Function at 0x48e2a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.00476ab0
test byte [ebp + 0x14], 1
jne 0x48e310
call fcn.00476ab0
mov edi, dword [0x56161c]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x48e2f4
push 0xc08
call fcn.004bb5d5
add esp, 4
mov esi, eax
push 0xc08
push 0
push esi
call fcn.004c13c0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push str.Invalid_FS_type_in_ntfs_open
mov dword [esi], 0x8000006
call fcn.004768f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x1c8
call fcn.00479b80
mov esi, eax
test esi, esi
je 0x48f1ed
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x9c]
push eax
call ebx
lea eax, [esi + 0xb8]
push eax
call ebx
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xb4], 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov dword [esi + 4], ecx
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], str.Cluster
mov dword [esi + 0x70], 1
mov dword [esi], 0x10101010
mov byte [esi + 0x140], 0
mov dword [esi + 0x144], 0
mov dword [esi + 0x160], 0
mov ecx, dword [ecx + 0x14]
lea eax, [ecx + 0x1ff]
div ecx
mov edi, eax
imul edi, ecx
mov ecx, edi
call fcn.00479b80
mov dword [esi + 0x118], eax
test eax, eax
je 0x48f1cb
push edi
push 0
push 0
mov edx, eax
mov ecx, esi
call fcn.00491170
add esp, 0xc
cmp eax, edi
je 0x48e3f4
test eax, eax
js 0x48e3dd
call fcn.00476ab0
mov ecx, 0x8000004
call fcn.00476850
push str.ntfs_open
push str._s:_Error_reading_boot_sector.
call fcn.00476950
add esp, 8
jmp 0x48f1cb
mov edx, dword [esi + 0x118]
lea ebx, [esi + 0x98]
push 0xaa55
add edx, 0x1fe
mov ecx, ebx
call fcn.00490d90
add esp, 4
test al, al
je 0x48e45d
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
push str.Not_a_NTFS_file_system__magic_
call fcn.004768f0
add esp, 4
cmp dword [0x561618], 0
je 0x48f1cb
push str.ntfs_open:_Incorrect_NTFS_magic_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.004bea01
add esp, 8
jmp 0x48f1cb
cmp dword [ebx], 1
mov edx, dword [esi + 0x118]
jne 0x48e472
movzx ecx, byte [edx + 0xc]
movzx eax, byte [edx + 0xb]
jmp 0x48e47a
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xc]
shl ecx, 8
add ecx, eax
mov word [esi + 0x12c], cx
test cx, cx
je 0x48f180
movzx ecx, cx
mov eax, ecx
and eax, 0x800001ff
jns 0x48e4a2
dec eax
or eax, 0xfffffe00
inc eax
jne 0x48f180
mov al, byte [edx + 0xd]
cmp al, 1
je 0x48e514
cmp al, 2
je 0x48e514
cmp al, 4
je 0x48e514
cmp al, 8
je 0x48e514
cmp al, 0x10
je 0x48e514
cmp al, 0x20
je 0x48e514
cmp al, 0x40
je 0x48e514
cmp al, 0x80
je 0x48e514
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0xd]
push eax
push str.Not_a_NTFS_file_system__invalid_cluster_size__d_
call fcn.004768f0
add esp, 8
cmp dword [0x561618], 0
je 0x48f1cb
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0xd]
push eax
push str.ntfs_open:_invalid_cluster_size:__d_n
jmp 0x48f1ba
movzx eax, al
imul eax, ecx
mov dword [esi + 0x128], eax
cmp dword [ebx], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov eax, dword [esi + 0x118]
jne 0x48e5d7
movzx eax, byte [eax + 0x2f]
cdq
mov ecx, eax
mov edi, edx
mov eax, dword [esi + 0x118]
shld edi, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x2e]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2d]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2c]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2b]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2a]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x29]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x28]
jmp 0x48e66c
movzx eax, byte [eax + 0x28]
cdq
mov ecx, eax
mov edi, edx
mov eax, dword [esi + 0x118]
shld edi, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x29]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2a]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2b]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2c]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2d]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x2e]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x2f]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
movzx eax, byte [eax + 0xd]
cdq
push edx
push eax
push edi
push ecx
call fcn.004c5590
mov dword [esi + 0x30], eax
mov edi, eax
or eax, edx
mov dword [esi + 0x34], edx
jne 0x48e6cd
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
push str.Not_a_NTFS_file_system__volume_size_is_0_
call fcn.004768f0
add esp, 4
cmp dword [0x561618], 0
je 0x48f1cb
push str.ntfs_open:_invalid_volume_size:_0_n
jmp 0x48e447
mov ecx, edi
add ecx, 0xffffffff
mov dword [esi + 0x48], ecx
adc edx, 0xffffffff
mov dword [esi + 0x40], ecx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x128]
mov dword [esi + 0x50], eax
push 0
mov eax, dword [edx + 0x14]
push dword [esi + 0x50]
mov dword [esi + 0x54], eax
mov ecx, dword [edx + 8]
sub ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
sbb eax, dword [ebp + 0x10]
push eax
push ecx
call fcn.004c1450
cmp edx, dword [esi + 0x34]
ja 0x48e722
jb 0x48e716
cmp eax, edi
jae 0x48e722
add eax, 0xffffffff
mov dword [esi + 0x48], eax
adc edx, 0xffffffff
mov dword [esi + 0x4c], edx
mov edi, dword [esi + 0x118]
mov edx, 1
mov al, byte [edi + 0x40]
test al, al
jle 0x48e740
movsx eax, al
imul eax, dword [esi + 0x128]
jmp 0x48e749
movsx ecx, al
mov eax, edx
neg ecx
shl eax, cl
mov dword [esi + 0x130], eax
test eax, eax
je 0x48f151
test eax, 0x1ff
jne 0x48f151
mov al, byte [edi + 0x44]
test al, al
jle 0x48e77b
movsx eax, al
imul eax, dword [esi + 0x128]
mov dword [esi + 0x134], eax
jmp 0x48e788
movsx ecx, al
neg ecx
shl edx, cl
mov dword [esi + 0x134], edx
mov eax, dword [esi + 0x134]
test eax, eax
je 0x48f115
test eax, 0x1ff
jne 0x48f115
cmp dword [ebx], 1
jne 0x48e854
movzx eax, byte [edi + 0x37]
cdq
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x36]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x31]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x30]
jmp 0x48e8f9
movzx eax, byte [edi + 0x30]
cdq
mov ecx, eax
mov eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x31]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x36]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
shld eax, ecx, 8
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 0x37]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esp + 0xc]
adc eax, edx
push eax
push ecx
push 0
push dword [esi + 0x128]
call fcn.004c2160
mov dword [esi + 0x138], eax
mov dword [esi + 0x13c], edx
cmp dword [ebx], 1
jne 0x48e9c3
movzx eax, byte [edi + 0x37]
cdq
mov ecx, eax
mov edi, edx
mov eax, dword [esi + 0x118]
shld edi, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x36]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x31]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x30]
jmp 0x48ea58
movzx eax, byte [edi + 0x30]
cdq
mov ecx, eax
mov edi, edx
mov eax, dword [esi + 0x118]
shld edi, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x31]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc edi, edx
shld edi, ecx, 8
movzx eax, byte [eax + 0x36]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x37]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
adc edi, edx
cmp edi, dword [esi + 0x44]
jb 0x48eaa5
ja 0x48ea72
cmp ecx, dword [esi + 0x40]
jbe 0x48eaa5
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
push str.Not_a_NTFS_file_system__invalid_starting_MFT_clust_
call fcn.004768f0
add esp, 4
cmp dword [0x561618], 0
je 0x48f1cb
push str.ntfs_open:_invalid_starting_MFT_cluster_n
jmp 0x48e447
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x148]
push eax
mov dword [esi + 0xdc], 0x489400
mov dword [esi + 0xd4], 0x4891b0
mov dword [esi + 0xd8], 0x489170
mov dword [esi + 0xe4], 0x48e150
mov dword [esi + 0xe8], 0x4875c0
mov dword [esi + 0xe0], 0x487660
mov dword [esi + 0xf0], 0x4931f0
mov dword [esi + 0x100], 0x489980
mov dword [esi + 0x108], 0x489920
mov dword [esi + 0xec], 0x48aca0
mov dword [esi + 0x10c], 0x48e180
mov dword [esi + 0x104], 0x494400
mov dword [esi + 0x110], fcn.004889d0
mov dword [esi + 0xf8], 0x48e0f0
mov dword [esi + 0xfc], 0x48e0f0
mov dword [esi + 0xf4], 0x48e0f0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
call edi
lea eax, [esi + 0x178]
push eax
call edi
lea eax, [esi + 0x194]
push eax
call edi
mov dword [esi + 0x18], 5
mov ecx, esi
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x10
mov dword [esi + 0x2c], 0
push 0
push 0
mov dword [esi + 0x124], 0
mov byte [esi + 0x140], 1
call fcn.004795e0
add esp, 8
mov dword [esi + 0x120], eax
test eax, eax
jne 0x48ebe3
cmp dword [0x561618], eax
je 0x48f1cb
call fcn.00476630
push eax
push str.ntfs_open:_Error_opening__MFT___s__n
jmp 0x48f1ba
mov ecx, dword [eax + 8]
mov edx, 0x80
mov ecx, dword [ecx + 0xc8]
call fcn.0047fea0
mov dword [esi + 0x124], eax
test eax, eax
jne 0x48ec35
mov ecx, dword [esi + 0x120]
call fcn.00479590
push str.___Data_Attribute_not_found_in__MFT
call fcn.004769b0
add esp, 4
cmp dword [0x561618], 0
je 0x48f1cb
call fcn.00476630
push eax
push str.ntfs_open:_Data_attribute_not_found_in__MFT___s__n
jmp 0x48f1ba
push 0
push dword [esi + 0x130]
push dword [eax + 0x24]
push dword [eax + 0x20]
call fcn.004c1450
add eax, 1
mov ecx, eax
mov dword [esi + 0x10], eax
adc edx, 0
add ecx, 0xffffffff
mov eax, edx
mov dword [esi + 0x14], edx
adc eax, 0xffffffff
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov byte [esi + 0x140], 0
mov dword [esi + 0x94], 0
jmp 0x48ec80
mov ecx, dword [esi + 0x94]
mov eax, dword [esi + 0x118]
mov al, byte [eax + ecx + 0x48]
mov byte [ecx + esi + 0x74], al
inc dword [esi + 0x94]
cmp dword [esi + 0x94], 8
jb 0x48ec80
mov ecx, esi
call fcn.00487e60
test al, al
je 0x48ecd6
mov ecx, dword [esi + 0x120]
call fcn.00479590
cmp dword [0x561618], 0
je 0x48f1cb
call fcn.00476630
push eax
push str.ntfs_open:_Error_loading_file_system_version____s__n
jmp 0x48f1ba
mov ecx, esi
call fcn.00487a80
test al, al
je 0x48ed09
mov ecx, dword [esi + 0x120]
call fcn.00479590
cmp dword [0x561618], 0
je 0x48f1cb
call fcn.00476630
push eax
push str.ntfs_open:_Error_loading_block_bitmap___s__n
jmp 0x48f1ba
mov ecx, esi
call fcn.00488dc0
test al, al
je 0x48ed3c
mov ecx, dword [esi + 0x120]
call fcn.00479590
cmp dword [0x561618], 0
je 0x48f1cb
call fcn.00476630
push eax
push str.ntfs_open:_Error_loading_Secure_Info___s__n
jmp 0x48f1ba
cmp dword [0x561618], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x190], 0
mov dword [esi + 0x1c4], 0xffffffff
je 0x48f10c
mov eax, dword [ebx]
mov ebx, dword [esi + 0x118]
mov dword [esp + 0xc], eax
cmp eax, 1
jne 0x48ede5
movzx eax, byte [ebx + 0x4f]
cdq
mov ecx, eax
mov edi, edx
movzx eax, byte [ebx + 0x4e]
shld edi, ecx, 8
cdq
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4d]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4c]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4b]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4a]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x49]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x48]
jmp 0x48ee50
movzx eax, byte [ebx + 0x48]
cdq
mov ecx, eax
mov edi, edx
movzx eax, byte [ebx + 0x49]
shld edi, ecx, 8
cdq
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4a]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4b]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4c]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4d]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4e]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 0x4f]
adc edi, edx
cdq
shld edi, ecx, 8
shl ecx, 8
add ecx, eax
adc edi, edx
cmp dword [esp + 0xc], 1
jne 0x48ee6f
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xb]
jmp 0x48ee77
movzx edx, byte [ebx + 0xb]
movzx eax, byte [ebx + 0xc]
push edi
shl edx, 8
add edx, eax
movzx eax, byte [ebx + 0xd]
push ecx
push eax
movzx eax, dx
push eax
push str.ssize:__hu_csize:__d_serial:__llx_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
mov ebx, dword [esi + 0x118]
add esp, 0x18
cmp dword [esi + 0x98], 1
jne 0x48ef19
movzx eax, byte [ebx + 0x3f]
cdq
mov edi, eax
mov ecx, edx
movzx eax, byte [ebx + 0x3e]
shld ecx, edi, 8
cdq
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3d]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3c]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3b]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3a]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x39]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x38]
jmp 0x48ef84
movzx eax, byte [ebx + 0x38]
cdq
mov edi, eax
mov ecx, edx
movzx eax, byte [ebx + 0x39]
shld ecx, edi, 8
cdq
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3a]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3b]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3c]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3d]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3e]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
movzx eax, byte [ebx + 0x3f]
adc ecx, edx
cdq
shld ecx, edi, 8
shl edi, 8
add edi, eax
adc ecx, edx
cmp dword [esi + 0x98], 1
mov dword [esp + 0xc], ecx
jne 0x48f03d
movzx eax, byte [ebx + 0x37]
cdq
mov ecx, eax
mov ebx, edx
mov eax, dword [esi + 0x118]
shld ebx, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x36]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x31]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x30]
jmp 0x48f0d2
movzx eax, byte [ebx + 0x30]
cdq
mov ecx, eax
mov ebx, edx
mov eax, dword [esi + 0x118]
shld ebx, ecx, 8
shl ecx, 8
movzx eax, byte [eax + 0x31]
cdq
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x32]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x33]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x34]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x35]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
adc ebx, edx
shld ebx, ecx, 8
movzx eax, byte [eax + 0x36]
cdq
shl ecx, 8
add ecx, eax
mov eax, dword [esi + 0x118]
movzx eax, byte [eax + 0x37]
push dword [esp + 0xc]
adc ebx, edx
cdq
shld ebx, ecx, 8
push edi
shl ecx, 8
add ecx, eax
adc ebx, edx
push ebx
push ecx
push dword [esi + 0x30]
push dword [esi + 0x134]
push dword [esi + 0x130]
push str.mft_rsize:__d_idx_rsize:__d_vol:__d_mft:__llu_mft_mir:__llu_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.00479b20
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
push dword [esi + 0x134]
push str.Not_a_NTFS_file_system__invalid_idx_record_size__d_
call fcn.004768f0
add esp, 8
cmp dword [0x561618], 0
je 0x48f1cb
push dword [esi + 0x134]
push str.ntfs_open:_invalid_idx_record_size__d_n
jmp 0x48f1ba
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
push str.Not_a_NTFS_file_system__invalid_MFT_entry_size_
call fcn.004768f0
add esp, 4
cmp dword [0x561618], 0
je 0x48f1cb
push str.ntfs_open:_invalid_MFT_entry_size_n
jmp 0x48e447
call fcn.00476ab0
mov ecx, 0x800000a
call fcn.00476850
movzx eax, word [esi + 0x12c]
push eax
push str.Not_a_NTFS_file_system__invalid_sector_size__d__
call fcn.004768f0
add esp, 8
cmp dword [0x561618], 0
je 0x48f1cb
movzx eax, word [esi + 0x12c]
push eax
push str.ntfs_open:_invalid_sector_size:__d_n
call fcn.004bdd06
add eax, 0x40
push eax
call fcn.004bea01
add esp, 0xc
mov dword [esi], 0
mov eax, dword [esi + 0x118]
test eax, eax
je 0x48f1e4
push eax
call fcn.004bae83
add esp, 4
push esi
call fcn.004bae83
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret