Function at 0x433a50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
cmp edi, ebx
jne 0x433aa6
call fcn.004dc440
push str.ntfs_inode_add_attrlist
push 0x548560
push ebx
push 0x43d
mov dword [eax], 0x16
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x18
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
test byte [edi + 0x10], 2
jne 0x43411f
cmp dword [edi + 0x20], ebx
jne 0x43411f
push ebp
push 0x20
call fcn.004d5c5c
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x433af8
push ebx
push 0x20
push str.Failed_to_malloc__lld_bytes
push ebx
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425280
add esp, 0x1c
call fcn.004dc440
mov ebx, dword [eax]
jmp 0x4340e8
mov eax, dword [edi + 8]
mov dword [ebp], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], 1
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
lea ecx, [ecx]
cmp dword [ebp], ebx
je 0x433c6a
cmp dword [ebp + 4], ebx
je 0x433c6a
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x433b40
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x433b59
test byte [eax + 0x10], 2
je 0x433b59
push ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429c90
add esp, 0x24
jmp 0x433b68
push ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004299a0
add esp, 0x1c
cmp eax, ebx
jne 0x433c9c
mov eax, dword [ebp + 4]
cmp dword [eax], 0x20
je 0x433ce5
movzx ebx, byte [eax + 9]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ebx, [ebx + ebx + 0x21]
and ebx, 0xfffffff8
add eax, ebx
push eax
push edx
mov dword [esp + 0x18], eax
call fcn.004df11f
mov edi, eax
add esp, 8
test edi, edi
je 0x433d12
sub eax, dword [esp + 0x14]
push ebx
add esi, eax
push 0
push esi
mov dword [esp + 0x20], edi
call fcn.004d5720
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esi], edx
mov eax, dword [ebp + 4]
movzx cx, byte [eax + 9]
add cx, cx
add cx, 0x21
mov edx, 0xfff8
and cx, dx
mov word [esi + 4], cx
mov eax, dword [ebp + 4]
mov cl, byte [eax + 9]
mov byte [esi + 6], cl
mov byte [esi + 7], 0x1a
mov edx, dword [ebp + 4]
add esp, 0xc
cmp byte [edx + 8], 0
je 0x433c07
mov eax, edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0xc], edx
jmp 0x433c0f
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
movzx eax, word [eax + 0x10]
mov ebx, dword [ecx]
movzx ecx, word [ecx + 4]
cdq
xor edx, edx
shl eax, 0x10
or eax, ecx
or edx, ebx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov edx, dword [ebp + 4]
mov ax, word [edx + 0xe]
mov word [esi + 0x18], ax
mov eax, dword [ebp + 4]
movzx ecx, byte [eax + 9]
movzx edx, word [eax + 0xa]
add ecx, ecx
push ecx
add edx, eax
push edx
add esi, 0x1a
push esi
call fcn.004d57a0
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea esi, [edi + eax]
mov edi, dword [esp + 0x20]
xor ebx, ebx
jmp 0x433b20
call fcn.004dc440
push str.ntfs_attr_lookup
push 0x548560
push ebx
push 0xcfa
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_lookup
mov eax, 0x100
call fcn.00425280
add esp, 0x18
call fcn.004dc440
cmp dword [eax], 2
je 0x433d46
call fcn.004dc440
mov ebx, dword [eax]
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push eax
push str.ntfs_inode_add_attrlist
push str._s:_Attribute_lookup_failed__inode__lld
push 0
push 0x47f
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x20
jmp 0x4340df
push str.Attribute_list_already_present
push 0
push 0x456
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
mov ebx, 5
call fcn.00425280
add esp, 0x14
jmp 0x4340df
call fcn.004dc440
mov ecx, dword [esp + 0x10]
mov ebx, dword [eax]
push ecx
push str.Failed_to_realloc__d_bytes
push 0
push 0x461
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x4340df
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
or dword [edi + 0x10], 6
mov eax, dword [edi + 8]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], edx
mov ecx, dword [eax + 0x1c]
sub ecx, dword [eax + 0x18]
cmp ecx, 0x18
jae 0x433da4
push 0x18
push edi
call fcn.00434160
add esp, 8
test eax, eax
je 0x433da4
call fcn.004dc440
mov ebx, dword [eax]
push str.Failed_to_free_space_for_attrlist
push 0
push 0x491
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
jmp 0x434026
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x433db3
cmp dword [eax + 0xbc], ebx
jne 0x433dc8
call fcn.004dc440
mov dword [eax], 0x16
call fcn.004dc440
jmp 0x433eec
push 0x20
call fcn.004d5c5c
mov ebx, eax
xor ecx, ecx
add esp, 4
cmp ebx, ecx
jne 0x433e01
push ecx
push 0x20
push str.Failed_to_malloc__lld_bytes
push ecx
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425280
add esp, 0x1c
jmp 0x433eec
mov eax, dword [edi + 8]
push ebx
push ecx
push ecx
push ecx
mov dword [ebx], eax
movzx edx, word [eax + 0x14]
push ecx
push ecx
add edx, eax
push 0x20
mov dword [ebx + 4], edx
mov dword [ebx + 8], 1
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
call fcn.004299a0
add esp, 0x1c
test eax, eax
jne 0x433e3e
lea esi, [eax + 0x11]
jmp 0x433e6d
call fcn.004dc440
cmp dword [eax], 2
je 0x433e4f
mov esi, 5
jmp 0x433e6d
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov ecx, 0x18
call fcn.0042a7a0
test eax, eax
je 0x433e7f
call fcn.004dc440
mov esi, dword [eax]
mov edi, dword [esp + 0x20]
push ebx
call fcn.004d5b05
add esp, 4
call fcn.004dc440
mov dword [eax], esi
jmp 0x433eec
mov eax, edi
sub eax, esi
xor ecx, ecx
mov dword [esp + 0x18], eax
xor eax, eax
push ecx
mov word [edi + 0xa], ax
mov word [edi + 0xc], cx
mov dword [edi], 0x20
mov dword [edi + 4], 0x18
mov byte [edi + 8], 0
mov byte [edi + 9], 0
mov dx, word [esi + 0x28]
push ecx
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x18]
mov eax, 0x18
push ecx
mov word [edi + 0xe], dx
mov word [edi + 0x14], ax
call fcn.004d5720
mov eax, dword [esp + 0x2c]
mov byte [edi + 0x16], 0
inc word [esi + 0x28]
call fcn.00432740
push ebx
call fcn.004d5b05
mov edi, dword [esp + 0x30]
add esp, 0x10
cmp dword [esp + 0x18], 0
jge 0x433f1b
call fcn.004dc440
mov ebx, dword [eax]
push str.Couldnt_add__ATTRIBUTE_LIST_to_MFT
push 0
push 0x49a
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
jmp 0x434026
push 0
push 0x5784c0
push 0x20
mov eax, edi
call fcn.00425cb0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x433f5f
call fcn.004dc440
mov ebx, dword [eax]
push str.Failed_to_open_just_added__ATTRIBUTE_LIST
push esi
push 0x4a2
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
jmp 0x433fa7
mov eax, dword [esp + 0x10]
cdq
push edx
push eax
mov edx, esi
call fcn.0042e460
add esp, 8
test eax, eax
je 0x434107
call fcn.004dc440
mov ebx, dword [eax]
push str.Failed_to_resize_just_added__ATTRIBUTE_LIST
push 0
push 0x4a7
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
call fcn.00426030
and dword [edi + 0x10], 0xfffffffd
mov eax, ebp
mov dword [edi + 0x1c], 0
call fcn.0042a3c0
push ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x20
call fcn.0042a250
add esp, 0x24
test eax, eax
jne 0x433ff1
push ebp
call fcn.0042af00
add esp, 4
test eax, eax
je 0x434014
push str.Rollback_failed_to_remove_attrlist
push 0
push 0x4b9
jmp 0x433ffd
push str.Rollback_failed_to_find_attrlist
push 0
push 0x4bb
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
or dword [edi + 0x10], 2
mov dword [edi + 0x1c], edx
mov dword [edi + 0x18], eax
mov eax, ebp
call fcn.0042a3c0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [ecx + esi]
mov dword [esp + 0x20], edx
cmp esi, edx
jae 0x4340d3
mov eax, dword [esi + 0x10]
movzx ecx, word [esi + 0x14]
cmp eax, dword [edi]
jne 0x434054
cmp ecx, dword [edi + 4]
je 0x4340c5
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
movzx ecx, byte [esi + 6]
push ebp
push 0
push 0
push edx
push eax
mov eax, dword [esi]
push 0
push ecx
lea edx, [esi + 0x1a]
push edx
push eax
call fcn.0042a250
add esp, 0x24
test eax, eax
jne 0x434097
push edi
push ebp
call fcn.0042b9e0
add esp, 8
test eax, eax
je 0x4340ba
push str.Rollback_failed_to_move_attribute
push 0
push 0x4d0
jmp 0x4340a3
push str.Rollback_failed_to_find_attr
push 0
push 0x4d2
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
mov eax, ebp
call fcn.0042a3c0
mov edx, dword [esp + 0x20]
movzx ecx, word [esi + 4]
add esi, ecx
cmp esi, edx
jb 0x434044
xor eax, eax
and dword [edi + 0x10], 0xfffffff9
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
push ebp
call fcn.004d5b05
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.004d5b05
add esp, 4
call fcn.004dc440
pop ebp
pop edi
mov dword [eax], ebx
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
push ebp
call fcn.004d5b05
add esp, 4
call fcn.00426030
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
call fcn.004dc440
push str.Inode_already_has_attribute_list
push ebx
push 0x445
mov dword [eax], 0x11
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425280
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret