Function at 0x402560
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4d8
mov rax, qword [0x0042baf8]
mov qword [rsp + 0x480], rax
test r8, r8
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x38], r14
mov qword [rsp + 0x50], r9
mov r14, r8
mov r12, r9
mov rsi, rdx
mov qword [rsp + 0x40], rdx
mov rbp, rcx
je 0x402a01
test r9, r9
je 0x402a01
cmp dword [rsp + 0x500], 0x3e8
jle 0x4025d5
xor edx, edx
lea r8, str.Error:_infinite_attribute_loop__the_MFT_may_be_corrupt.
lea ecx, [rdx + 2]
call qword [rbp + 0x298]
jmp 0x402a01
mov qword [rsp + 0x20], r9
mov r9, qword [rdx]
xor edx, edx
lea r8, str.____Processing_AttributeList_for_Inode__I64u___u_bytes
lea ecx, [rdx + 6]
mov qword [rsp + 0x498], r15
call qword [rbp + 0x298]
xor r15d, r15d
test r12, r12
je 0x4029f9
mov qword [rsp + 0x4a8], r13
mov qword [rsp + 0x4d0], rbx
mov qword [rsp + 0x4b8], rdi
xor r13d, r13d
nop
lea eax, [r15 + 3]
mov ecx, eax
cmp rcx, r12
ja 0x4029e1
mov ecx, dword [r13 + r14]
cmp ecx, 0xffffffff
je 0x4029e1
movzx eax, word [r13 + r14 + 4]
cmp ax, 3
jb 0x4029e1
movzx eax, ax
add eax, r15d
cmp rax, r12
ja 0x4029e1
movzx r12d, word [r13 + r14 + 0x14]
mov eax, dword [r13 + r14 + 0x10]
shl r12, 0x20
add r12, rax
cmp r12, qword [rsi]
je 0x402972
call fcn.00401200
xor edx, edx
lea r8, str.____List_attribute:__s
lea ecx, [rdx + 6]
mov r9, rax
call qword [rbp + 0x298]
movzx ecx, word [r13 + r14 + 0x16]
movzx eax, word [r13 + r14 + 0x18]
mov r9, qword [r13 + r14 + 8]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
xor edx, edx
lea r8, str.______LowestVcn___I64u__RefInode___I64u__InodeSequence___u__Instance___u
mov qword [rsp + 0x20], r12
lea ecx, [rdx + 6]
call qword [rbp + 0x298]
movzx eax, byte [r13 + r14 + 6]
test al, al
je 0x402733
movzx eax, al
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.00410900
test rax, rax
mov rbx, rax
je 0x40298e
movzx edx, byte [r13 + r14 + 6]
movzx r8d, byte [r13 + r14 + 7]
mov rcx, rax
mov r9, rdx
inc edx
add r8d, r15d
movsxd rdx, edx
add r8, r14
call fcn.0040f750
movzx r11d, byte [r13 + r14 + 6]
xor edx, edx
lea r8, str.______AttributeList_name___s
lea ecx, [rdx + 6]
mov r9, rbx
mov word [rbx + r11*2], 0
call qword [rbp + 0x298]
mov rcx, rbx
call fcn.004109b0
mov r10, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x118]
mov rbx, qword [rsi + 0x58]
imul rcx, qword [rbp + 0x120]
xor edx, edx
mov rax, r10
xor r8d, r8d
xor edi, edi
imul rax, r12
div rcx
test rbx, rbx
mov r9, rax
je 0x402797
cmp qword [rbx], 0xffffffffffffffff
je 0x40278a
cmp r9, rdi
jb 0x402780
mov rcx, qword [rbx + 8]
sub rcx, r8
add rcx, rdi
cmp r9, rcx
jb 0x4027b9
mov rax, qword [rbx + 8]
sub rax, r8
add rdi, rax
mov r8, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402766
mov rax, qword [rsi]
xor edx, edx
lea r8, str.______Error:_Inode__I64u_is_an_extension_of_Inode__I64u__but_does_not_exist__outside_the_MFT_.
lea ecx, [rdx + 6]
mov r9, r12
mov qword [rsp + 0x20], rax
call qword [rbp + 0x298]
jmp 0x402972
mov rcx, r10
call fcn.00410900
test rax, rax
mov rsi, rax
je 0x40298e
mov rcx, qword [rbx]
mov rdx, qword [rbp + 0x158]
mov r8d, dword [rbp + 0x158]
imul rdx, r12
sub rcx, rdi
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x20], rax
imul rcx, qword [rbp + 0x118]
imul rcx, qword [rbp + 0x120]
add rcx, rdx
mov rdx, rsi
mov dword [rsp + 0x68], ecx
shr rcx, 0x20
mov dword [rsp + 0x6c], ecx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4029a2
mov r8, qword [rbp + 0x158]
mov eax, dword [rsp + 0x48]
cmp rax, r8
jne 0x4029a2
mov rdx, rsi
mov rcx, rbp
call fcn.004013f0
test eax, eax
jne 0x40287b
lea r8, str.The_error_occurred_while_processing_Inode__I64u
lea ecx, [rax + 2]
mov r9, r12
xor edx, edx
call qword [rbp + 0x298]
mov rcx, rsi
call fcn.004109b0
mov rsi, qword [rsp + 0x40]
jmp 0x402972
test byte [rsi + 0x16], 1
jne 0x4028a8
xor edx, edx
lea r8, str.______Referenced_Inode__I64u_is_not_in_use.
mov r9, r12
lea ecx, [rdx + 6]
call qword [rbp + 0x298]
mov rcx, rsi
call fcn.004109b0
mov rsi, qword [rsp + 0x40]
jmp 0x402972
mov eax, dword [rsi + 0x20]
movzx ecx, word [rsi + 0x24]
mov rbx, qword [rsp + 0x40]
shl rcx, 0x20
add rcx, rax
mov rax, qword [rbx]
cmp rax, rcx
je 0x4028f2
mov qword [rsp + 0x28], rcx
xor edx, edx
lea r8, str.______Warning:_Inode__I64u_is_an_extension_of_Inode__I64u__but_thinks_its_an_extension_of_Inode__I64u.
lea ecx, [rdx + 6]
mov r9, r12
mov qword [rsp + 0x20], rax
call qword [rbp + 0x298]
mov rcx, rsi
call fcn.004109b0
mov rsi, rbx
jmp 0x402972
movzx eax, word [r13 + r14 + 0x18]
xor edx, edx
lea r8, str.______Processing_Inode__I64u_Instance__u
lea ecx, [rdx + 6]
mov r9, r12
mov dword [rsp + 0x20], eax
call qword [rbp + 0x298]
movzx r11d, word [rsi + 0x14]
mov eax, dword [rsp + 0x500]
mov r9, qword [rbp + 0x158]
inc eax
lea r8, [r11 + rsi]
mov dword [rsp + 0x28], eax
movzx eax, word [r13 + r14 + 0x18]
mov rdx, rbx
sub r9, r11
mov rcx, rbp
mov word [rsp + 0x20], ax
call fcn.00402a40
movzx r11d, word [r13 + r14 + 0x18]
xor edx, edx
lea r8, str.______Finished_processing_Inode__I64u_Instance__u
lea ecx, [rdx + 6]
mov r9, r12
mov dword [rsp + 0x20], r11d
call qword [rbp + 0x298]
mov rcx, rsi
call fcn.004109b0
mov rsi, rbx
movzx eax, word [r13 + r14 + 4]
mov r12, qword [rsp + 0x50]
add r15d, eax
mov r13d, r15d
cmp r13, r12
jb 0x402620
jmp 0x4029e1
xor edx, edx
lea r8, str.Error:_malloc___returned_NULL.
lea ecx, [rdx + 2]
call qword [rbp + 0x298]
jmp 0x4029e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x80]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
xor edx, edx
lea r11, [rsp + 0x80]
lea r8, str.______Error_while_reading_Inode__I64u:__s
lea ecx, [rdx + 2]
mov r9, r12
mov qword [rsp + 0x20], r11
call qword [rbp + 0x298]
mov rcx, rsi
call fcn.004109b0
mov rdi, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x4a8]
mov r15, qword [rsp + 0x498]
mov r14, qword [rsp + 0x4a0]
mov r12, qword [rsp + 0x4b0]
mov rsi, qword [rsp + 0x4c0]
mov rbp, qword [rsp + 0x4c8]
mov rcx, qword [rsp + 0x480]
call fcn.0041e010
add rsp, 0x4d8
ret