to_read_the_file_record__FrNumber:_I64d.
push ebx
call eax
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
add esp, 0x14
push 0xd2
mov ecx, edi
call eax
lea ecx, [esp + 0x11c]
mov byte [esp + 0xca48], 0
call fcn.1002f120
lea ecx, [esp + 0x34]
call fcn.1003e200
xor eax, eax
jmp 0x1003f7a9
call fcn.10059c60
mov ecx, dword [ebx]
mov edx, dword [esp + 0x2c]
push ecx
mov ebp, eax
mov eax, dword [esp + 0x2c]
mov esi, dword [ebp]
push edx
push eax
push 0x41d
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_initialize_DataRun_List__FrNumber:_I64d__AttrCode:0x_X.
push ebp
call ecx
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
add esp, 0x18
push 0xd3
mov ecx, edi
call eax
lea ecx, [esp + 0xac]
mov byte [esp + 0xca48], 2
call fcn.100309d0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1003f467
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x28]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor esi, esi
lea ecx, [esp + 0x11c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0xca48], 0
call fcn.1002f120
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x1003f366
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x48]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor eax, eax
jmp 0x1003f7a9
mov ecx, dword [ebx + 0x130]
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
lea eax, [esp + 0x423c]
push eax
call edx
call fcn.10059c60
mov edi, eax
mov esi, dword [edi]
push 0x45e
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
push eax
mov eax, dword [esi]
push str._s:_Too_much_file_fragment__please_defragment.
push edi
call eax
jmp 0x1003ebb1
mov ecx, dword [edi + 0x130]
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
lea eax, [esp + 0x423c]
push eax
call edx
call fcn.10059c60
mov ecx, dword [esp + 0x28]
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov esi, dword [ebx]
push eax
push ecx
push 0x4bb
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
mov edx, dword [esi]
add esp, 4
push eax
push str._s:_Too_much_file_fragment__please_defragment__FrNumber:_I64d.
push ebx
call edx
mov edi, dword [edi + 0x130]
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
add esp, 0x14
push 0xd7
mov ecx, edi
call edx
lea ecx, [esp + 0x14]
call fcn.1003e200
jmp 0x1003f3b7
call fcn.10059c60
mov ebx, eax
mov esi, dword [ebx]
push 0x4ea
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
push eax
mov eax, dword [esi]
push str._s:_Write_mft_file_failed.
push ebx
call eax
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
add esp, 0x10
push 0xd2
mov ecx, edi
call eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x1003f5d2
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x28]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
lea ecx, [esp + 0x11c]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov byte [esp + 0xca48], 0
call fcn.1002f120
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x1003f366
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x48]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor eax, eax
jmp 0x1003f7a9
call fcn.10059c60
mov ebp, eax
mov ebx, dword [ebp]
push 0x4f8
mov ecx, str..._ntfsresize.cpp
add ebx, 8
call fcn.100386c0
push eax
mov eax, dword [ebx]
push str._s:_Move_file_data_error.
push ebp
call eax
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
add esp, 0x10
push esi
mov ecx, edi
call eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1003f68b
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x28]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor esi, esi
lea ecx, [esp + 0x11c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0xca48], 0
call fcn.1002f120
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x1003f366
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x48]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor eax, eax
jmp 0x1003f7a9
call fcn.10059c60
mov ebp, eax
mov esi, dword [ebp]
push 0x517
mov ecx, str..._ntfsresize.cpp
add esi, 8
call fcn.100386c0
push eax
mov eax, dword [esi]
push str._s:_Move_file_data_error.
push ebp
call eax
mov edi, dword [edi + 0x130]
mov edx, dword [edi]
mov eax, dword [edx + 0x20]
add esp, 0x10
push ebx
mov ecx, edi
call eax
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1003f366
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x38]
push edx
push ecx
push eax
call fcn.1003e1a0
mov edx, dword [esp + 0x48]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor eax, eax
jmp 0x1003f7a9
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.10038840
xor ebp, ebp
mov esi, dword [esp + 0x38]
cmp esi, ebp
je 0x1003f7a4
mov eax, dword [esp + 0x3c]
cmp esi, eax
mov edi, eax
je 0x1003f79b
add esi, 0x14
mov eax, dword [esi]
cmp eax, ebp
je 0x1003f785
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
add esi, 0x20
lea eax, [esi - 0x14]
cmp eax, edi
jne 0x1003f776
mov esi, dword [esp + 0x38]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xca40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xca28]
xor ecx, esp
call fcn.10059076
add esp, 0xca38
ret 0xc