Function at 0x428260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x84]
or eax, 0xffffffff
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ebx
cmp edi, ebx
je 0x4291d5
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x4291d5
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x4291d5
cmp dword [esp + 0x98], ebx
je 0x4291d5
mov ebp, dword [esp + 0x8c]
cmp ebp, ebx
jl 0x4291d5
mov ecx, dword [esp + 0x88]
jg 0x4282da
cmp ecx, ebx
jb 0x4291d5
cmp dword [esp + 0x94], ebx
jl 0x4291d5
jg 0x4282f6
cmp dword [esp + 0x90], ebx
jb 0x4291d5
movzx eax, word [edi + 0xc]
xor edx, edx
test al, al
setne dl
mov byte [edi + 0x46], bl
mov esi, edx
mov dword [esp + 0x18], esi
test eax, 0x4000
je 0x428331
cmp esi, ebx
jne 0x428321
mov eax, dword [esp + 0x10]
cmp dword [eax + 0xd8], ebx
jne 0x42835e
call fcn.004ff09d
mov dword [eax], 0xd
jmp 0x429207
cmp esi, ebx
je 0x42835e
cmp dword [edi + 8], 0x80
jne 0x42835e
cmp ebp, dword [edi + 0x34]
jl 0x42835e
jg 0x42834a
cmp ecx, dword [edi + 0x30]
jbe 0x42835e
push ebp
push ecx
mov eax, edi
call fcn.0042e470
add esp, 8
test eax, eax
jne 0x429207
mov eax, dword [edi + 0x18]
mov ecx, eax
shr ecx, 1
and ecx, 1
mov dword [esp + 0x28], ecx
cmp esi, ebx
je 0x42838f
cmp dword [edi + 8], 0x80
jne 0x42837f
cmp byte [edi + 0xc], 1
je 0x42838f
call fcn.004ff09d
mov dword [eax], 0x5f
jmp 0x429207
mov ecx, dword [esp + 0x90]
or ecx, dword [esp + 0x94]
je 0x429212
cmp dword [edi + 8], 0x80
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov esi, dword [edi + 0x28]
mov dword [esp + 0x50], edx
mov edx, dword [edi + 0x2c]
mov dword [esp + 0x54], ecx
mov ebx, esi
mov ecx, edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
jne 0x4283ed
cmp ebp, ecx
jl 0x4283ed
jg 0x4283e3
cmp dword [esp + 0x88], ebx
jb 0x4283ed
test al, 2
je 0x4283ed
or eax, 0x10
mov dword [edi + 0x18], eax
mov ecx, dword [esp + 0x88]
add ecx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov eax, ebp
adc eax, ebx
cmp eax, edx
jl 0x428469
jg 0x428410
cmp ecx, esi
jbe 0x428469
test byte [edi + 0x18], 0x10
mov edx, 0
setne dl
inc edx
push edx
push eax
push ecx
push edi
call fcn.0042e2d0
add esp, 0x10
test eax, eax
je 0x428455
push str.Failed_to_enlarge_attribute
push 0
push 0x739
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x14
jmp 0x429207
xor eax, eax
cmp byte [edi + 0xc], al
mov dword [esp + 0x24], 2
setne al
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x4284b0
mov ecx, dword [edi + 0x40]
mov edx, dword [esp + 0x88]
xor eax, eax
dec ecx
or eax, ebp
or ecx, edx
sub ecx, edx
sbb eax, ebp
add ecx, 1
adc eax, 0
cmp ebx, eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
jl 0x4284b0
jg 0x4284a2
cmp dword [esp + 0x90], ecx
jbe 0x4284b0
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x34]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
test dl, 2
jne 0x4286a1
mov ebx, dword [edi + 4]
xor ebp, ebp
cmp ebx, ebp
jne 0x428507
call fcn.004ff09d
push str.NULL_arguments
push ebp
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425250
add esp, 0x14
xor ebx, ebx
jmp 0x428ffe
push 0x20
call fcn.004f8626
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x42853b
push ebp
push 0x20
push str.Failed_to_malloc__lld_bytes
push ebp
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425250
add esp, 0x1c
jmp 0x42855f
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov ebx, esi
cmp esi, ebp
je 0x428ffe
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push esi
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
push eax
push ecx
call fcn.0042a220
add esp, 0x24
test eax, eax
je 0x4285b3
push str.ntfs_attr_pwrite
push str._s:_lookup_failed
push ebp
push 0x75f
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428ffe
mov ecx, dword [esi + 4]
movzx eax, word [ecx + 0x14]
add eax, ecx
cmp eax, ecx
jb 0x42866a
mov edx, dword [ecx + 0x10]
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 0x1c]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
ja 0x428668
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x8c]
push ecx
add edx, eax
push edx
call fcn.004f8140
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esi]
push ecx
push edx
push ebp
call fcn.004255c0
add esp, 0x18
test eax, eax
je 0x42863f
push str.ntfs_attr_pwrite
push str._s:_failed_to_write_mft_record
push 0
push 0x774
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428ffe
push esi
call fcn.004f84cf
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov edx, ecx
pop ebx
add esp, 0x70
ret
xor ebp, ebp
call fcn.004ff09d
push str.ntfs_attr_pwrite
push str._s:_Sanity_check_failed
push ebp
push 0x767
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428ffe
mov esi, dword [esp + 0x88]
mov ebp, dword [esp + 0x8c]
mov ebx, esi
add ebx, dword [esp + 0x90]
adc ebp, dword [esp + 0x94]
mov dword [esp + 0x60], ebx
cmp ebp, eax
jl 0x428903
jg 0x4286d5
cmp ebx, ecx
jbe 0x428903
test dl, 0x10
je 0x428733
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x8c]
call fcn.005382a0
cmp dword [esp + 0x18], 0
mov esi, eax
mov ebx, edx
je 0x42870b
movzx eax, byte [edi + 0x45]
neg eax
cdq
and esi, eax
and ebx, edx
mov eax, esi
or eax, ebx
je 0x428717
add esi, 0xffffffff
adc ebx, 0xffffffff
push ebx
push esi
call fcn.004261a0
add esp, 8
test eax, eax
jne 0x428ffa
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
jmp 0x428742
mov eax, edi
call fcn.00426420
test eax, eax
jne 0x428ffa
cmp dword [esp + 0x18], 0
je 0x428765
mov eax, dword [edi]
push 2
mov ebx, edi
call fcn.00437ac0
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x428ffa
mov byte [edi + 0x46], 2
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x4287a2
call fcn.004ff09d
push str.NULL_arguments
push ebx
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425250
add esp, 0x14
mov dword [esp + 0x14], ebx
jmp 0x428ffa
push 0x20
call fcn.004f8626
mov esi, eax
add esp, 4
test esi, esi
jne 0x4287d6
push eax
push 0x20
push str.Failed_to_malloc__lld_bytes
push eax
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425250
add esp, 0x1c
jmp 0x4287fc
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
xor eax, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x428ffa
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push esi
push 0
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call fcn.0042a220
add esp, 0x24
test eax, eax
jne 0x428ffa
mov eax, dword [edi + 0x34]
mov edx, dword [esp + 0x8c]
cmp edx, eax
mov ecx, dword [edi + 0x30]
jl 0x42886b
jg 0x42884b
cmp dword [esp + 0x88], ecx
jbe 0x42886b
mov ebx, dword [esp + 0x88]
sub ebx, ecx
sbb edx, eax
push edx
push ebx
push eax
push ecx
push edi
call fcn.00427170
add esp, 0x14
test eax, eax
jne 0x428ffa
cmp dword [esp + 0x18], 0
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x60]
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ebp
je 0x428894
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ebp
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
mov dword [eax + 0x30], edx
mov ecx, dword [eax + 0x3c]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [esp + 0x10]
push edx
push eax
mov eax, dword [esi]
push ebx
call fcn.004255c0
add esp, 0xc
test eax, eax
je 0x4288dc
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esi]
push ecx
push edx
push ebx
call fcn.004255c0
add esp, 0xc
jmp 0x428ffa
mov eax, dword [esp + 0x60]
push esi
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebp
call fcn.004f84cf
mov esi, dword [esp + 0x8c]
add esp, 4
or dword [esp + 0x24], 1
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
movzx ecx, byte [ecx + 0x24]
mov ebp, dword [esp + 0x8c]
mov eax, esi
mov edx, ebp
call fcn.005382a0
push edx
push eax
mov eax, edi
call fcn.004267b0
mov ebx, eax
add esp, 8
mov dword [esp + 0x1c], ebx
test ebx, ebx
jne 0x428976
call fcn.004ff09d
cmp dword [eax], 2
jne 0x428ffa
call fcn.004ff09d
push str.ntfs_attr_pwrite
push str._s:_Failed_to_find_VCN_3
push ebx
push 0x7e4
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428ffa
xor eax, eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x18], eax
je 0x428a41
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
and edx, ecx
cmp edx, 0xffffffff
jne 0x4289e5
cmp dword [esp + 0x28], eax
je 0x4289e5
movzx ecx, byte [edi + 0x45]
mov eax, ecx
cdq
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x14]
cmp eax, edx
jg 0x4289bd
jl 0x4289b6
mov edx, dword [ebx + 0x10]
cmp edx, dword [esp + 0x78]
jae 0x4289bd
sub ecx, dword [ebx + 0x10]
mov eax, ecx
jmp 0x428a1f
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
lea eax, [esp + 0x40]
push eax
push ecx
push edx
push ebp
lea eax, [esp + 0x2c]
push esi
push eax
mov eax, edi
call fcn.00427980
add esp, 0x18
jmp 0x428a1b
test ecx, ecx
jl 0x428a2b
jg 0x4289f1
cmp dword [ebx + 8], 0
jb 0x428a2b
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
push ecx
mov ecx, dword [esp + 0x94]
lea edx, [esp + 0x44]
push edx
push eax
push ecx
push ebp
push esi
lea edx, [esp + 0x34]
push edx
push edi
call fcn.00427d80
add esp, 0x20
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
test eax, eax
jl 0x428ffa
test byte [edi + 0x18], 4
je 0x428a41
movzx ecx, byte [edi + 0x45]
cmp eax, ecx
jge 0x428a41
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.004f9360
mov ecx, esi
sub ecx, eax
mov eax, ebp
sbb eax, edx
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x90]
or eax, dword [esp + 0x94]
mov dword [esp + 0x28], ecx
je 0x428eae
cmp dword [ebx + 8], 0xfffffffe
jne 0x428ae7
cmp dword [ebx + 0xc], 0xffffffff
jne 0x428ae7
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [esp + 0x84]
push ecx
push edx
call fcn.004267b0
mov ebx, eax
add esp, 8
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x428eda
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0x24]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.004f9360
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
sub edi, eax
sbb esi, edx
add edi, dword [esp + 0x88]
adc esi, dword [esp + 0x8c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
jmp 0x428aef
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebp, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ecx, ebp
or ecx, eax
je 0x428f20
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
test edx, edx
jg 0x428b68
jl 0x428b0f
test eax, eax
jae 0x428b68
mov ecx, dword [ebx]
add ecx, ebp
mov dword [esp + 0x60], ecx
mov ecx, dword [ebx + 4]
adc ecx, dword [ebx + 0x14]
and eax, edx
mov dword [esp + 0x64], ecx
cmp eax, 0xffffffff
jne 0x428f55
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
mov eax, dword [esp + 0x98]
call fcn.004273d0
add esp, 0x14
test eax, eax
jne 0x428ff3
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
cmp dword [esp + 0x18], 0
je 0x428baf
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
mov ecx, eax
or ecx, edx
je 0x428baf
mov ecx, dword [esp + 0x10]
movzx ebp, byte [ecx + 0x24]
mov ecx, ebp
call fcn.004f9360
cmp esi, edx
jl 0x428ba7
jg 0x428b94
cmp edi, eax
jb 0x428ba7
sub edi, eax
mov eax, dword [ebx + 0x28]
sbb esi, edx
mov edx, dword [ebx + 0x2c]
add ebx, 0x18
mov ecx, eax
or ecx, edx
jne 0x428b83
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
call fcn.004f9360
mov ecx, dword [esp + 0x94]
sub eax, edi
sbb edx, esi
cmp ecx, edx
jg 0x428be9
jl 0x428bdc
cmp dword [esp + 0x90], eax
jae 0x428be9
mov eax, dword [esp + 0x90]
mov dword [esp + 0x34], ecx
jmp 0x428bed
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x10]
test byte [ecx + 8], 1
jne 0x428e13
mov eax, dword [ebx + 8]
mov edx, ecx
movzx esi, byte [edx + 0x24]
mov edx, dword [ebx + 0xc]
mov ecx, esi
call fcn.004f9360
mov edi, dword [esp + 0x28]
add eax, edi
adc edx, dword [esp + 0x2c]
mov dword [esp + 0x48], eax
mov eax, dword [ebx]
mov dword [esp + 0x4c], edx
mov edx, dword [ebx + 4]
mov ecx, esi
call fcn.004f9360
add eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x18]
mov ebp, edx
adc ebp, dword [esp + 0x34]
add eax, edi
adc ebp, dword [esp + 0x2c]
xor esi, esi
mov edi, ecx
add edi, eax
adc esi, ebp
sub edi, 1
sbb esi, 0
dec ecx
xor edx, edx
not ecx
not edx
and edi, ecx
and esi, edx
sub edi, eax
mov dword [esp + 0x78], eax
sbb esi, ebp
mov eax, edi
or eax, esi
je 0x428d9d
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x84]
cmp ecx, dword [eax + 0x30]
jne 0x428c87
cmp ebp, dword [eax + 0x34]
je 0x428cb0
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
call fcn.004f9360
cmp ebp, edx
jg 0x428d9d
jl 0x428cb0
cmp dword [esp + 0x78], eax
jae 0x428d9d
add edi, dword [esp + 0x30]
adc esi, dword [esp + 0x34]
call fcn.00434550
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x428ff3
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x98]
push eax
push ecx
push ebp
call fcn.004f8140
mov eax, dword [esp + 0x3c]
mov edx, edi
sub edx, eax
push edx
add eax, ebp
push 0
push eax
call fcn.004f8090
add esp, 0x18
cmp dword [esp + 0x18], 0
je 0x428d51
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
mov edx, ebp
push edx
mov edx, dword [esp + 0x38]
push esi
push edi
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0xa8]
push ecx
push edx
push ebx
push eax
call fcn.00443030
mov ecx, dword [esp + 0x50]
add esp, 0x34
push ecx
mov ebp, eax
mov dword [esp + 0x60], edx
call fcn.004f84cf
add esp, 4
jmp 0x428e1f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x14]
push esi
push edi
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.00437110
mov ebp, eax
add esp, 0x18
mov dword [esp + 0x5c], edx
cmp ebp, edi
jne 0x428d8b
cmp edx, esi
jne 0x428d8b
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004f84cf
add esp, 4
jmp 0x428e1f
cmp dword [esp + 0x18], 0
mov ecx, dword [esp + 0x98]
je 0x428deb
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0xa8]
push ecx
push edx
push ebx
push eax
call fcn.00443030
add esp, 0x34
mov ebp, eax
jmp 0x428e23
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [eax]
push edx
push ecx
call fcn.00437110
add esp, 0x18
mov ebp, eax
jmp 0x428e23
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x5c]
xor eax, eax
cmp edx, eax
jl 0x428e54
jg 0x428e2f
cmp ebp, eax
jbe 0x428e54
add dword [esp + 0x38], ebp
adc dword [esp + 0x3c], edx
sub dword [esp + 0x90], ebp
sbb dword [esp + 0x94], edx
sub dword [esp + 0x50], ebp
sbb dword [esp + 0x54], edx
add dword [esp + 0x98], ebp
cmp ebp, dword [esp + 0x30]
jne 0x428e60
cmp edx, dword [esp + 0x34]
je 0x428e80
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
jne 0x428f92
call fcn.004ff09d
cmp dword [eax], 4
je 0x428bf1
jmp 0x428fa1
mov ecx, dword [esp + 0x90]
add ebx, 0x18
or ecx, dword [esp + 0x94]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
jne 0x428a81
mov edi, dword [esp + 0x84]
test byte [edi + 0x18], 0x18
je 0x429212
mov ecx, dword [esp + 0x44]
test ecx, ecx
jg 0x4291bf
jl 0x428ed1
cmp dword [esp + 0x40], 0
jae 0x4291bf
xor eax, eax
xor ecx, ecx
jmp 0x4291c3
call fcn.004ff09d
cmp dword [eax], 2
jne 0x428fa1
call fcn.004ff09d
push str.ntfs_attr_pwrite
push str._s:_Failed_to_find_VCN_4
push 0
push 0x82f
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428fa1
call fcn.004ff09d
push str.ntfs_attr_pwrite
push str._s:_Zero_run_length
push 0
push 0x838
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x428fa1
call fcn.004ff09d
mov dword [eax], 5
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
push edx
push eax
push str.ntfs_attr_pwrite
push str._s:_Unexpected_LCN___lld_
push 0
push 0x842
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x20
jmp 0x428fa1
or ebp, edx
jne 0x428fa1
call fcn.004ff09d
mov dword [eax], 5
call fcn.004ff09d
mov ecx, dword [esp + 0x38]
mov esi, dword [eax]
mov eax, dword [esp + 0x3c]
mov edx, ecx
or edx, eax
je 0x428fec
test byte [esp + 0x24], 1
je 0x428ea7
add ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
adc eax, dword [esp + 0x8c]
cmp eax, dword [edi + 0x34]
jg 0x428eae
jl 0x428ffa
cmp ecx, dword [edi + 0x30]
ja 0x428eae
jmp 0x428ffa
call fcn.004ff09d
mov dword [eax], esi
mov edi, dword [esp + 0x84]
mov ebx, dword [esp + 0x14]
call fcn.004ff09d
test byte [esp + 0x24], 1
mov ebp, dword [eax]
je 0x429136
test ebx, ebx
jne 0x4290b5
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x429051
call fcn.004ff09d
push str.NULL_arguments
push ebx
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425250
add esp, 0x14
jmp 0x429113
push 0x20
call fcn.004f8626
mov esi, eax
add esp, 4
test esi, esi
jne 0x429087
push eax
push 0x20
push str.Failed_to_malloc__lld_bytes
push eax
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425250
add esp, 0x1c
xor eax, eax
jmp 0x4290ad
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
xor eax, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ebx, esi
cmp esi, eax
jne 0x4290bc
jmp 0x429113
mov eax, ebx
call fcn.0042a390
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push ebx
push 0
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call fcn.0042a220
add esp, 0x24
test eax, eax
jne 0x429113
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], edx
mov eax, dword [ebx + 4]
mov dword [eax + 0x38], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x3c], edx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebx]
push ecx
call fcn.004255c0
add esp, 0xc
test eax, eax
je 0x429136
push str.Eeek__Failed_to_recover_from_error._Leaving_metadata_in_inconsistent_state__Run_chkdsk__n
push 0
push 0x8ec
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x80
call fcn.00425250
add esp, 0x14
test ebx, ebx
je 0x429143
push ebx
call fcn.004f84cf
add esp, 4
cmp dword [esp + 0x18], 0
je 0x4291b0
mov eax, dword [edi + 0x18]
shr eax, 3
and eax, 1
test eax, eax
je 0x429165
push 0
push 0
mov edx, edi
call fcn.0042d8f0
add esp, 8
test byte [esp + 0x24], 2
je 0x4291a7
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push edx
push eax
mov edx, edi
call fcn.0042e430
add esp, 8
test eax, eax
je 0x4291a7
push str.Failed_to_restore_data_size
push 0
push 0x8f8
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x14
call fcn.004ff09d
mov dword [eax], ebp
jmp 0x429207
mov eax, dword [esp + 0x40]
and eax, dword [esp + 0x44]
cmp eax, 0xffffffff
jne 0x429157
jmp 0x429165
mov eax, dword [esp + 0x40]
push ecx
push eax
mov edx, edi
call fcn.0042d8f0
add esp, 8
test eax, eax
je 0x429212
jmp 0x429207
call fcn.004ff09d
push str.ntfs_attr_pwrite
push 0x56ff10
push ebx
push 0x6fa
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425250
add esp, 0x18
or eax, 0xffffffff
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret