Function at 0x40e1d0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov eax, 0xc0510
call fcn.00412cb0
mov eax, dword [0x42d0f0]
xor eax, esp
mov dword [esp + 0xc050c], eax
push ebx
push esi
mov esi, dword [esp + 0xc051c]
push edi
push 0x40000
mov byte [esp + 0xc0114], 1
mov byte [esp + 0xc0115], 2
mov byte [esp + 0xc0116], 4
mov byte [esp + 0xc0117], 8
mov byte [esp + 0xc0118], 0x10
mov byte [esp + 0xc0119], 0x20
mov byte [esp + 0xc011a], 0x40
mov byte [esp + 0xc011b], 0x80
call fcn.00412a5f
mov edi, eax
xor ebx, ebx
add esp, 4
mov dword [esp + 0x3c], edi
cmp edi, ebx
jne 0x40e278
mov eax, dword [esi + 0x22c]
push str.Error:_malloc___returned_NULL.
push ebx
push 2
call eax
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc050c]
xor ecx, esp
call fcn.00411002
add esp, 0xc0510
ret
mov eax, dword [esi + 0x20]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x44]
push edx
push 0x200
push edi
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f254
cmp dword [esp + 0x40], 0x200
jne 0x40f254
cmp dword [edi + 3], 0x5346544e
jne 0x40e2c9
cmp dword [edi + 7], 0x20202020
je 0x40e2fc
mov ecx, dword [esi + 0x22c]
push str.This_is_not_an_NTFS_disk__different_cookie_.
push ebx
push 2
call ecx
push edi
call fcn.00412c14
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc050c]
xor ecx, esp
call fcn.00411002
add esp, 0xc0510
ret
mov dword [esi + 0xfc], 1
movzx eax, word [edi + 0xb]
cdq
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], edx
movzx eax, byte [edi + 0xd]
cdq
mov dword [esp + 0xb0], eax
push ebp
mov ebp, edx
mov dword [esp + 0xb8], ebp
mov edx, dword [edi + 0x28]
mov dword [esp + 0xbc], edx
mov eax, dword [edi + 0x2c]
mov dword [esp + 0xc0], eax
mov ecx, dword [edi + 0x30]
mov dword [esp + 0xc4], ecx
mov edx, dword [edi + 0x34]
mov dword [esp + 0xc8], edx
mov eax, dword [edi + 0x38]
mov dword [esp + 0xcc], eax
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0xd0], ecx
mov eax, dword [edi + 0x40]
cmp eax, 0x80
jb 0x40e38a
mov ecx, 0x100
sub ecx, eax
mov eax, 1
xor edx, edx
call fcn.00413310
jmp 0x40e3b1
mov edx, dword [esp + 0xb4]
push ebp
push edx
push ebx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xac]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xb0]
push eax
mov dword [esp + 0xdc], edx
mov edx, dword [edi + 0x44]
push ecx
mov dword [esp + 0xe4], edx
mov edx, dword [esp + 0xbc]
push ebp
push edx
mov dword [esp + 0xf0], ebx
call fcn.00412be0
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], edx
cmp ebp, ebx
ja 0x40e407
cmp dword [esp + 0xb4], ebx
jbe 0x40e431
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xbc]
push ebp
push eax
push ecx
push edx
call fcn.00412e10
mov dword [esi + 0x178], eax
mov dword [esi + 0x17c], edx
mov eax, dword [esi + 0x22c]
push str.This_is_an_NTFS_disk.
push ebx
push ebx
call eax
mov ecx, dword [edi + 7]
mov edx, dword [edi + 3]
mov eax, dword [esi + 0x22c]
push ecx
push edx
push str.__Disk_cookie:__I64X
push ebx
push 2
call eax
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xcc]
mov eax, dword [esi + 0x22c]
push ecx
push edx
push str.__BytesPerSector:__I64u
push ebx
push 2
call eax
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xf0]
mov eax, dword [esi + 0x22c]
push ecx
push edx
push str.__TotalSectors:__I64u
push ebx
push 2
call eax
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0xfc]
mov eax, dword [esi + 0x22c]
add esp, 0x48
push ecx
push edx
push str.__SectorsPerCluster:__I64u
push ebx
push 2
call eax
movzx ecx, word [edi + 0x18]
mov edx, dword [esi + 0x22c]
push ecx
push str.__SectorsPerTrack:__lu
push ebx
push 2
call edx
movzx eax, word [edi + 0x1a]
mov ecx, dword [esi + 0x22c]
push eax
push str.__NumberOfHeads:__lu
push ebx
push 2
call ecx
mov edx, dword [esp + 0xfc]
mov eax, dword [esp + 0xf8]
mov ecx, dword [esi + 0x22c]
push edx
push eax
push str.__MftStartLcn:__I64u
push ebx
push 2
call ecx
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x114]
mov ecx, dword [esi + 0x22c]
add esp, 0x48
push edx
push eax
push str.__Mft2StartLcn:__I64u
push ebx
push 2
call ecx
mov edx, dword [esp + 0xec]
mov eax, dword [esp + 0xe8]
push edx
push eax
push str.__BytesPerMftRecord:__I64u
push ebx
mov ecx, dword [esi + 0x22c]
push 2
call ecx
mov edx, dword [esp + 0x108]
mov eax, dword [esp + 0x104]
mov ecx, dword [esi + 0x22c]
push edx
push eax
push str.__ClustersPerIndexRecord:__I64u
push ebx
push 2
call ecx
movzx edx, byte [edi + 0x15]
mov eax, dword [esi + 0x22c]
push edx
push str.__MediaType:__X
push ebx
push 2
call eax
mov ecx, dword [edi + 0x4c]
mov edx, dword [edi + 0x48]
mov eax, dword [esi + 0x22c]
add esp, 0x4c
push ecx
push edx
push str.__VolumeSerialNumber:__I64X
push ebx
push 2
call eax
mov ebp, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xcc]
mov eax, dword [esp + 0xc8]
add esp, 0x14
push ebp
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xd8]
push ecx
mov ecx, dword [esp + 0xd8]
push ecx
push edx
push eax
call fcn.00412e10
mov ecx, dword [esp + 0xc8]
mov dword [esi + 0x104], edx
mov edx, dword [esp + 0xb8]
push edx
mov edx, dword [esp + 0xc8]
mov dword [esi + 0x100], eax
mov eax, dword [esp + 0xb8]
push eax
push ecx
push edx
call fcn.00412be0
mov ecx, dword [esp + 0xac]
push ebp
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x6c], edx
lea edx, [esp + 0x60]
push edx
mov edx, dword [esi + 0x20]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x48]
push eax
push ecx
push edi
push edx
mov dword [esp + 0x84], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f215
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xd4]
cmp eax, ecx
jne 0x40f215
mov eax, dword [esp + 0xd8]
cmp ebx, eax
jne 0x40f215
push eax
push ecx
push edi
lea eax, [esp + 0xb8]
push eax
push esi
call fcn.0040c440
add esp, 0x14
test eax, eax
jne 0x40e694
push edi
call fcn.00412c14
add esp, 4
jmp 0x40eab1
mov ecx, dword [esp + 0xd8]
mov edx, dword [esp + 0xd4]
push ecx
push edx
push edi
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0xdc]
push ecx
push esi
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x80], ebx
call fcn.0040dc50
add esp, 0x38
test eax, eax
je 0x40f1e5
cmp dword [esp + 0x5c], ebx
je 0x40f1e5
mov edx, dword [esp + 0x54]
or edx, dword [esp + 0x58]
je 0x40f1e5
cmp dword [esp + 0x48], ebx
je 0x40f1e5
mov eax, dword [esp + 0x38]
or eax, dword [esp + 0x3c]
je 0x40f1e5
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
mov edx, dword [esi + 0x22c]
push eax
push ecx
push str.MftDataBytes___I64u__MftBitmapBytes___I64u
push ebx
push 6
call edx
mov eax, dword [esi + 0x22c]
push str.Reading__MFT::_BITMAP_into_memory
push ebx
push 6
call eax
mov ebp, dword [esp + 0x70]
add esp, 0x28
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov edx, dword [ebp]
and edx, dword [ebp + 4]
cmp edx, 0xffffffff
je 0x40e7bd
mov edx, dword [ebp + 8]
sub edx, eax
mov eax, dword [ebp + 0xc]
sbb eax, ecx
mov ecx, dword [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0xb8]
push ecx
push eax
push edx
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
add dword [esp + 0x10], eax
adc dword [esp + 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x10]
cmp ebp, ebx
jne 0x40e772
mov edx, dword [esp + 0x3c]
cmp dword [esp + 0x14], edx
ja 0x40e7ec
jb 0x40e7e0
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x38]
jae 0x40e7ec
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x10]
push edx
call fcn.00412a5f
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
je 0x40ea48
mov edx, dword [esp + 0x38]
push edx
push ebx
push eax
call fcn.00412f00
mov ecx, dword [esi + 0x22c]
push str.Reading__MFT::_BITMAP_into_memory
push ebx
push 6
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ecx
mov ebp, dword [esp + 0x60]
add esp, 0x18
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
je 0x40e9be
mov edx, dword [ebp + 8]
mov ebx, dword [esp + 0x28]
mov edi, dword [ebp + 0xc]
sub edx, ebx
sbb edi, dword [esp + 0x2c]
push edi
push edx
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push edx
push ecx
push eax
mov eax, dword [esi + 0x22c]
push str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
push 0
push 6
call eax
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd8]
mov eax, dword [ebp + 4]
add esp, 0x24
push ecx
mov ecx, dword [ebp]
push edx
push eax
push ecx
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x70], 0
mov edx, dword [ebp + 4]
mov eax, dword [ebp]
mov edi, dword [ebp + 8]
push edx
mov edx, dword [esp + 0xb8]
push eax
sub edi, ebx
mov ebx, dword [ebp + 0xc]
sbb ebx, dword [esp + 0x34]
push ecx
push edx
push ebx
push edi
call fcn.00412be0
mov ecx, dword [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0xb8]
push ecx
push edx
push eax
call fcn.00412be0
push edx
mov edx, dword [esi + 0x22c]
push eax
push ebx
push edi
push str.____Reading__I64u_clusters___I64u_bytes__from_LCN_I64u
push 0
push 6
call edx
mov edx, dword [ebp + 8]
sub edx, dword [esp + 0x4c]
add esp, 0x24
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0xb0]
imul edx, eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0xbc]
imul edx, ecx
push edx
imul eax, ecx
imul eax, dword [esp + 0x24]
add eax, dword [esp + 0x58]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40ea52
mov edi, dword [ebp + 8]
sub edi, dword [esp + 0x28]
mov ecx, dword [esp + 0xb8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [esp + 0xb4]
sbb ebx, dword [esp + 0x2c]
push ecx
push edx
push ebx
push edi
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
xor ecx, ecx
cmp dword [esp + 0x44], eax
jne 0x40ea52
cmp ecx, edx
jne 0x40ea52
add dword [esp + 0x18], edi
mov edi, dword [esp + 0x40]
adc dword [esp + 0x1c], ebx
xor ebx, ebx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x10]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
cmp ebp, ebx
jne 0x40e838
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ebx
push 8
push ecx
push edx
call fcn.00412be0
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xd8]
push eax
mov eax, dword [esp + 0x58]
mov ebp, edx
mov edx, dword [esp + 0x5c]
push ecx
push edx
push eax
mov dword [esp + 0x44], ebp
call fcn.00412e10
cmp ebp, edx
jb 0x40ea28
ja 0x40ea1e
cmp dword [esp + 0x30], eax
jbe 0x40ea28
mov ebp, edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
mov ecx, dword [esp + 0x30]
lea edx, [ecx*4]
push edx
call fcn.00412a5f
add esp, 4
mov dword [esp + 0x50], eax
cmp eax, ebx
jne 0x40eacc
push str.Error:_malloc___returned_NULL.
jmp 0x40f1ea
push 0x200
lea ecx, [esp + 0xc0120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov eax, dword [esi + 0x22c]
lea edx, [esp + 0xc0128]
push edx
push str.___s
push 0
push 2
call eax
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00412c14
mov edx, dword [esp + 0x60]
push edx
call fcn.00412c14
mov eax, dword [esi + 0x110]
push eax
call sym.JkDefrag.exe_DeleteItemTree
add esp, 0x28
mov dword [esi + 0x110], 0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc050c]
xor ecx, esp
call fcn.00411002
add esp, 0xc0510
ret
mov edx, dword [esi + 0x110]
mov dword [eax], edx
xor edx, edx
mov ecx, 1
cmp edx, ebp
ja 0x40eb02
mov edi, dword [esp + 0x30]
jb 0x40eaf0
cmp ecx, edi
jae 0x40eb02
lea esp, [esp]
mov dword [eax + ecx*4], ebx
add ecx, 1
adc edx, ebx
cmp edx, ebp
jb 0x40eaf0
ja 0x40eb02
cmp ecx, edi
jb 0x40eaf0
mov edi, dword [esp + 0x5c]
lea eax, [esp + 0x8c]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esi + 0x1f8], ebx
mov dword [esi + 0x1fc], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1f4], ebx
call fcn.00411e0a
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
add esp, 4
push ebx
push 0x3e8
push ecx
push edx
call fcn.00412be0
mov ecx, eax
movzx eax, word [esp + 0x94]
mov dword [esp + 0x80], edx
cdq
add ecx, eax
mov eax, dword [esp + 0x80]
adc eax, edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x84], ecx
xor eax, eax
mov ecx, 1
mov dword [esp + 0x20], ecx
cmp eax, ebp
ja 0x40ebe9
jb 0x40eba3
cmp ecx, dword [esp + 0x30]
jae 0x40ebe9
mov edx, ecx
mov ebx, eax
shrd edx, ebx, 3
shr ebx, 3
mov ebx, dword [esp + 0x4c]
mov dl, byte [edx + ebx]
and ecx, 7
test byte [esp + ecx + 0xc0114], dl
je 0x40ebcf
add dword [esi + 0x1f0], 1
adc dword [esi + 0x1f4], 0
mov ecx, dword [esp + 0x20]
add ecx, 1
adc eax, 0
mov dword [esp + 0x20], ecx
cmp eax, ebp
jb 0x40eba3
ja 0x40ebe9
cmp ecx, dword [esp + 0x30]
jb 0x40eba3
xor ebx, ebx
mov ebp, 1
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp ebx, dword [esp + 0x34]
ja 0x40f03f
jb 0x40ec10
cmp ebp, dword [esp + 0x30]
jae 0x40f03f
mov edi, edi
mov eax, dword [esi + 8]
cmp dword [eax], 0
jne 0x40f03f
mov ecx, ebp
mov edx, ebx
shrd ecx, edx, 3
shr edx, 3
mov edx, dword [esp + 0x4c]
mov cl, byte [ecx + edx]
mov eax, ebp
and eax, 7
test byte [esp + eax + 0xc0114], cl
jne 0x40ec57
mov edx, dword [esi + 0x22c]
push ebx
push ebp
push str.Inode__I64u_is_not_in_use.
push 0
push 6
call edx
add esp, 0x14
jmp 0x40f01b
add dword [esi + 0x1f8], 1
adc dword [esi + 0x1fc], 0
cmp ebx, dword [esp + 0x14]
jb 0x40ef67
ja 0x40ec7b
cmp ebp, dword [esp + 0x10]
jb 0x40ef67
push esi
call sym.JkDefrag.exe_SlowDown
mov ecx, dword [esp + 0xdc]
mov ebp, dword [esp + 0xd8]
mov eax, dword [esp + 0x24]
add esp, 4
push ecx
push ebp
push 0
push 0x40000
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebx
call fcn.00412e10
add eax, dword [esp + 0x20]
push 0
adc edx, ebx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x40]
push 8
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
push edx
push eax
call fcn.00412be0
cmp dword [esp + 0x14], edx
jb 0x40ece9
ja 0x40ece1
cmp dword [esp + 0x10], eax
jbe 0x40ece9
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
test edi, edi
je 0x40f03f
mov ecx, dword [edi + 8]
sub ecx, dword [esp + 0x28]
mov edx, dword [edi + 0xc]
sbb edx, dword [esp + 0x2c]
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
adc edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0xb8]
push eax
push edx
push ecx
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
push dword [esp + 0xd8]
push ebp
push edx
push eax
call fcn.00412e10
cmp edx, ebx
ja 0x40edf0
jb 0x40ed58
cmp eax, dword [esp + 0x20]
ja 0x40edf0
mov ebp, dword [esp + 0x28]
lea esp, [esp]
mov edx, dword [esi + 0x22c]
push str.Skipping_to_next_extent
push 0
push 6
call edx
mov eax, dword [edi]
and eax, dword [edi + 4]
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ed92
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
sub ecx, ebp
sbb edx, dword [esp + 0x2c]
add dword [esp + 0x18], ecx
adc dword [esp + 0x1c], edx
mov eax, dword [edi + 0xc]
mov ebp, dword [edi + 8]
mov edi, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
test edi, edi
je 0x40edad
mov ecx, dword [edi]
and ecx, dword [edi + 4]
cmp ecx, 0xffffffff
je 0x40ed60
mov edx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
sub edx, ebp
sbb eax, dword [esp + 0x2c]
mov dword [esp + 0x28], ebp
push eax
mov eax, dword [edi + 4]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [esi + 0x22c]
push eax
push ecx
push str.__Extent_Lcn_I64u__RealVcn_I64u__Size_I64u
push 0
push 6
call edx
mov ebp, dword [esp + 0xf8]
add esp, 0x24
jmp 0x40ecf1
cmp dword [esp + 0x14], edx
jb 0x40ee06
ja 0x40edfe
cmp dword [esp + 0x10], eax
jb 0x40ee06
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [edi]
sub eax, dword [esp + 0x18]
mov edx, dword [esp + 0xb8]
mov ecx, dword [edi + 4]
sbb ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0xb8]
push edx
push ecx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xa8], edx
mov edx, dword [esp + 0xd8]
push edx
mov ebx, eax
mov eax, dword [esp + 0x28]
push ebp
push eax
push ecx
call fcn.00412be0
mov ecx, dword [esp + 0x20]
add ebx, eax
mov eax, dword [esp + 0xa8]
adc eax, edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x10]
mov edx, eax
sub edx, ecx
sub eax, ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x14]
sbb eax, dword [esp + 0x24]
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0xb0]
push edx
mov edx, dword [esp + 0xb8]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xb0]
push eax
push ecx
push edx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], 0
call fcn.00412be0
push edx
push eax
mov eax, dword [esp + 0xa8]
push eax
push ebx
call fcn.00412e10
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x78]
imul ebp, ebx
push edx
mov edx, dword [esp + 0x78]
push eax
mov eax, dword [esi + 0x22c]
push ebp
push ecx
push edx
push str.Reading_block_of__I64u_Inodes_from_MFT_into_memory___u_bytes_from_LCN_I64u
push 0
push 6
call eax
mov eax, dword [esp + 0xf4]
add esp, 0x20
imul eax, ebx
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x48]
push edx
mov ecx, dword [esp + 0x48]
mov edx, dword [esi + 0x20]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f115
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x78]
push eax
mov eax, dword [esp + 0x78]
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [esp + 0x44]
xor ebx, ebx
cmp ecx, eax
jne 0x40f115
cmp ebx, edx
jne 0x40f115
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xd8]
mov ebx, ebp
sub ebx, dword [esp + 0x7c]
push ecx
mov edx, ebx
imul edx, eax
add edx, dword [esp + 0x44]
push eax
push edx
lea eax, [esp + 0xb8]
push eax
push esi
call fcn.0040c440
add esp, 0x14
test eax, eax
jne 0x40efc5
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
push ecx
push edx
push ebx
push ebp
push str.The_error_occurred_while_processing_Inode__I64u__max__I64u_
push eax
mov eax, dword [esi + 0x22c]
push 2
call eax
add esp, 0x1c
jmp 0x40f017
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xd8]
imul ebx, eax
add ebx, dword [esp + 0x40]
push ecx
push eax
push ebx
mov ebx, dword [esp + 0x30]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x74]
push edx
mov edx, dword [esp + 0x6c]
push eax
push ecx
push ebx
push ebp
push edx
lea eax, [esp + 0xdc]
push eax
push esi
call fcn.0040dc50
add esp, 0x38
mov ebp, dword [esp + 0x20]
add ebp, 1
adc ebx, 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp ebx, dword [esp + 0x34]
jb 0x40ec10
ja 0x40f03f
cmp ebp, dword [esp + 0x30]
jb 0x40ec10
lea eax, [esp + 0x8c]
push eax
call fcn.00411e0a
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
add esp, 4
xor ebp, ebp
push ebp
push 0x3e8
push ecx
push edx
call fcn.00412be0
mov ebx, eax
movzx eax, word [esp + 0x94]
mov edi, edx
cdq
add ebx, eax
mov eax, dword [esp + 0x88]
adc edi, edx
cmp edi, eax
jl 0x40f0cf
jg 0x40f093
cmp ebx, dword [esp + 0x84]
jbe 0x40f0cf
sub ebx, dword [esp + 0x84]
mov ecx, dword [esp + 0x30]
push ebp
sbb edi, eax
mov eax, dword [esp + 0x38]
push 0x3e8
push eax
push ecx
call fcn.00412be0
push edi
push ebx
push edx
push eax
call fcn.00412e10
push edx
mov edx, dword [esi + 0x22c]
push eax
push str.__Analysis_speed:__I64u_items_per_second
push ebp
push 2
call edx
add esp, 0x14
mov eax, dword [esp + 0x40]
push eax
call fcn.00412c14
mov ecx, dword [esp + 0x50]
push ecx
call fcn.00412c14
mov edx, dword [esi + 8]
add esp, 8
cmp dword [edx], ebp
je 0x40f18c
mov eax, dword [esp + 0x50]
push eax
call fcn.00412c14
mov ecx, dword [esi + 0x110]
push ecx
call sym.JkDefrag.exe_DeleteItemTree
add esp, 8
mov dword [esi + 0x110], ebp
jmp 0x40eab1
push 0x200
lea ecx, [esp + 0xc0120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add eax, 0xffffffff
lea edx, [esp + 0xc0128]
push edx
mov edx, dword [esi + 0x22c]
adc ecx, 0xffffffff
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x3c]
push eax
push ecx
push str.Error_while_reading_Inodes__I64u_to__I64u:__s
push 0
push 2
call edx
mov eax, dword [esp + 0x6c]
push eax
call fcn.00412c14
mov ecx, dword [esp + 0x80]
push ecx
call fcn.00412c14
mov edx, dword [esi + 0x110]
push edx
call sym.JkDefrag.exe_DeleteItemTree
add esp, 0x38
jmp 0x40eaa7
mov edx, dword [esi + 0x110]
push edx
call sym.JkDefrag.exe_TreeSmallest
mov esi, dword [esp + 0x54]
add esp, 4
cmp eax, ebp
je 0x40f1d2
mov edi, 5
jmp 0x40f1b0
mov ecx, dword [eax + 0x50]
mov edx, dword [esi + ecx*4]
mov dword [eax + 0x58], edx
cmp ecx, edi
jne 0x40f1c5
cmp dword [eax + 0x54], ebp
jne 0x40f1c5
mov dword [eax + 0x58], ebp
push eax
call sym.JkDefrag.exe_TreeNext
add esp, 4
cmp eax, ebp
jne 0x40f1b0
push esi
call fcn.00412c14
add esp, 4
mov eax, 1
jmp 0x40eab3
push str.Fatal_error__cannot_process_this_disk.
mov eax, dword [esi + 0x22c]
push ebx
push 2
call eax
push edi
call fcn.00412c14
mov ecx, dword [esi + 0x110]
push ecx
call sym.JkDefrag.exe_DeleteItemTree
add esp, 0x14
mov dword [esi + 0x110], ebx
jmp 0x40eab1
push 0x200
lea edx, [esp + 0xc0120]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov ecx, dword [esi + 0x22c]
lea eax, [esp + 0xc0128]
push eax
push str.Error_while_reading_first_MFT_record:__s
push ebx
push 2
call ecx
push edi
call fcn.00412c14
add esp, 0x20
jmp 0x40eab1
push 0x200
lea edx, [esp + 0xc011c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov ecx, dword [esi + 0x22c]
lea eax, [esp + 0xc0124]
push eax
push str.Error_while_reading_bootblock:__s
push ebx
push 2
call ecx
push edi
call fcn.00412c14
mov ecx, dword [esp + 0xc0538]
add esp, 0x20
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00411002
add esp, 0xc0510
ret