Function at 0x403480
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push ebp
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.00403700
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi]
add esp, 4
cmp ecx, eax
jne 0x4034bf
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov al, byte [ebp + 8]
test al, al
je 0x4034bf
mov eax, dword [ebp + 0x10]
mov dword [edi], eax
mov ecx, dword [ebp + 0x14]
mov dword [edi + 4], ecx
mov edx, dword [esi]
mov al, byte [edx]
test al, al
jne 0x4034cc
pop edi
pop esi
pop ebp
pop ebx
ret
movsx eax, al
mov ebp, eax
sar eax, 4
and eax, 0xf
mov ebx, eax
mov eax, dword [0x46bb84]
mov cl, byte [eax + 0x141]
and ebp, 0xf
test cl, cl
mov dword [esp + 0x1c], ebx
je 0x40350c
cmp ebp, 4
jg 0x4035c7
test ebp, ebp
je 0x4035c7
cmp ebx, 4
jle 0x40350c
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
cmp ebp, 4
jg 0x403515
test ebp, ebp
jne 0x403537
push str.Length_of_Length_in_Run_wrong
push 0x55a
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x403537
push eax
call fcn.0041c4fb
cmp ebx, 4
jle 0x40355e
push str.Length_of_Logical_cluster_in_Run_wrong
push 0x55c
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40355e
push eax
call fcn.0041c4fb
mov edx, dword [esi]
inc edx
cmp ebp, 1
mov dword [esi], edx
mov eax, edx
jne 0x403572
movsx ecx, byte [eax]
mov dword [edi + 0x10], ecx
jmp 0x4035b0
cmp ebp, 2
jne 0x40357f
movsx edx, word [eax]
mov dword [edi + 0x10], edx
jmp 0x4035b0
cmp ebp, 3
jne 0x4035ab
xor ecx, ecx
mov dword [edi + 0x10], ecx
xor eax, eax
mov edx, dword [esi]
xor ebx, ebx
mov bl, byte [edx + eax]
mov edx, dword [edi + 0x10]
shl ebx, cl
add ecx, 8
add edx, ebx
inc eax
cmp ecx, 0x18
mov dword [edi + 0x10], edx
jl 0x40358b
mov ebx, dword [esp + 0x1c]
jmp 0x4035b0
mov eax, dword [eax]
mov dword [edi + 0x10], eax
mov ecx, dword [0x46bb84]
mov al, byte [ecx + 0x141]
test al, al
mov eax, dword [edi + 0x10]
je 0x4035ce
test eax, eax
jg 0x4035f4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
test eax, eax
jg 0x4035f4
push str.Run_length_less_than_zero_
push 0x57c
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4035f4
push eax
call fcn.0041c4fb
mov edx, dword [esi]
add edx, ebp
xor eax, eax
cmp ebx, eax
mov dword [esi], edx
mov dword [edi + 0x14], eax
jne 0x403613
mov edx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
cmp ebx, 1
jne 0x40361f
mov eax, dword [esi]
movsx ebp, byte [eax]
jmp 0x403650
cmp ebx, 2
jne 0x40362b
mov ecx, dword [esi]
movsx ebp, word [ecx]
jmp 0x403650
cmp ebx, 3
jne 0x40364c
mov ebp, dword [esi]
movsx eax, byte [ebp + 2]
mov ecx, 1
xor edx, edx
mov dl, byte [ecx + ebp]
shl eax, 8
or eax, edx
dec ecx
jns 0x40363b
mov ebp, eax
jmp 0x403650
mov eax, dword [esi]
mov ebp, dword [eax]
test ebp, ebp
jne 0x40367e
mov ecx, dword [edi + 8]
or ecx, dword [edi + 0xc]
je 0x40367e
push str.deltaLCN_0__Run.lcn__0
push 0x59e
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40367e
push eax
call fcn.0041c4fb
mov ecx, dword [edi + 8]
mov eax, ebp
cdq
add ecx, eax
mov dword [edi + 8], ecx
adc dword [edi + 0xc], edx
mov edx, dword [esi]
add edx, ebx
mov eax, edx
mov dword [esi], edx
mov al, byte [eax]
test al, al
je 0x4036f7
test al, 0xf0
jne 0x4036f7
mov dword [edi + 0x14], 0
mov edx, dword [esi]
movsx ebp, byte [edx]
cmp ebp, 4
jle 0x4036d1
push str.compressedlen___4
push 0x5be
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4036d1
push eax
call fcn.0041c4fb
mov edx, dword [esi]
inc edx
test ebp, ebp
mov dword [esi], edx
mov eax, edx
jle 0x4036f7
xor ecx, ecx
mov ebx, dword [edi + 0x14]
xor edx, edx
mov dl, byte [eax]
shl edx, cl
add ecx, 8
add ebx, edx
mov dword [edi + 0x14], ebx
mov eax, dword [esi]
inc eax
dec ebp
mov dword [esi], eax
jne 0x4036de
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret