Function at 0x4415b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
movzx edx, word [esi + 0xc]
mov ecx, dword [eax + 0x14]
and ecx, 0x800
push edi
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
test eax, eax
je 0x441edc
cmp dword [eax + 0xc], 0
je 0x441edc
cmp dword [esp + 0xa4], 0
je 0x441edc
cmp dl, 1
jne 0x441edc
cmp dword [esp + 0x98], 0
jl 0x441edc
mov ecx, dword [esp + 0x94]
jg 0x44161b
test ecx, ecx
jb 0x441edc
mov ebx, dword [esp + 0xa0]
test ebx, ebx
jl 0x441edc
mov edi, dword [esp + 0x9c]
jg 0x44163b
test edi, edi
jb 0x441edc
mov eax, esi
call fcn.004256f0
test eax, eax
je 0x441660
call fcn.004dc440
pop edi
mov dword [eax], 0xd
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
mov eax, edi
or eax, ebx
jne 0x441672
pop edi
pop esi
xor edx, edx
pop ebx
add esp, 0x84
ret
mov eax, dword [esi + 0x2c]
mov edx, ecx
add edx, edi
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x98]
adc edx, ebx
cmp edx, eax
push ebp
mov ebp, dword [esi + 0x28]
jl 0x4416cc
jg 0x441696
cmp dword [esp + 0x58], ebp
jbe 0x4416cc
mov edx, dword [esp + 0x9c]
cmp edx, eax
jl 0x4416b6
jg 0x4416a7
cmp ecx, ebp
jb 0x4416b6
pop ebp
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x84
ret
sub ebp, ecx
sbb eax, edx
mov edi, ebp
mov ebx, eax
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], ebx
test byte [esi + 0x18], 2
jne 0x4416f9
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0x9c]
push edx
push ebx
push edi
push eax
push ecx
push esi
call fcn.004270f0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov ebp, dword [esi + 0x34]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x9c]
mov edx, ecx
add edx, edi
adc eax, ebx
cmp eax, ebp
jl 0x441796
jg 0x441726
cmp edx, dword [esi + 0x30]
jbe 0x441796
mov edx, dword [esp + 0x9c]
cmp edx, ebp
jl 0x44175a
jg 0x441738
cmp ecx, dword [esi + 0x30]
jb 0x44175a
mov ecx, dword [esp + 0xa8]
push edi
push 0
push ecx
call fcn.004d5720
add esp, 0xc
pop ebp
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x84
ret
mov eax, ecx
sub eax, dword [esi + 0x30]
mov ecx, edx
mov edx, dword [esp + 0xa8]
sbb ecx, ebp
add eax, edi
adc ecx, ebx
sub edi, eax
push eax
sbb ebx, ecx
mov dword [esp + 0xa4], edi
add edi, edx
push 0
push edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0xb0], ebx
call fcn.004d5720
add esp, 0xc
mov eax, dword [esi + 4]
movzx edx, byte [esi + 0x45]
mov edi, dword [esi + 0x40]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edi
lea ebx, [edi - 1]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x80], edx
call fcn.00434580
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x4417e2
call fcn.00434580
mov dword [esp + 0x28], eax
test eax, eax
jne 0x4417f2
push ebp
call fcn.004d5b05
add esp, 4
or eax, 0xffffffff
or edx, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x24]
mov edi, ebx
not edi
not ebp
mov eax, edi
and eax, dword [esp + 0x98]
mov edx, ebp
and edx, dword [esp + 0x9c]
call fcn.004daa90
and ebx, dword [esp + 0x98]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x3c]
and edx, dword [esp + 0x9c]
mov dword [esp + 0x50], eax
mov eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
xor edx, edx
add eax, dword [esp + 0x98]
adc edx, dword [esp + 0x9c]
add eax, dword [esp + 0xa0]
adc edx, dword [esp + 0xa4]
add eax, 0xffffffff
adc edx, 0xffffffff
and eax, edi
movzx edi, byte [ecx + 0x24]
and edx, ebp
mov ecx, edi
call fcn.004daa90
sub eax, dword [esp + 0x50]
mov ecx, edi
sbb edx, dword [esp + 0x54]
call fcn.004daa70
movzx ecx, byte [esi + 0x44]
call fcn.00515670
mov edx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
add edx, eax
mov dword [esp + 0x84], edx
jmp 0x4418b0
mov eax, dword [esp + 0x50]
dec dword [esp + 0x4c]
mov edx, dword [esp + 0x54]
mov edi, dword [esp + 0x18]
mov ebp, eax
add eax, dword [esp + 0x80]
mov ecx, edx
mov dword [esp + 0x50], eax
mov eax, 0
adc edx, eax
push ecx
push ebp
mov eax, esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x5c], edx
call fcn.004267e0
add esp, 8
test eax, eax
je 0x441e98
mov edx, dword [eax + 0xc]
cmp edx, 0xffffffff
mov ecx, dword [eax + 8]
jl 0x441e98
jg 0x441914
cmp ecx, 0xffffffff
jb 0x441e98
and ecx, edx
cmp ecx, 0xffffffff
jne 0x441981
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0xa4]
sub edi, ebx
mov eax, 0
sbb eax, dword [esp + 0x30]
cmp ebp, eax
jg 0x441949
jl 0x441940
cmp dword [esp + 0xa0], edi
jae 0x441949
mov edi, dword [esp + 0xa0]
jmp 0x44194b
mov ebp, eax
mov ecx, dword [esp + 0xa8]
push edi
xor ebx, ebx
push ebx
push ecx
call fcn.004d5720
add esp, 0xc
add dword [esp + 0x10], edi
adc dword [esp + 0x14], ebp
sub dword [esp + 0xa0], edi
sbb dword [esp + 0xa4], ebp
add dword [esp + 0xa8], edi
jmp 0x441c91
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x64]
push edx
push ecx
push ebp
push esi
mov ecx, eax
call fcn.004414e0
add esp, 0x10
test eax, eax
jne 0x441ae0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0xa4]
sub ecx, ebx
sbb eax, dword [esp + 0x30]
cmp edx, eax
jg 0x4419d3
jl 0x4419c2
cmp dword [esp + 0xa0], ecx
jae 0x4419d3
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jmp 0x4419db
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x34]
movzx ecx, byte [ecx + 0x24]
mov edx, dword [esp + 0x64]
mov eax, ebp
call fcn.004daa70
add ebx, eax
adc dword [esp + 0x30], edx
mov eax, esi
call fcn.004256d0
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [esi + 0x34]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x78], ecx
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x7c], edx
mov edx, eax
mov dword [esi + 0x30], eax
mov eax, ecx
mov byte [esi + 0xc], 0
mov dword [esi + 0x34], ecx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push ebx
push esi
call fcn.004270f0
mov edi, edx
add esp, 0x18
mov ebp, eax
test edi, edi
jl 0x441cd2
jg 0x441a68
test ebp, ebp
jbe 0x441cd2
add dword [esp + 0x10], ebp
mov eax, dword [esp + 0x20]
adc dword [esp + 0x14], edi
sub dword [esp + 0xa0], ebp
sbb dword [esp + 0xa4], edi
add dword [esp + 0xa8], ebp
sub dword [esp + 0x1c], ebp
sbb eax, edi
add ebx, ebp
adc dword [esp + 0x30], edi
mov dword [esp + 0x20], eax
test eax, eax
jg 0x441a31
jl 0x441aa6
cmp dword [esp + 0x1c], 0
ja 0x441a31
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x78]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x7c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x34], edx
or dword [eax + 0x14], ecx
mov dx, word [esp + 0x44]
xor ebx, ebx
mov word [esi + 0xc], dx
mov dword [esp + 0x30], ebx
jmp 0x441c95
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov eax, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
call fcn.004256d0
mov eax, dword [esi + 0x28]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x74], eax
mov eax, dword [esi + 0x30]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x34]
mov byte [esi + 0xc], cl
mov dword [esi + 0x2c], eax
jmp 0x441b34
mov ebp, dword [esp + 0x60]
push edi
push ecx
mov ecx, dword [esp + 0x3c]
movzx ecx, byte [ecx + 0x24]
mov eax, edi
sub eax, dword [esp + 0x20]
push edx
cdq
mov edi, eax
mov eax, edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x94], eax
mov eax, ebp
call fcn.004daa70
add edi, eax
mov eax, dword [esp + 0x94]
adc eax, edx
push eax
push edi
push esi
call fcn.004270f0
mov ebp, edx
add esp, 0x18
mov edi, eax
mov dword [esp + 0x8c], edi
test ebp, ebp
jl 0x441d8b
jg 0x441b8f
test edi, edi
jbe 0x441d8b
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add edi, eax
sub edx, eax
sbb ecx, ebp
mov dword [esp + 0x40], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
test ecx, ecx
jg 0x441b30
jl 0x441bc6
test edx, edx
ja 0x441b30
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x34], edx
or dword [eax + 0x14], ecx
mov dx, word [esp + 0x44]
lea eax, [edi + 2]
mov word [esi + 0xc], dx
cmp eax, dword [esp + 0x84]
ja 0x441c06
xor ecx, ecx
mov word [edi], cx
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push ebp
mov eax, edi
mov edx, edi
call fcn.00441260
add esp, 4
test eax, eax
jl 0x441e55
sub edi, ebx
mov eax, 0
sbb eax, dword [esp + 0x30]
cmp dword [esp + 0xa4], eax
jg 0x441c56
jl 0x441c46
cmp dword [esp + 0xa0], edi
jae 0x441c56
mov edi, dword [esp + 0xa0]
mov ebp, dword [esp + 0xa4]
jmp 0x441c58
mov ebp, eax
mov edx, dword [esp + 0x28]
add ebx, edx
push edi
push ebx
mov ebx, dword [esp + 0xb0]
push ebx
call fcn.004d57a0
add esp, 0xc
add dword [esp + 0x10], edi
adc dword [esp + 0x14], ebp
sub dword [esp + 0xa0], edi
sbb dword [esp + 0xa4], ebp
add ebx, edi
mov dword [esp + 0xa8], ebx
xor ebx, ebx
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x4c], 0
jne 0x4418b0
mov edx, dword [esp + 0x18]
push edx
call fcn.004d5b05
mov eax, dword [esp + 0x2c]
push eax
call fcn.004d5b05
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
add esp, 8
add eax, dword [esp + 0x10]
pop ebp
adc edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov eax, ebp
or eax, edi
jne 0x441d16
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push ebx
push edx
push eax
push str.Failed_to_read_an_uncompressed_cluster__inode__lld_offs_0x_llx_n
push 0
push 0x2f3
push str..libntfscompress.c
push str.ntfs_compressed_attr_pread
mov eax, 0x80
call fcn.00425280
add esp, 0x24
call fcn.004dc440
mov dword [eax], 5
call fcn.004dc440
mov ebx, dword [eax]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x78]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x48]
mov dword [esi + 0x34], ecx
or dword [eax + 0x14], edx
mov ecx, dword [esp + 0x18]
mov ax, word [esp + 0x44]
push ecx
mov word [esi + 0xc], ax
call fcn.004d5b05
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d5b05
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417e7
call fcn.004dc440
mov dword [eax], ebx
mov eax, ebp
pop ebp
mov edx, edi
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov edx, edi
or edx, ebp
jne 0x441de0
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x24]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
call fcn.004daa70
push edx
push eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
push str.Failed_to_read_a_compressed_cluster___inode__lld_offs_0x_llx_n
push 0
push 0x32e
push str..libntfscompress.c
push str.ntfs_compressed_attr_pread
mov eax, 0x80
call fcn.00425280
add esp, 0x24
call fcn.004dc440
mov dword [eax], 5
call fcn.004dc440
mov ebx, dword [eax]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x30], edx
or dword [eax + 0x14], ecx
mov eax, dword [esp + 0x18]
mov dx, word [esp + 0x44]
push eax
mov word [esi + 0xc], dx
call fcn.004d5b05
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004d5b05
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417e7
call fcn.004dc440
mov dword [eax], ebx
mov edx, ebp
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x84
ret
call fcn.004dc440
mov edx, dword [esp + 0x18]
mov esi, dword [eax]
push edx
call fcn.004d5b05
push ebp
call fcn.004d5b05
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417e7
call fcn.004dc440
pop ebp
pop edi
mov dword [eax], esi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004d5b05
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d5b05
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417e7
call fcn.004dc440
pop ebp
pop edi
mov dword [eax], 5
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
call fcn.004dc440
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret