Function at 0x404f90
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44f66c
push eax
mov al, byte [0x46bd79]
mov dword fs:[0], esp
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp al, bl
push ebp
push esi
push edi
mov dword [0x46bd94], ebx
mov dword [0x46bd98], ebx
mov dword [0x46bd9c], ebx
je 0x404fee
call fcn.00446e5a
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x1c]
push ebx
push str.Error
push str.Cant_start_a_second_operation_while_one_is_running:_recursion_error_nThis_is_probably_a_bug..._Report_it
call fcn.00432ba1
xor eax, eax
jmp 0x405546
mov esi, 0x46bd14
mov eax, dword [esi]
cmp eax, ebx
je 0x405002
push eax
call fcn.00404e60
add esp, 4
mov dword [esi], ebx
sub esi, 4
cmp esi, 0x46bb88
jge 0x404ff3
mov esi, 0x46bd1c
mov eax, dword [esi]
cmp eax, ebx
je 0x405023
push eax
call fcn.00404e60
add esp, 4
add esi, 4
cmp esi, 0x46bd44
jl 0x405014
mov eax, dword [esp + 0x16c]
xor ecx, ecx
mov dword [0x46bd18], ebx
mov dword [0x46bd6c], ebx
mov dword [0x46bd70], ebx
mov cl, byte [eax]
push ecx
call fcn.00402950
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x40553e
cmp edi, 0xffffffff
je 0x40553e
cmp dword [0x46b14c], 4
jb 0x40509b
cmp dword [0x46b158], 2
jne 0x40509b
mov edx, dword [0x46bb84]
cmp byte [edx + 0x141], bl
jne 0x40509b
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00402490
cmp eax, ebx
je 0x40509b
call fcn.004028e0
mov ecx, dword [0x46bb84]
cmp byte [ecx + 0x140], bl
jne 0x40541e
push ebx
push ebx
push edi
call fcn.004046e0
add esp, 0xc
cmp eax, ebx
mov dword [0x46bb88], eax
jne 0x4050e8
push str.mftrecptr_MASTER_FILE_TABLE_NUMBER____0
push 0x10ee
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x4050e3
push eax
call fcn.0041c4fb
mov eax, dword [0x46bb88]
push ebx
push ebx
push 0x80
push eax
push edi
call fcn.00404100
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x405107
xor eax, eax
mov dword [esp + 0x18], ebx
jmp 0x40511f
cmp byte [esi + 8], bl
jne 0x405115
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], ebx
jmp 0x40511f
mov edx, dword [esi + 0x34]
mov eax, dword [esi + 0x30]
mov dword [esp + 0x18], edx
mov ecx, dword [0x46bb84]
xor edx, edx
mov dword [0x46bd6c], eax
div dword [ecx + 0x2c]
push esi
mov dword [0x46bd70], eax
call fcn.00403700
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
cmp byte [eax], bl
mov dword [esp + 0x164], ebx
je 0x4051a2
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00403480
add esp, 0xc
test al, al
je 0x4051a2
cmp dword [esp + 0x58], ebx
jne 0x4051ce
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
cdq
add ebp, eax
adc ecx, edx
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x44], ebp
cmp byte [ecx], bl
jne 0x405164
mov edx, dword [0x46bb88]
push ebx
push ebx
push 0xb0
push edx
push edi
call fcn.00404100
mov ebp, eax
push ebx
push ebp
call fcn.00403d50
add esp, 0x1c
cmp ebp, ebx
jne 0x4051eb
mov dword [esp + 0x14], ebx
xor ecx, ecx
jmp 0x405205
push 0x10000
push str.Fatal_Error
push str.MFT_not_understood__has_skipped_clusters
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0041c4fb
cmp byte [ebp + 8], bl
jne 0x4051fb
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
xor ecx, ecx
jmp 0x405205
mov ecx, dword [ebp + 0x30]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x34]
mov eax, dword [0x46bd6c]
mov esi, dword [0x46bb84]
xor edx, edx
div dword [esi + 0x30]
add eax, 7
shr eax, 3
cmp ebx, ecx
jl 0x405249
jg 0x405227
cmp eax, dword [esp + 0x14]
jbe 0x405249
push str.__mftsize_Vcb__BytesPerFileRecordSegment7__8__Get_Attr_Datasize_attrptr_
push 0x1115
push str.E:_srcundelete_ntfs.cpp
call fcn.004025a0
add esp, 0xc
cmp eax, 1
jne 0x405249
push eax
call fcn.0041c4fb
cmp ebp, ebx
jne 0x405255
xor ecx, ecx
mov dword [esp + 0x18], ebx
jmp 0x40526d
cmp byte [ebp + 8], bl
jne 0x405263
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ebx
jmp 0x40526d
mov edx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x30]
mov dword [esp + 0x18], edx
mov esi, dword [0x46bb84]
mov eax, dword [0x46bd6c]
xor edx, edx
div dword [esi + 0x30]
push 1
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
push ebx
push ebx
push ebp
push edi
call fcn.004037c0
mov cl, byte [esp + 0x2f]
add esp, 0x1c
mov ebp, eax
mov byte [esp + 0x30], cl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x16c], 1
call fcn.00405910
mov eax, esi
mov ecx, esi
shr eax, 1
shr esi, 2
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
lea edx, [esp + 0x30]
mov dword [0x46b200], ecx
push edx
mov ecx, 0x46b210
mov byte [esp + 0x168], 2
mov dword [0x46b204], ebp
mov dword [0x46b208], eax
mov dword [0x46b20c], esi
call fcn.00405770
mov eax, dword [esp + 0x34]
push eax
mov byte [esp + 0x168], bl
mov dword [esp + 0x28], ebx
call fcn.004353f0
push ebx
push 3
push edi
call fcn.004046e0
push ebx
push ebx
push 0x60
push eax
push edi
mov dword [0x46bb94], eax
call fcn.00404100
mov esi, eax
add esp, 0x24
cmp esi, ebx
jne 0x405340
xor eax, eax
xor ecx, ecx
jmp 0x405352
cmp byte [esi + 8], bl
jne 0x40534c
mov eax, dword [esi + 0x10]
xor ecx, ecx
jmp 0x405352
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 1
push ecx
push eax
push ebx
push ebx
push esi
push edi
call fcn.004037c0
add esp, 0x1c
cmp esi, ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
jne 0x405372
xor eax, eax
xor edx, edx
jmp 0x405384
cmp byte [esi + 8], bl
jne 0x40537e
mov eax, dword [esi + 0x10]
xor edx, edx
jmp 0x405384
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov ecx, 1
call fcn.0041c950
push eax
lea ecx, [esp + 0x60]
push ebp
push ecx
call fcn.0041cb7a
add esp, 0xc
cmp esi, ebx
jne 0x4053a7
xor eax, eax
xor esi, esi
jmp 0x4053b9
cmp byte [esi + 8], bl
jne 0x4053b3
mov eax, dword [esi + 0x10]
xor esi, esi
jmp 0x4053b9
mov eax, dword [esi + 0x30]
mov esi, dword [esi + 0x34]
mov ecx, 1
mov edx, esi
call fcn.0041c950
mov edx, dword [0x46bb94]
push ebx
push ebx
push 0x70
push edx
push edi
mov byte [esp + eax + 0x70], bl
call fcn.00404100
add esp, 0x14
cmp eax, ebx
jne 0x4053e7
xor ecx, ecx
xor edx, edx
jmp 0x4053f9
cmp byte [eax + 8], bl
jne 0x4053f3
mov ecx, dword [eax + 0x10]
xor edx, edx
jmp 0x4053f9
mov ecx, dword [eax + 0x30]
mov edx, dword [eax + 0x34]
push 1
push edx
push ecx
push ebx
push ebx
push eax
push edi
call fcn.004037c0
push edi
mov dword [esp + 0x3c], eax
call fcn.00403390
add esp, 0x20
mov dword [esp + 0x164], 0xffffffff
lea eax, [esp + 0x40]
push eax
push edi
mov dword [esp + 0x48], ebx
call fcn.00402e10
mov ecx, dword [0x46bb84]
mov eax, dword [ecx + 0x10]
mov dl, byte [esp + 0x1b]
mov ecx, eax
mov esi, eax
mov byte [esp + 0x38], dl
mov edx, dword [esp + 0x48]
shr ecx, 1
shr eax, 2
add esp, 8
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [0x46b1ec], eax
lea eax, [esp + 0x30]
mov dword [0x46b1e8], ecx
push eax
mov ecx, 0x46b1f0
mov dword [esp + 0x168], 3
mov dword [0x46b1e0], esi
mov dword [0x46b1e4], edx
call fcn.00405770
mov ecx, dword [esp + 0x34]
push ecx
mov dword [esp + 0x168], 0xffffffff
mov dword [esp + 0x28], ebx
call fcn.004353f0
add esp, 4
mov ecx, 0x46b1e0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00402720
mov esi, dword [0x46bb84]
mov ecx, dword [esi + 0x10]
mov ebp, dword [esi + 0x18]
lea edx, [esi + 0x18]
sub ecx, eax
mov al, byte [esi + 0x141]
sub ecx, ebp
cmp al, bl
je 0x4054fe
mov eax, ebp
or eax, dword [edx + 4]
jne 0x4054fe
mov dword [edx], ecx
mov dword [edx + 4], ebx
mov esi, dword [0x46bb84]
jmp 0x40551a
cmp ecx, ebx
jbe 0x40551a
mov ecx, dword [0x46b1e4]
mov edx, dword [ecx]
shr edx, 0xf
test dl, 1
jne 0x40551a
xor eax, eax
inc eax
cmp eax, 0x10
jl 0x405514
cmp byte [esi + 0x140], bl
jne 0x405533
push ebx
push 5
push edi
call fcn.004046e0
add esp, 0xc
mov dword [0x46bb9c], eax
mov byte [0x46bd79], 1
mov eax, edi
jmp 0x405546
call fcn.004028e0
or eax, 0xffffffff
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x158
ret