Function at 0x40ef30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [0x4666b4]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
push 4
push str.FILE
push ebx
mov byte [ebp - 4], 2
call fcn.0041caf0
add esp, 0xc
test eax, eax
je 0x40efa3
push str.strncmp__char__mftptr__MultiSectorHeader.Signature__FILE__4_0
push 0x1d8
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40efa3
push eax
call fcn.0041c4fb
cmp word [ebx + 0x14], 0x400
jb 0x40efcd
push str.mftptr__FirstAttributeOffset___1024
push 0x1d9
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40efcd
push eax
call fcn.0041c4fb
xor eax, eax
mov ax, word [ebx + 0x14]
mov ecx, dword [eax + ebx]
or esi, 0xffffffff
add eax, ebx
cmp ecx, esi
jne 0x40f015
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00434de3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00434de3
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], esi
call fcn.00434de3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 0
push 0
push 0x10
push ebx
push ecx
call fcn.00404100
add esp, 0x14
test eax, eax
je 0x40efdf
mov cl, byte [eax + 8]
test cl, cl
jne 0x40f03f
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x40f045
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
mov edx, dword [0x46bb84]
push ecx
push 0
push 0
push eax
mov eax, dword [edx + 0x60]
push eax
call fcn.004037c0
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x20], eax
je 0x40efdf
mov ecx, dword [eax + 0x20]
mov edi, eax
add eax, 0x20
and ecx, 0x400
cmp ecx, 0x400
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x28], eax
je 0x40efdf
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push 0
push 0
push 0x20
push ebx
push eax
call fcn.00404100
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push 0
push 0
push 0x30
push ebx
push edx
call fcn.00404100
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x28
cmp eax, 0x10
jl 0x40f124
test edi, edi
je 0x40f124
mov ax, word [ebx + 0x16]
test ax, ax
je 0x40f0d7
cmp ax, 1
jne 0x40f0f1
test esi, esi
jne 0x40f0f1
push 0x10000
push str.found
push str.File_with_no_name_found.__This_seems_odd.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
test edi, edi
je 0x40f124
mov ax, word [ebx + 0x16]
cmp ax, 2
je 0x40f105
cmp ax, 3
jne 0x40f124
test esi, esi
jne 0x40f12c
push 0x10000
push str.found
push str.Directory_with_no_name_found._This_seems_odd.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f85e
test esi, esi
je 0x40f85e
xor ecx, ecx
cmp esi, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
jne 0x40f145
xor eax, eax
jmp 0x40f157
mov al, byte [esi + 8]
test al, al
jne 0x40f151
mov eax, dword [esi + 0x10]
jmp 0x40f157
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 1
push ecx
push eax
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 0
push 0
push esi
push ecx
call fcn.004037c0
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x40f193
push 0x10000
push str.Problem
push str.Filename_cant_be_accessed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40f920
mov edi, dword [eax]
lea esi, [eax + 0x40]
xor edx, edx
mov dl, byte [esi]
mov dword [ebp - 0x44], eax
add eax, 0x42
push edx
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0041cb7a
xor ecx, ecx
mov cl, byte [esi]
add esp, 0xc
lea edx, [ebp - 0x168]
push edx
mov byte [ebp + ecx - 0x168], 0
lea ecx, [ebp - 0x14]
call fcn.00434f6c
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 1
push 0
push 0x30
push ebx
push ecx
call fcn.00404100
add esp, 0x14
test eax, eax
je 0x40f281
mov cl, byte [eax + 8]
test cl, cl
jne 0x40f1fc
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x40f202
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
mov edx, dword [0x46bb84]
push ecx
push 0
push 0
push eax
mov eax, dword [edx + 0x60]
push eax
call fcn.004037c0
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x40f23d
push 0x10000
push str.Problem
push str.Filename_cant_be_accessed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x20]
lea esi, [eax + 0x40]
xor ecx, ecx
mov cl, byte [esi]
add eax, 0x42
lea edx, [ebp - 0x168]
push ecx
push eax
push edx
call fcn.0041cb7a
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov al, byte [esi]
xor edx, edx
add esp, 0xc
mov byte [ebp + eax - 0x168], 0
mov dl, byte [esi]
mov eax, dword [ecx - 8]
cmp eax, edx
jge 0x40f281
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x14]
call fcn.00434f6c
lea ecx, [ebp - 0x4c]
push edi
push ecx
call fcn.0040e360
add esp, 8
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.00434f1c
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00434de3
mov edi, dword [ebp + 0x14]
mov esi, 0x46b118
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f2d5
test cl, cl
je 0x40f2d1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f2d5
add eax, 2
add esi, 2
test cl, cl
jne 0x40f2b1
xor eax, eax
jmp 0x40f2da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f36d
mov esi, 0x463150
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f30d
test cl, cl
je 0x40f309
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f30d
add eax, 2
add esi, 2
test cl, cl
jne 0x40f2e9
xor eax, eax
jmp 0x40f312
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f36d
mov esi, 0x465428
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f341
test cl, cl
je 0x40f33d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f341
add eax, 2
add esi, 2
test cl, cl
jne 0x40f31d
xor eax, eax
jmp 0x40f346
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f36d
mov eax, dword [ebp + 0x18]
push eax
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp + 0x18], esp
push edx
call fcn.00434b58
call fcn.0040eb20
add esp, 8
test al, al
je 0x40f920
mov al, byte [ebp + 0x1c]
test al, al
je 0x40f3aa
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp + 0x1c], esp
push eax
call fcn.00434b58
push ecx
lea edx, [ebp - 0x1c]
mov ecx, esp
mov dword [ebp + 0x18], esp
push edx
mov byte [ebp - 4], 4
call fcn.00434b58
mov byte [ebp - 4], 2
call fcn.0040ebc0
add esp, 8
test al, al
jne 0x40f920
cmp word [ebx + 0x16], 0
jne 0x40f3d7
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 0
push str._I30
push 0x90
push ebx
push ecx
call fcn.00404100
add esp, 0x14
test eax, eax
je 0x40f3d7
or byte [ebx + 0x16], 2
mov dl, byte [ebx + 0x16]
and dl, 2
cmp dl, 2
jne 0x40f3ef
push 0x463f94
lea ecx, [ebp - 0x14]
call fcn.004351bf
test byte [ebx + 0x16], 1
je 0x40f428
mov eax, dword [0x46bb84]
mov cl, byte [eax + 0x141]
test cl, cl
jne 0x40f428
push 0x10000
push str.help
push str.MFT_bitmap_says_deleted__but_MFT_record_not_yet_marked_unused
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.__MFT_not_marked_unused_
lea ecx, [ebp - 0x14]
call fcn.004351bf
mov ecx, dword [0x46bb84]
mov esi, dword [ebp + 8]
mov edx, dword [ecx + 0x60]
xor edi, edi
push edi
push 0x46bdf4
push 0x80
push esi
push edx
call fcn.00404100
mov ecx, dword [ebp - 0x50]
mov ebx, eax
add esp, 0x14
lea eax, [ebp - 0x68]
push eax
add ecx, 8
push ecx
mov dword [ebp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov edx, dword [0x4666b4]
mov dword [ebp - 0x18], edx
mov al, byte [esi + 0x16]
and al, 2
cmp al, 2
mov byte [ebp - 4], 5
je 0x40f4cb
cmp ebx, edi
jne 0x40f4ef
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
push edi
push str._I30
push 0x90
push esi
push edx
call fcn.00404100
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x40f4b7
or byte [esi + 0x16], 2
push str.Directory
lea ecx, [ebp - 0x18]
call fcn.00434f6c
xor ebx, ebx
jmp 0x40f658
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax + 0x38]
and ecx, dword [edx]
test cl, 0x10
je 0x40f4dd
or byte [esi + 0x16], 2
push str.Directory
lea ecx, [ebp - 0x18]
call fcn.00434f6c
jmp 0x40f658
push str.Hopeless
lea ecx, [ebp - 0x18]
call fcn.00434f6c
jmp 0x40f658
mov al, byte [ebx + 8]
test al, al
jne 0x40f508
push str.Excellent
lea ecx, [ebp - 0x18]
call fcn.00434f6c
jmp 0x40f658
push str.Good
lea ecx, [ebp - 0x18]
call fcn.00434f6c
push ebx
call fcn.00403700
add esp, 4
cmp eax, edi
mov dword [ebp - 0x20], eax
jne 0x40f581
push 0x10000
push str.Problem
push str.Find_Attr_DataArea_failed_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00434de3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00434de3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00434de3
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00434de3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
cmp byte [eax], 0
mov byte [ebp - 4], 6
je 0x40f658
jmp 0x40f5a4
xor edi, edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.00403480
add esp, 0xc
test al, al
je 0x40f658
cmp dword [0x46b1e4], edi
je 0x40f638
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cdq
mov edi, eax
mov eax, dword [ebp - 0x34]
add edi, esi
adc edx, eax
xor eax, eax
cmp eax, edx
jg 0x40f638
jl 0x40f5e6
cmp esi, edi
jae 0x40f638
jmp 0x40f5e6
mov ebx, dword [ebp + 0x1c]
cmp esi, dword [0x46b1e0]
ja 0x40f62b
mov ebx, dword [0x46b1e4]
mov eax, esi
shr eax, 5
mov eax, dword [ebx + eax*4]
mov ecx, esi
and ecx, 0x1f
shr eax, cl
test al, 1
jne 0x40f619
xor eax, eax
inc esi
cmp eax, edx
jl 0x40f5e3
jg 0x40f614
cmp esi, edi
jb 0x40f5e3
mov ebx, dword [ebp + 0x1c]
jmp 0x40f638
push str.Poor
lea ecx, [ebp - 0x18]
call fcn.00434f6c
mov ebx, dword [ebp + 0x1c]
jmp 0x40f638
push str.Hopeless
lea ecx, [ebp - 0x18]
call fcn.00434f6c
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
cdq
add esi, eax
adc ecx, edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], esi
cmp byte [ecx], 0
jne 0x40f5a2
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 7
mov esi, str.Directory
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f688
test cl, cl
je 0x40f684
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f688
add eax, 2
add esi, 2
test cl, cl
jne 0x40f664
xor eax, eax
jmp 0x40f68d
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ecx
je 0x40f6d7
cmp ebx, ecx
jne 0x40f69b
xor eax, eax
jmp 0x40f6ad
mov al, byte [ebx + 8]
test al, al
jne 0x40f6a7
mov eax, dword [ebx + 0x10]
jmp 0x40f6ad
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x34]
mov edx, dword [ebp + 0xc]
push edx
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x68]
push edx
mov edx, dword [ecx]
push edx
mov edx, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.0040e860
add esp, 0x20
mov eax, dword [0x46bb84]
mov ebx, dword [ebp + 8]
mov ecx, dword [eax + 0x60]
push 0
push 0x46bdf4
push 0x80
push ebx
push ecx
mov dword [ebp - 4], 5
call fcn.00404100
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp eax, 0x10
mov edi, 1
jl 0x40f7b2
mov ax, word [ebx + 0x16]
test ax, ax
je 0x40f724
cmp ax, di
jne 0x40f7b2
test esi, esi
jne 0x40f7ba
mov edx, dword [0x4666b4]
mov dword [ebp + 0x1c], edx
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp + 0x1c]
push str.File__s_found_that_has_no_unnamed_data_attribute
push ecx
mov byte [ebp - 4], 9
call fcn.0042e13c
add esp, 0xc
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 5
call fcn.00434de3
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00434de3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00434de3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00434de3
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00434de3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x40f898
mov ax, word [ebx + 0x16]
test ax, ax
je 0x40f7eb
cmp ax, 1
je 0x40f7eb
push str.mftptr__Flags0__mftptr__Flags1
push 0x2c8
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40f7eb
push eax
call fcn.0041c4fb
test esi, esi
je 0x40f834
push 1
push esi
call fcn.00403d50
mov ecx, dword [ebp - 0x24]
add ecx, eax
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x58]
push eax
push esi
mov dword [ebp - 0x24], ecx
call fcn.00404030
mov ecx, dword [0x46bb84]
mov edx, dword [ecx + 0x60]
mov eax, edi
push eax
push 0x46bdf4
push 0x80
push ebx
push edx
inc edi
call fcn.00404100
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x40f7ef
mov eax, dword [0x46bb84]
mov ecx, dword [eax + 0x60]
push 0
push 0x46bdf4
push 0x80
push ebx
push ecx
call fcn.00404100
add esp, 0x14
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00434de3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00434de3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00434de3
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00434de3
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x46bb84]
mov eax, dword [edx + 0x60]
push 0
push str._I30
push 0xa0
push ebx
push eax
call fcn.00404100
add esp, 0x14
cmp word [ebx + 0x16], 0
jne 0x40f8c8
test eax, eax
je 0x40f8c8
mov word [ebx + 0x16], 2
mov ecx, dword [0x46bb84]
mov al, byte [ecx + 0x141]
test al, al
jne 0x40f90a
mov ax, word [ebx + 0x16]
cmp ax, 2
je 0x40f90a
cmp ax, 3
je 0x40f90a
push str.mftptr__Flags2__mftptr__Flags_3
push 0x2f9
push str.E:_srcundeleteundeleteDoc.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x40f90a
push eax
call fcn.0041c4fb
test byte [ebx + 0x16], 2
jne 0x40f852
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00434de3
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00434de3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00434de3
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00434de3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret