Function at 0x10002910
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ebx + 0x198]
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x24]
push esi
lea esi, [eax + eax*2]
test esi, esi
push edi
ja 0x1000292f
push 1
call dword [sym.imp.MSVCR80.dll_exit]
mov edi, dword [sym.imp.MSVCR80.dll_malloc]
push esi
call edi
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jne 0x1000294b
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
push 0
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebx + 0x198]
lea esi, [eax + eax*2]
add esp, 0xc
test esi, esi
ja 0x1000296c
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
call edi
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x10002982
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push esi
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, edi
mov ecx, dword [ebp + 0xf0]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x198]
lea esi, [eax + eax*2]
mov eax, dword [ebp + 0xf4]
push eax
mov eax, dword [ebx + 0x198]
push ecx
mov ecx, dword [ebx + 0x134]
lea edx, [eax + eax*2]
mov eax, dword [esp + 0x18]
push edx
push eax
mov edi, 0x100d8460
push ebx
mov dword [esp + 0x2c], edi
call ecx
add esp, 0x14
cmp eax, esi
je 0x100029ed
mov edx, dword [esp + 0x10]
push esi
push 0
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov esi, dword [esp + 0x10]
push ebp
push ebx
call fcn.10001da0
add esp, 8
test eax, eax
jne 0x10002a15
cmp dword [ebp + 0x14c], 0xb
jne 0x10002a15
mov eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x198]
mov ecx, eax
lea esi, [ecx + ecx*2]
lea ecx, [eax + eax*2]
add ecx, ecx
xor edx, edx
add ecx, dword [ebp + 0xf0]
lea eax, [eax + eax*2]
adc edx, dword [ebp + 0xf4]
push edx
mov edx, dword [ebx + 0x134]
push ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push ebx
call edx
add esp, 0x14
cmp eax, esi
je 0x10002a5e
mov eax, dword [esp + 0x14]
push esi
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov esi, dword [esp + 0x14]
push ebp
push ebx
call fcn.10001da0
add esp, 8
test eax, eax
jne 0x10002a86
cmp dword [ebp + 0x14c], 0xb
jne 0x10002a86
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x10]
mov eax, 0x3e8
mov ecx, esi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10002aa9
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10002a91
test eax, eax
je 0x10002b0e
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002af8
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002b0a
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002af8
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002b0a
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002af8
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002b0a
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x10002b0a
test esi, esi
mov edi, dword [esp + 0x18]
mov eax, 1
jg 0x10002b10
or eax, 0xffffffff
jmp 0x10002b10
mov edi, dword [esp + 0x18]
xor eax, eax
test eax, eax
jne 0x10002bb4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add ecx, 0x3f0
mov eax, 0x210
add edx, 0x3f0
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10002b49
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10002b31
test eax, eax
je 0x10002bae
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002b98
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002baa
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002b98
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002baa
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x10002b98
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10002baa
movzx esi, byte [edx]
movzx edx, byte [ecx]
sub esi, edx
je 0x10002baa
test esi, esi
mov edi, dword [esp + 0x18]
mov eax, 1
jg 0x10002bb0
or eax, 0xffffffff
jmp 0x10002bb0
mov edi, dword [esp + 0x18]
xor eax, eax
test eax, eax
je 0x10002c0c
mov ecx, dword [esp + 0x24]
cmp ecx, 1
mov eax, dword [esp + 0x1c]
jne 0x10002bc9
test eax, eax
je 0x10002d60
cmp dword [esp + 0x20], 0
je 0x10002c10
test ecx, ecx
je 0x10002c01
test eax, eax
je 0x10002bdf
mov edi, str.DOBRL
jmp 0x10002c1e
mov eax, dword [ebx + 0x198]
lea eax, [eax + eax*2]
add eax, eax
mov dword [ebp + 0x108], eax
mov dword [ebp + 0x10c], 0
mov edi, str.DBRL
jmp 0x10002c1e
test eax, eax
je 0x10002c1e
mov edi, str.DORL
jmp 0x10002c1e
mov ecx, dword [esp + 0x24]
test ecx, ecx
mov edi, str.DRCL
jne 0x10002c1e
mov edi, 0x100d8484
mov eax, dword [0x100ddb00]
test eax, eax
je 0x10002cb5
cmp byte [eax], 0x2c
jne 0x10002c3d
add eax, 1
mov dword [0x100ddb00], eax
cmp byte [eax], 0x2c
je 0x10002c30
mov esi, dword [sym.imp.ntdll.dll_strncmp]
push 9
push str.rebuildbs
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x10002c60
add dword [0x100ddb00], 9
jmp 0x10002990
mov ecx, dword [0x100ddb00]
push 4
push str.dump
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x10002c83
add dword [0x100ddb00], 4
jmp 0x10002990
mov edx, dword [0x100ddb00]
push 4
push str.list
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x10002cd8
add dword [0x100ddb00], 4
push 0x4c
push edi
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
test eax, eax
jne 0x10002990
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.MSVCR80.dll_free]
push eax
call esi
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
mov eax, dword [0x100ddb00]
push 8
push str.repairfat
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x10002cf9
add dword [0x100ddb00], 8
push 0x43
jmp 0x10002ca3
mov ecx, dword [0x100ddb00]
push 0xb
push str.originalfat
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x10002d1b
add dword [0x100ddb00], 0xb
push 0x4f
jmp 0x10002ca3
mov edx, dword [0x100ddb00]
push 9
push str.backupfat
push edx
call esi
add esp, 0xc
test eax, eax
jne 0x10002cb5
add dword [0x100ddb00], 9
push 0x42
push edi
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
test eax, eax
je 0x10002cb5
xor eax, eax
mov dword [ebp + 0x108], eax
mov dword [ebp + 0x10c], eax
jmp 0x10002990
mov eax, dword [ebp + 0xf4]
mov ecx, dword [ebp + 0xf0]
mov edi, dword [esp + 0x14]
push eax
mov dword [ebp + 0x108], 0
mov dword [ebp + 0x10c], 0
mov eax, dword [ebx + 0x198]
push ecx
lea edx, [eax + eax*2]
mov eax, dword [ebx + 0x138]
push edx
push edi
push ebx
call eax
mov ecx, dword [ebx + 0x13c]
add esp, 0x14
push ebx
call ecx
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCR80.dll_free]
add esp, 4
push edx
call esi
add esp, 4
push edi
call esi
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret