Function at 0x40d180
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x474
mov eax, dword [0x42d0f0]
xor eax, esp
mov dword [esp + 0x470], eax
mov ecx, dword [esp + 0x478]
mov eax, dword [esp + 0x480]
push ebp
mov ebp, dword [esp + 0x488]
push edi
mov edi, dword [esp + 0x484]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x40d74a
mov edx, dword [esp + 0x490]
push ebx
mov ebx, dword [esp + 0x498]
push esi
mov esi, edx
or esi, ebx
je 0x40d748
cmp dword [esp + 0x4a0], 0x3e8
jle 0x40d206
mov eax, dword [ecx + 0x22c]
push str.Error:_infinite_attribute_loop__the_MFT_may_be_corrupt.
push 0
push 2
call eax
add esp, 0xc
jmp 0x40d748
mov ecx, dword [ecx + 0x22c]
push ebx
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push str.____Processing_AttributeList_for_Inode__I64u___u_bytes
push 0
push 6
call ecx
xor esi, esi
add esp, 0x1c
mov dword [esp + 0x14], esi
test ebx, ebx
jb 0x40d748
mov edx, dword [esp + 0x498]
ja 0x40d25e
test edx, edx
jbe 0x40d748
jmp 0x40d25e
mov ebx, dword [esp + 0x49c]
mov edx, dword [esp + 0x498]
xor eax, eax
lea ecx, [esi + 3]
cmp eax, ebx
ja 0x40d748
jb 0x40d275
cmp ecx, edx
ja 0x40d748
cmp dword [esi + ebp], 0xffffffff
je 0x40d748
lea eax, [esi + ebp + 4]
mov dword [esp + 0x48], eax
movzx eax, word [eax]
cmp ax, 3
jb 0x40d748
movzx eax, ax
xor ecx, ecx
add eax, esi
cmp ecx, ebx
ja 0x40d748
jb 0x40d2ad
cmp eax, edx
ja 0x40d748
movzx eax, word [esi + ebp + 0x14]
push 1
cdq
push 0
push edx
push eax
call fcn.00412be0
mov ebx, eax
mov eax, dword [esi + ebp + 0x10]
xor ecx, ecx
add ebx, eax
mov eax, dword [esp + 0x18]
adc edx, ecx
mov dword [esp + 0x2c], edx
cmp ebx, dword [eax]
jne 0x40d2df
cmp edx, dword [eax + 4]
je 0x40d6a2
mov eax, dword [esi + ebp]
push eax
call fcn.0040c280
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx + 0x22c]
push str.____List_attribute:__s
push 0
push 6
call eax
movzx ecx, word [esi + ebp + 0x18]
movzx edx, word [esi + ebp + 0x16]
push ecx
mov ecx, dword [esi + ebp + 0xc]
lea eax, [esi + ebp + 0x18]
push edx
mov edx, dword [esi + ebp + 8]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x30]
push ebx
push ecx
mov ecx, dword [eax + 0x22c]
push edx
push str.______LowestVcn___I64u__RefInode___I64u__InodeSequence___u__Instance___u
push 0
push 6
call ecx
lea eax, [esi + ebp + 6]
mov dword [esp + 0x74], eax
mov al, byte [eax]
add esp, 0x38
test al, al
jbe 0x40d3b1
movzx edx, al
lea eax, [edx + edx + 2]
push eax
call fcn.00412a5f
add esp, 4
mov dword [esp + 0x4c], eax
test eax, eax
je 0x40d6d3
movzx edx, byte [esi + ebp + 7]
mov ecx, dword [esp + 0x3c]
movzx ecx, byte [ecx]
push ecx
add edx, ebp
add edx, esi
push edx
inc ecx
push ecx
push eax
call fcn.00413237
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x4c]
movzx ecx, byte [eax]
mov eax, dword [esp + 0x20]
push esi
push str.______AttributeList_name___s
xor edx, edx
xor ebp, ebp
mov word [esi + ecx*2], dx
mov ecx, dword [eax + 0x22c]
push ebp
push 6
call ecx
push esi
call fcn.00412c14
add esp, 0x24
jmp 0x40d3b3
xor ebp, ebp
mov edx, dword [esp + 0x2c]
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push edx
push ebx
push eax
push ecx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.00412be0
mov ecx, dword [edi + 4]
mov ebp, edx
mov edx, dword [edi + 0xc]
push edx
mov edx, dword [edi]
mov esi, eax
mov eax, dword [edi + 8]
push eax
push ecx
push edx
call fcn.00412be0
push edx
push eax
push ebp
push esi
call fcn.00412e10
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + 0x44]
mov dword [esp + 0x40], eax
mov eax, edx
mov dword [esp + 0x44], eax
test esi, esi
je 0x40d479
mov edx, dword [esp + 0x34]
mov ecx, dword [esi]
and ecx, dword [esi + 4]
cmp ecx, 0xffffffff
je 0x40d464
cmp eax, dword [esp + 0x20]
jb 0x40d450
ja 0x40d42c
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x1c]
jb 0x40d450
mov ebp, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x44]
sub ebp, edx
sbb ecx, dword [esp + 0x38]
add ebp, dword [esp + 0x1c]
adc ecx, dword [esp + 0x20]
cmp eax, ecx
jb 0x40d4a3
ja 0x40d450
cmp dword [esp + 0x40], ebp
jb 0x40d4a3
mov ecx, dword [esi + 8]
sub ecx, edx
mov edx, dword [esi + 0xc]
sbb edx, dword [esp + 0x38]
add dword [esp + 0x1c], ecx
adc dword [esp + 0x20], edx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x38], ecx
test esi, esi
jne 0x40d410
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx + 0x22c]
push ecx
push ebx
push str.______Error:_Inode__I64u_is_an_extension_of_Inode__I64u__but_does_not_exist__outside_the_MFT_.
push 0
push 6
call eax
add esp, 0x1c
jmp 0x40d69a
mov ecx, dword [edi + 0x28]
push ecx
call fcn.00412a5f
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x40d6ed
mov edx, dword [esi]
sub edx, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
mov eax, dword [esi + 4]
sbb eax, dword [esp + 0x20]
push ecx
mov ecx, dword [edi]
push ecx
push eax
push edx
call fcn.00412be0
mov ecx, dword [edi + 0xc]
push ecx
mov ecx, dword [edi + 8]
push ecx
push edx
push eax
call fcn.00412be0
mov ecx, dword [edi + 0x28]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x2c]
push edx
mov esi, eax
mov eax, dword [edi + 0x2c]
push ebx
push eax
push ecx
call fcn.00412be0
mov ecx, dword [edi + 0x28]
add esi, eax
mov eax, dword [esp + 0x60]
adc eax, edx
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x7c], esi
mov esi, dword [esp + 0x18]
mov edx, dword [esi + 0x20]
push ecx
push ebp
push edx
mov dword [esp + 0x90], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d707
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
cmp dword [esp + 0x50], eax
jne 0x40d707
xor edx, edx
cmp edx, ecx
jne 0x40d707
push ecx
push eax
push ebp
push edi
push esi
call fcn.0040c440
add esp, 0x14
test eax, eax
jne 0x40d58c
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x22c]
push eax
push ebx
push str.The_error_occurred_while_processing_Inode__I64u
push 0
push 2
call ecx
push ebp
call fcn.00412c14
add esp, 0x18
jmp 0x40d69a
test byte [ebp + 0x16], 1
jne 0x40d5b7
mov edx, dword [esp + 0x2c]
mov eax, dword [esi + 0x22c]
push edx
push ebx
push str.______Referenced_Inode__I64u_is_not_in_use.
push 0
push 6
call eax
push ebp
call fcn.00412c14
add esp, 0x18
jmp 0x40d69a
movzx eax, word [ebp + 0x24]
push 1
cdq
push 0
push edx
push eax
call fcn.00412be0
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x68], edx
xor edx, edx
add eax, ecx
mov ecx, dword [esp + 0x68]
adc ecx, edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x58], ecx
mov ecx, dword [edx]
mov edx, dword [edx + 4]
cmp ecx, eax
jne 0x40d5ef
cmp edx, dword [esp + 0x58]
je 0x40d61b
push dword [esp + 0x58]
push eax
mov eax, dword [esi + 0x22c]
push edx
mov edx, dword [esp + 0x38]
push ecx
push edx
push ebx
push str.______Warning:_Inode__I64u_is_an_extension_of_Inode__I64u__but_thinks_its_an_extension_of_Inode__I64u.
push 0
push 6
call eax
push ebp
call fcn.00412c14
add esp, 0x28
jmp 0x40d69a
mov ecx, dword [esp + 0x30]
movzx edx, word [ecx]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x22c]
push edx
push eax
push ebx
push str.______Processing_Inode__I64u_Instance__u
push 0
push 6
call ecx
mov edx, dword [esp + 0x4b8]
mov ecx, dword [esp + 0x48]
movzx eax, word [ebp + 0x14]
inc edx
push edx
movzx edx, word [ecx]
mov ecx, dword [edi + 0x28]
push edx
cdq
sub ecx, eax
mov eax, dword [edi + 0x2c]
sbb eax, edx
push eax
movzx eax, word [ebp + 0x14]
push ecx
mov ecx, dword [esp + 0x40]
add eax, ebp
push eax
push ecx
push edi
push esi
call fcn.0040d770
mov edx, dword [esp + 0x68]
movzx eax, word [edx]
mov ecx, dword [esp + 0x64]
mov edx, dword [esi + 0x22c]
push eax
push ecx
push ebx
push str.______Finished_processing_Inode__I64u_Instance__u
push 0
push 6
call edx
add esp, 0x50
push ebp
call fcn.00412c14
add esp, 4
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x48]
movzx ecx, word [eax]
add esi, ecx
xor eax, eax
mov dword [esp + 0x14], esi
cmp eax, dword [esp + 0x49c]
jb 0x40d250
ja 0x40d748
cmp esi, dword [esp + 0x498]
jb 0x40d250
jmp 0x40d748
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x22c]
push str.Error:_malloc___returned_NULL.
push 0
push 2
call eax
add esp, 0xc
jmp 0x40d748
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x22c]
push str.Error:_malloc___returned_NULL.
push 0
push 2
call edx
add esp, 0xc
jmp 0x40d748
push 0x200
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.JkDefrag.exe_SystemErrorStr
mov edx, dword [esp + 0x38]
mov eax, dword [esi + 0x22c]
lea ecx, [esp + 0x8c]
push ecx
push edx
push ebx
push str.______Error_while_reading_Inode__I64u:__s
push 0
push 2
call eax
push ebp
call fcn.00412c14
add esp, 0x28
pop esi
pop ebx
mov ecx, dword [esp + 0x478]
pop edi
pop ebp
xor ecx, esp
call fcn.00411002
add esp, 0x474
ret