Function at 0x433a20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
cmp edi, ebx
jne 0x433a76
call fcn.004ff09d
push str.ntfs_inode_add_attrlist
push 0x56ff10
push ebx
push 0x43d
mov dword [eax], 0x16
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x18
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
test byte [edi + 0x10], 2
jne 0x4340ef
cmp dword [edi + 0x20], ebx
jne 0x4340ef
push ebp
push 0x20
call fcn.004f8626
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x433ac8
push ebx
push 0x20
push str.Failed_to_malloc__lld_bytes
push ebx
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425250
add esp, 0x1c
call fcn.004ff09d
mov ebx, dword [eax]
jmp 0x4340b8
mov eax, dword [edi + 8]
mov dword [ebp], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], 1
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
lea ecx, [ecx]
cmp dword [ebp], ebx
je 0x433c3a
cmp dword [ebp + 4], ebx
je 0x433c3a
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x433b10
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x433b29
test byte [eax + 0x10], 2
je 0x433b29
push ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429c60
add esp, 0x24
jmp 0x433b38
push ebp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429970
add esp, 0x1c
cmp eax, ebx
jne 0x433c6c
mov eax, dword [ebp + 4]
cmp dword [eax], 0x20
je 0x433cb5
movzx ebx, byte [eax + 9]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ebx, [ebx + ebx + 0x21]
and ebx, 0xfffffff8
add eax, ebx
push eax
push edx
mov dword [esp + 0x18], eax
call fcn.00501d7c
mov edi, eax
add esp, 8
test edi, edi
je 0x433ce2
sub eax, dword [esp + 0x14]
push ebx
add esi, eax
push 0
push esi
mov dword [esp + 0x20], edi
call fcn.004f8090
mov ecx, dword [ebp + 4]
mov edx, dword [ecx]
mov dword [esi], edx
mov eax, dword [ebp + 4]
movzx cx, byte [eax + 9]
add cx, cx
add cx, 0x21
mov edx, 0xfff8
and cx, dx
mov word [esi + 4], cx
mov eax, dword [ebp + 4]
mov cl, byte [eax + 9]
mov byte [esi + 6], cl
mov byte [esi + 7], 0x1a
mov edx, dword [ebp + 4]
add esp, 0xc
cmp byte [edx + 8], 0
je 0x433bd7
mov eax, edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0x14]
mov dword [esi + 0xc], edx
jmp 0x433bdf
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
movzx eax, word [eax + 0x10]
mov ebx, dword [ecx]
movzx ecx, word [ecx + 4]
cdq
xor edx, edx
shl eax, 0x10
or eax, ecx
or edx, ebx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov edx, dword [ebp + 4]
mov ax, word [edx + 0xe]
mov word [esi + 0x18], ax
mov eax, dword [ebp + 4]
movzx ecx, byte [eax + 9]
movzx edx, word [eax + 0xa]
add ecx, ecx
push ecx
add edx, eax
push edx
add esi, 0x1a
push esi
call fcn.004f8140
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea esi, [edi + eax]
mov edi, dword [esp + 0x20]
xor ebx, ebx
jmp 0x433af0
call fcn.004ff09d
push str.ntfs_attr_lookup
push 0x56ff10
push ebx
push 0xcfa
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_lookup
mov eax, 0x100
call fcn.00425250
add esp, 0x18
call fcn.004ff09d
cmp dword [eax], 2
je 0x433d16
call fcn.004ff09d
mov ebx, dword [eax]
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push eax
push str.ntfs_inode_add_attrlist
push str._s:_Attribute_lookup_failed__inode__lld
push 0
push 0x47f
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x20
jmp 0x4340af
push str.Attribute_list_already_present
push 0
push 0x456
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
mov ebx, 5
call fcn.00425250
add esp, 0x14
jmp 0x4340af
call fcn.004ff09d
mov ecx, dword [esp + 0x10]
mov ebx, dword [eax]
push ecx
push str.Failed_to_realloc__d_bytes
push 0
push 0x461
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x18
jmp 0x4340af
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
or dword [edi + 0x10], 6
mov eax, dword [edi + 8]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], edx
mov ecx, dword [eax + 0x1c]
sub ecx, dword [eax + 0x18]
cmp ecx, 0x18
jae 0x433d74
push 0x18
push edi
call fcn.00434130
add esp, 8
test eax, eax
je 0x433d74
call fcn.004ff09d
mov ebx, dword [eax]
push str.Failed_to_free_space_for_attrlist
push 0
push 0x491
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
jmp 0x433ff6
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x433d83
cmp dword [eax + 0xbc], ebx
jne 0x433d98
call fcn.004ff09d
mov dword [eax], 0x16
call fcn.004ff09d
jmp 0x433ebc
push 0x20
call fcn.004f8626
mov ebx, eax
xor ecx, ecx
add esp, 4
cmp ebx, ecx
jne 0x433dd1
push ecx
push 0x20
push str.Failed_to_malloc__lld_bytes
push ecx
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425250
add esp, 0x1c
jmp 0x433ebc
mov eax, dword [edi + 8]
push ebx
push ecx
push ecx
push ecx
mov dword [ebx], eax
movzx edx, word [eax + 0x14]
push ecx
push ecx
add edx, eax
push 0x20
mov dword [ebx + 4], edx
mov dword [ebx + 8], 1
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
call fcn.00429970
add esp, 0x1c
test eax, eax
jne 0x433e0e
lea esi, [eax + 0x11]
jmp 0x433e3d
call fcn.004ff09d
cmp dword [eax], 2
je 0x433e1f
mov esi, 5
jmp 0x433e3d
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
mov ecx, 0x18
call fcn.0042a770
test eax, eax
je 0x433e4f
call fcn.004ff09d
mov esi, dword [eax]
mov edi, dword [esp + 0x20]
push ebx
call fcn.004f84cf
add esp, 4
call fcn.004ff09d
mov dword [eax], esi
jmp 0x433ebc
mov eax, edi
sub eax, esi
xor ecx, ecx
mov dword [esp + 0x18], eax
xor eax, eax
push ecx
mov word [edi + 0xa], ax
mov word [edi + 0xc], cx
mov dword [edi], 0x20
mov dword [edi + 4], 0x18
mov byte [edi + 8], 0
mov byte [edi + 9], 0
mov dx, word [esi + 0x28]
push ecx
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x18]
mov eax, 0x18
push ecx
mov word [edi + 0xe], dx
mov word [edi + 0x14], ax
call fcn.004f8090
mov eax, dword [esp + 0x2c]
mov byte [edi + 0x16], 0
inc word [esi + 0x28]
call fcn.00432710
push ebx
call fcn.004f84cf
mov edi, dword [esp + 0x30]
add esp, 0x10
cmp dword [esp + 0x18], 0
jge 0x433eeb
call fcn.004ff09d
mov ebx, dword [eax]
push str.Couldnt_add__ATTRIBUTE_LIST_to_MFT
push 0
push 0x49a
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
jmp 0x433ff6
push 0
push 0x5a22a0
push 0x20
mov eax, edi
call fcn.00425c80
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x433f2f
call fcn.004ff09d
mov ebx, dword [eax]
push str.Failed_to_open_just_added__ATTRIBUTE_LIST
push esi
push 0x4a2
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
jmp 0x433f77
mov eax, dword [esp + 0x10]
cdq
push edx
push eax
mov edx, esi
call fcn.0042e430
add esp, 8
test eax, eax
je 0x4340d7
call fcn.004ff09d
mov ebx, dword [eax]
push str.Failed_to_resize_just_added__ATTRIBUTE_LIST
push 0
push 0x4a7
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
call fcn.00426000
and dword [edi + 0x10], 0xfffffffd
mov eax, ebp
mov dword [edi + 0x1c], 0
call fcn.0042a390
push ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x20
call fcn.0042a220
add esp, 0x24
test eax, eax
jne 0x433fc1
push ebp
call fcn.0042aed0
add esp, 4
test eax, eax
je 0x433fe4
push str.Rollback_failed_to_remove_attrlist
push 0
push 0x4b9
jmp 0x433fcd
push str.Rollback_failed_to_find_attrlist
push 0
push 0x4bb
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
or dword [edi + 0x10], 2
mov dword [edi + 0x1c], edx
mov dword [edi + 0x18], eax
mov eax, ebp
call fcn.0042a390
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [ecx + esi]
mov dword [esp + 0x20], edx
cmp esi, edx
jae 0x4340a3
mov eax, dword [esi + 0x10]
movzx ecx, word [esi + 0x14]
cmp eax, dword [edi]
jne 0x434024
cmp ecx, dword [edi + 4]
je 0x434095
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
movzx ecx, byte [esi + 6]
push ebp
push 0
push 0
push edx
push eax
mov eax, dword [esi]
push 0
push ecx
lea edx, [esi + 0x1a]
push edx
push eax
call fcn.0042a220
add esp, 0x24
test eax, eax
jne 0x434067
push edi
push ebp
call fcn.0042b9b0
add esp, 8
test eax, eax
je 0x43408a
push str.Rollback_failed_to_move_attribute
push 0
push 0x4d0
jmp 0x434073
push str.Rollback_failed_to_find_attr
push 0
push 0x4d2
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
mov eax, ebp
call fcn.0042a390
mov edx, dword [esp + 0x20]
movzx ecx, word [esi + 4]
add esi, ecx
cmp esi, edx
jb 0x434014
xor eax, eax
and dword [edi + 0x10], 0xfffffff9
mov dword [edi + 0x1c], eax
mov dword [edi + 0x18], eax
push ebp
call fcn.004f84cf
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call fcn.004f84cf
add esp, 4
call fcn.004ff09d
pop ebp
pop edi
mov dword [eax], ebx
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
push ebp
call fcn.004f84cf
add esp, 4
call fcn.00426000
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
call fcn.004ff09d
push str.Inode_already_has_attribute_list
push ebx
push 0x445
mov dword [eax], 0x11
push str..libntfsinode.c
push str.ntfs_inode_add_attrlist
mov eax, 0x100
call fcn.00425250
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret