Function at 0x44b940
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov esi, dword [eax]
test ecx, ecx
push edi
mov dword [esp + 0x1c], esi
jne 0x44b97a
lea edi, [eax + 0x24]
mov ax, word [esi + 0x68]
mov cl, al
mov dword [esp + 0x14], edi
and cl, 0xf
cmp cl, 4
jb 0x44b98b
test ah, 0x10
je 0x44b98b
mov eax, 1
jmp 0x44b98d
mov edi, dword [eax + 0x20]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], edi
jmp 0x44b998
xor eax, eax
xor edx, edx
test eax, eax
setne dl
mov dword [esp + 0x2c], edx
mov ebx, dword [edi + 8]
xor eax, eax
movsx edx, word [edi + 0xc]
mov ax, word [ebx + 4]
xor ecx, ecx
mov ch, al
push 0
shr eax, 8
or ecx, eax
push edx
push esi
mov dword [esp + 0x1c], ecx
call fcn.0044d1c0
push esi
mov edi, eax
call fcn.0044e7b0
mov ecx, ebx
add esp, 0x10
add ecx, eax
mov eax, dword [ecx + edi*8]
mov dword [esp + 0x34], eax
mov edx, dword [ecx + edi*8 + 4]
lea ecx, [ecx + edi*8]
mov ebp, edx
mov ecx, 0x10
mov dword [esp + 0x38], edx
xor edi, edi
and ebp, 0xff0000
call fcn.00526f40
or edi, eax
or ebp, edx
mov ecx, 0x10
mov eax, edi
mov edx, ebp
call fcn.00526f40
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov edi, ebp
or eax, ecx
and edi, 0xff00
mov ecx, 0x10
or edx, edi
call fcn.00526f40
mov edi, ebp
xor ecx, ecx
and edi, 0xff
or eax, ecx
or edx, edi
mov ecx, 8
call fcn.00526f40
mov edi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x40], edx
mov ecx, 0x10
mov edx, ebp
call fcn.00526fd0
mov ecx, dword [esp + 0x34]
xor ebp, ebp
and ecx, 0xff00
or edx, ebp
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, dword [esp + 0x34]
or edx, ebp
and ecx, 0xff0000
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, dword [esp + 0x34]
or edx, ebp
and ecx, 0xff000000
or eax, ecx
mov ecx, 8
call fcn.00526fd0
mov ebp, dword [esp + 0x40]
or edi, eax
mov eax, dword [esp + 0x10]
or ebp, edx
mov edx, eax
dec eax
test edx, edx
mov dword [esp + 0x10], eax
jle 0x44bc32
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x58]
push eax
push 0
push ebp
push edi
push ecx
push esi
call fcn.0044d720
add esp, 0x18
test eax, eax
jne 0x44bff5
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
push edi
push eax
mov ebx, dword [eax + 0x18]
push esi
call fcn.0044c000
add esp, 0xc
test eax, eax
je 0x44bfd4
test edi, edi
je 0x44bc32
push esi
call fcn.0044e7b0
mov edx, dword [esi + 0x11c]
mov ecx, ebx
add ecx, eax
add esp, 4
xor edi, edi
mov esi, dword [ecx + edx*8]
lea eax, [ecx + edx*8]
mov ecx, 0x10
mov edx, dword [eax + 4]
mov eax, esi
mov ebp, edx
mov dword [esp + 0x38], edx
and ebp, 0xff0000
call fcn.00526f40
or edi, eax
or ebp, edx
mov ecx, 0x10
mov eax, edi
mov edx, ebp
call fcn.00526f40
mov ebp, dword [esp + 0x38]
xor ecx, ecx
mov edi, ebp
or eax, ecx
and edi, 0xff00
mov ecx, 0x10
or edx, edi
call fcn.00526f40
mov edi, ebp
xor ecx, ecx
and edi, 0xff
or eax, ecx
or edx, edi
mov ecx, 8
call fcn.00526f40
mov edi, eax
mov dword [esp + 0x40], edx
mov ecx, 0x10
mov eax, esi
mov edx, ebp
call fcn.00526fd0
mov ecx, esi
xor ebp, ebp
and ecx, 0xff00
or edx, ebp
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, esi
or edx, ebp
and ecx, 0xff0000
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
xor ecx, ecx
and esi, 0xff000000
or edx, ecx
or eax, esi
mov ecx, 8
call fcn.00526fd0
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x1c]
xor ecx, ecx
or edi, eax
mov cl, byte [esi + 0x80]
or ebp, edx
mov eax, edi
mov edx, ebp
mov dword [esp + 0x28], ecx
call fcn.00526f40
cmp eax, dword [esi + 0x5c]
jae 0x44bfd4
mov ecx, dword [esp + 0x28]
mov edx, 1
mov eax, dword [esi + 0x58]
shl edx, cl
dec edx
and edx, edi
cmp edx, eax
jae 0x44bfd4
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
push eax
push ecx
call fcn.00453ad0
mov eax, dword [esp + 0x18]
add esp, 8
mov edx, eax
dec eax
test edx, edx
mov dword [esp + 0x10], eax
jg 0x44bab1
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x10], 0
mov edi, dword [eax]
xor eax, eax
mov ax, word [ebx + 6]
mov ch, al
shr eax, 8
shr edi, 4
or eax, ecx
mov dword [esp + 0x34], edi
cmp eax, edi
mov dword [esp + 0x20], eax
jg 0x44bfb6
mov edi, dword [esp + 0x58]
push 0
push edi
push esi
call fcn.0044c000
add esp, 0xc
test eax, eax
je 0x44bfd4
mov edx, dword [ebx + 0x14]
mov esi, dword [ebx + 0x10]
mov ebp, edx
mov ecx, 0x10
mov eax, esi
xor edi, edi
and ebp, 0xff0000
call fcn.00526f40
or edi, eax
or ebp, edx
mov ecx, 0x10
mov eax, edi
mov edx, ebp
call fcn.00526f40
mov edi, dword [ebx + 0x14]
xor ecx, ecx
mov ebp, edi
or eax, ecx
and ebp, 0xff00
mov ecx, 0x10
or edx, ebp
call fcn.00526f40
mov ebp, edi
xor ecx, ecx
and ebp, 0xff
or eax, ecx
or edx, ebp
mov ecx, 8
call fcn.00526f40
mov ebp, eax
mov dword [esp + 0x48], edx
mov ecx, 0x10
mov eax, esi
mov edx, edi
call fcn.00526fd0
mov ecx, esi
xor edi, edi
and ecx, 0xff00
or edx, edi
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, esi
or edx, edi
and ecx, 0xff0000
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
xor ecx, ecx
and esi, 0xff000000
or edx, ecx
or eax, esi
mov ecx, 8
call fcn.00526fd0
mov esi, dword [esp + 0x1c]
or ebp, eax
mov eax, dword [esp + 0x48]
push esi
or eax, edx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], eax
call fcn.0044e7b0
mov ebp, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esp + 0x24]
add esp, 4
add edi, ebx
mov dword [esp + 0x30], ebp
test eax, eax
mov dword [esp + 0x18], edi
jle 0x44bf37
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x14]
push ebp
push ecx
call fcn.00451950
mov esi, dword [edi]
mov edi, dword [edi + 4]
mov dword [esp + 0x2c], eax
mov ebp, edi
add esp, 8
mov ecx, 0x10
mov eax, esi
mov edx, edi
xor ebx, ebx
and ebp, 0xff0000
call fcn.00526f40
or ebx, eax
or ebp, edx
mov ecx, 0x10
mov eax, ebx
mov edx, ebp
call fcn.00526f40
mov ebx, edi
xor ecx, ecx
and ebx, 0xff00
or eax, ecx
or edx, ebx
mov ecx, 0x10
call fcn.00526f40
mov ebx, edi
xor ecx, ecx
and ebx, 0xff
or eax, ecx
or edx, ebx
mov ecx, 8
call fcn.00526f40
mov ebx, eax
mov ebp, edx
mov ecx, 0x10
mov eax, esi
mov edx, edi
call fcn.00526fd0
mov ecx, esi
xor edi, edi
and ecx, 0xff00
or edx, edi
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, esi
or edx, edi
and ecx, 0xff0000
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
xor ecx, ecx
and esi, 0xff000000
or edx, ecx
or eax, esi
mov ecx, 8
call fcn.00526fd0
or ebx, eax
mov eax, dword [esp + 0x24]
or ebp, edx
mov ecx, 0x10
mov dword [eax], ebx
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov edi, dword [eax + 0xc]
mov esi, dword [eax + 8]
mov ebp, edi
mov eax, esi
mov edx, edi
and ebp, 0xff0000
call fcn.00526f40
or ebx, eax
or ebp, edx
mov ecx, 0x10
mov eax, ebx
mov edx, ebp
call fcn.00526f40
mov ebx, edi
xor ecx, ecx
and ebx, 0xff00
or eax, ecx
or edx, ebx
mov ecx, 0x10
call fcn.00526f40
mov ebx, edi
xor ecx, ecx
and ebx, 0xff
or eax, ecx
or edx, ebx
mov ecx, 8
call fcn.00526f40
mov ebx, eax
mov ebp, edx
mov ecx, 0x10
mov eax, esi
mov edx, edi
call fcn.00526fd0
mov ecx, esi
xor edi, edi
and ecx, 0xff00
or edx, edi
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
mov ecx, esi
or edx, edi
and ecx, 0xff0000
or eax, ecx
mov ecx, 0x10
call fcn.00526fd0
xor ecx, ecx
and esi, 0xff000000
or edx, ecx
or eax, esi
mov ecx, 8
call fcn.00526fd0
mov edi, dword [esp + 0x18]
or ebx, eax
mov eax, dword [esp + 0x24]
or ebp, edx
add edi, 0x10
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
inc ebp
dec eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], eax
jne 0x44bd70
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x44bf56
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.0044cc30
add esp, 0xc
test eax, eax
jne 0x44bfd4
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x50]
push ecx
push edi
call fcn.00453ad0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, eax
add esp, 8
and edx, ecx
cmp edx, 0xffffffff
je 0x44bff3
lea edx, [esp + 0x58]
push edx
push 0
push ecx
push eax
push edi
push esi
call fcn.0044d720
add esp, 0x18
test eax, eax
jne 0x44bff5
mov edi, dword [esp + 0x58]
xor ecx, ecx
mov ebx, dword [edi + 0x18]
mov ax, word [ebx + 6]
mov ch, al
shr eax, 8
or eax, ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], eax
add eax, ebp
cmp eax, ecx
jle 0x44bc66
mov eax, dword [esp + 0x54]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax]
push ecx
push str.corrupt_dinode__Lu___btree_extents_.
push edx
push 3
call fcn.00453cd0
add esp, 0x14
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
push eax
push ecx
call fcn.00453ad0
add esp, 8
mov eax, 0xffffffee
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret