Function at 0x1004ea9d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov edx, str.VirtualDiskSize
push ebx
mov ecx, esi
mov dword [esp + 0x14], edi
push dword [edi + 0x7c]
push dword [edi + 0x78]
call fcn.1004ed95
push ebx
push dword [edi + 0x3c]
mov edx, str.PhysicalSize
mov ecx, esi
push dword [edi + 0x38]
call fcn.1004ed95
mov ebp, 0x10112058
cmp dword [edi + 0x114], ebx
je 0x1004eb0a
push str.Error
mov ecx, esi
call fcn.10002740
push ebp
mov ecx, esi
call fcn.10002740
lea eax, [edi + 0x110]
mov ecx, esi
push eax
call fcn.1000270b
mov ecx, esi
call fcn.10002955
cmp byte [edi + 0x60], bl
je 0x1004eb36
push 0x10119440
mov ecx, esi
call fcn.10002740
push ebp
mov ecx, esi
call fcn.10002740
push esi
lea ecx, [edi + 0x80]
call fcn.10011c11
mov ecx, esi
call fcn.10002955
push ebx
push dword [edi + 0xa4]
mov edx, str.SequenceNumber
mov ecx, esi
push dword [edi + 0xa0]
call fcn.1004ed95
push 1
push ebx
push dword [edi + 0xa8]
mov edx, str.LogLength
mov ecx, esi
call fcn.1004ed95
mov ebp, ebx
lea ecx, [edi + 0xb8]
shl ebp, 4
add ecx, ebp
call fcn.1004f87e
test al, al
jne 0x1004ebca
test ebx, ebx
jne 0x1004eb85
mov eax, str.FileWrite
jmp 0x1004eb95
cmp ebx, 1
mov eax, str.DataWrite
mov ecx, 0x10119478
cmovne eax, ecx
push eax
mov ecx, esi
call fcn.10002740
push str.Guid
mov ecx, esi
call fcn.10002740
push 0x10112058
mov ecx, esi
call fcn.10002740
lea ecx, [edi + 0xb8]
push esi
add ecx, ebp
call fcn.10011c11
mov ecx, esi
call fcn.10002955
inc ebx
cmp ebx, 3
jb 0x1004eb64
mov eax, dword [edi + 0x70]
mov edx, str.HasParent
shr eax, 1
mov ecx, esi
and al, 1
movzx eax, al
push eax
call fcn.1004ed6d
mov al, byte [edi + 0x70]
mov edx, str.Fixed
and al, 1
mov ecx, esi
movzx eax, al
push eax
call fcn.1004ed6d
test byte [edi + 0x70], 1
je 0x1004ec16
movzx eax, byte [edi + 0x129]
mov edx, str.DataContiguous
push eax
mov ecx, esi
call fcn.1004ed6d
push dword [edi + 0x64]
mov edx, str.BlockSize
mov ecx, esi
call fcn.1004ed3c
push dword [edi + 0x68]
mov edx, str.LogicalSectorSize
mov ecx, esi
call fcn.1004ed3c
push dword [edi + 0x6c]
mov edx, str.PhysicalSectorSize
mov ecx, esi
call fcn.1004ed3c
mov eax, dword [edi + 0xe8]
xor edx, edx
mov ecx, dword [edi + 0x64]
call fcn.100f4dc0
mov ebp, edx
mov ebx, eax
push 1
push ebp
push ebx
mov edx, str.PackSize
mov ecx, esi
call fcn.1004ed95
mov eax, dword [edi + 0xec]
mov ecx, 0x100000
mul ecx
mov ecx, dword [esp + 0x18]
mov esi, eax
mov edi, edx
mov eax, dword [esp + 0x10]
mov edx, str.HeadersSize
push 1
add esi, dword [eax + 0xf0]
adc edi, dword [eax + 0xf4]
push edi
push esi
call fcn.1004ed95
mov eax, dword [esp + 0x10]
mov edx, str.FreeSpace
push 1
mov ecx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
sub ecx, esi
sbb eax, edi
sub ecx, ebx
mov ebx, dword [esp + 0x1c]
sbb eax, ebp
push eax
push ecx
mov ecx, ebx
call fcn.1004ed95
mov ebp, dword [esp + 0x10]
xor edi, edi
cmp dword [ebp + 0x94], edi
je 0x1004ed34
push str.Parent:
mov ecx, ebx
call fcn.10002740
mov ecx, ebx
call fcn.10002955
cmp dword [ebp + 0x94], edi
jbe 0x1004ed2d
mov eax, dword [ebp + 0x90]
mov ecx, ebx
push 0x1011205c
mov esi, dword [eax + edi*4]
call fcn.10002740
push esi
mov ecx, ebx
call fcn.1000270b
push 0x10112058
mov ecx, ebx
call fcn.10002740
lea eax, [esi + 0xc]
mov ecx, ebx
push eax
call fcn.1000270b
mov ecx, ebx
call fcn.10002955
inc edi
cmp edi, dword [ebp + 0x94]
jb 0x1004ece9
mov ecx, ebx
call fcn.10002955
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4