Function at 0x1000bf10
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [sym.imp.MSVCR80.dll_malloc]
push edi
push 0x200
mov edi, eax
call esi
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x1000bf3d
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x200
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
call esi
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x1000bf67
push 1
call dword [sym.imp.MSVCR80.dll_exit]
push 0x200
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [edi + 0xf4]
mov ecx, dword [edi + 0xf0]
mov esi, dword [esp + 0x1c]
mov edx, dword [ebp + 0x134]
push eax
push ecx
push 0x200
push esi
xor ebx, ebx
push ebp
mov dword [esp + 0x2c], ebx
call edx
add esp, 0x14
cmp eax, 0x200
je 0x1000bfb7
push 0x200
push ebx
push esi
call sub.ntdll.dll_memset
add esp, 0xc
push edi
mov eax, esi
call fcn.100054f0
add esp, 4
test eax, eax
jne 0x1000bfce
mov dword [esp + 0x18], 1
mov eax, dword [ebp + 0x198]
mov edx, dword [edi + 0xf0]
xor ecx, ecx
sub edx, eax
mov eax, dword [edi + 0xf4]
sbb eax, ecx
add edx, dword [edi + 0xf8]
mov ecx, dword [esp + 0x14]
adc eax, dword [edi + 0xfc]
push eax
push edx
mov edx, dword [ebp + 0x134]
push 0x200
push ecx
push ebp
call edx
add esp, 0x14
cmp eax, 0x200
je 0x1000c025
mov eax, dword [esp + 0x14]
push 0x200
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x14]
push edi
call fcn.100054f0
add esp, 4
test eax, eax
jne 0x1000c039
lea ebx, [eax + 1]
mov ecx, dword [esp + 0x14]
mov eax, 0x200
mov edx, esi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x1000c05c
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x1000c044
test eax, eax
je 0x1000c0c1
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x1000c0ab
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x1000c0bd
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x1000c0ab
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x1000c0bd
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x1000c0ab
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x1000c0bd
movzx ecx, byte [ecx]
movzx esi, byte [edx]
sub esi, ecx
je 0x1000c0bd
test esi, esi
mov ebp, dword [esp + 0x24]
mov eax, 1
jg 0x1000c0c3
or eax, 0xffffffff
jmp 0x1000c0c3
mov ebp, dword [esp + 0x24]
xor eax, eax
test eax, eax
jne 0x1000c0ce
mov eax, 1
jmp 0x1000c0d9
xor eax, eax
cmp ebx, 1
je 0x1000c28b
test ebx, ebx
je 0x1000c0fd
cmp dword [esp + 0x18], 0
je 0x1000c0f6
test eax, eax
jne 0x1000c0ef
mov esi, str.DOBRL
jmp 0x1000c10e
mov esi, str.DRML
jmp 0x1000c10e
mov esi, str.DBRL
jmp 0x1000c10e
cmp dword [esp + 0x18], 0
mov esi, str.DORL
jne 0x1000c10e
mov esi, 0x100d8484
mov eax, dword [0x100ddb00]
test eax, eax
je 0x1000c224
cmp byte [eax], 0x2c
jne 0x1000c12d
add eax, 1
mov dword [0x100ddb00], eax
cmp byte [eax], 0x2c
je 0x1000c120
mov ebx, dword [sym.imp.ntdll.dll_strncmp]
push 9
push str.rebuildbs
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c150
add dword [0x100ddb00], 9
jmp 0x1000bf77
mov edx, dword [0x100ddb00]
push 4
push str.dump
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c173
add dword [0x100ddb00], 4
jmp 0x1000bf77
mov eax, dword [0x100ddb00]
push 4
push str.list
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c1f2
add dword [0x100ddb00], 4
push 0x4f
push esi
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
test eax, eax
jne 0x1000bf77
push 0x42
push esi
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
test eax, eax
je 0x1000bf77
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0xf4]
mov eax, dword [edi + 0xf0]
push ecx
push edx
push eax
mov eax, ebp
call fcn.10003c30
mov ecx, dword [edi + 0xf4]
mov edx, dword [edi + 0xf0]
add esp, 0xc
push ecx
push edx
mov eax, ebp
call fcn.10003da0
add esp, 8
jmp 0x1000bf77
mov ecx, dword [0x100ddb00]
push 0xb
push str.originalntfs
push ecx
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c248
add dword [0x100ddb00], 0xb
push 0x4f
push esi
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
test eax, eax
jne 0x1000bf77
mov edx, dword [esp + 0x1c]
mov esi, dword [sym.imp.MSVCR80.dll_free]
push edx
call esi
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call esi
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edx, dword [0x100ddb00]
push 9
push str.backupntfs
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c26a
add dword [0x100ddb00], 9
push 0x42
jmp 0x1000c212
mov eax, dword [0x100ddb00]
push 9
push str.repairmft
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x1000c224
add dword [0x100ddb00], 9
push 0x4d
jmp 0x1000c212
mov eax, dword [edi + 0xf4]
mov ecx, dword [edi + 0xf0]
push eax
push ecx
mov dword [edi + 0x108], 0
mov dword [edi + 0x10c], 0
mov edi, dword [esp + 0x1c]
mov edx, dword [ebp + 0x138]
push 0x200
push edi
push ebp
call edx
mov eax, dword [ebp + 0x13c]
add esp, 0x14
push ebp
call eax
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.MSVCR80.dll_free]
add esp, 4
push ecx
call esi
add esp, 4
push edi
call esi
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret