Function at 0x428290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x84]
or eax, 0xffffffff
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ebx
cmp edi, ebx
je 0x429205
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x429205
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x429205
cmp dword [esp + 0x98], ebx
je 0x429205
mov ebp, dword [esp + 0x8c]
cmp ebp, ebx
jl 0x429205
mov ecx, dword [esp + 0x88]
jg 0x42830a
cmp ecx, ebx
jb 0x429205
cmp dword [esp + 0x94], ebx
jl 0x429205
jg 0x428326
cmp dword [esp + 0x90], ebx
jb 0x429205
movzx eax, word [edi + 0xc]
xor edx, edx
test al, al
setne dl
mov byte [edi + 0x46], bl
mov esi, edx
mov dword [esp + 0x18], esi
test eax, 0x4000
je 0x428361
cmp esi, ebx
jne 0x428351
mov eax, dword [esp + 0x10]
cmp dword [eax + 0xd8], ebx
jne 0x42838e
call fcn.004dc440
mov dword [eax], 0xd
jmp 0x429237
cmp esi, ebx
je 0x42838e
cmp dword [edi + 8], 0x80
jne 0x42838e
cmp ebp, dword [edi + 0x34]
jl 0x42838e
jg 0x42837a
cmp ecx, dword [edi + 0x30]
jbe 0x42838e
push ebp
push ecx
mov eax, edi
call fcn.0042e4a0
add esp, 8
test eax, eax
jne 0x429237
mov eax, dword [edi + 0x18]
mov ecx, eax
shr ecx, 1
and ecx, 1
mov dword [esp + 0x28], ecx
cmp esi, ebx
je 0x4283bf
cmp dword [edi + 8], 0x80
jne 0x4283af
cmp byte [edi + 0xc], 1
je 0x4283bf
call fcn.004dc440
mov dword [eax], 0x5f
jmp 0x429237
mov ecx, dword [esp + 0x90]
or ecx, dword [esp + 0x94]
je 0x429242
cmp dword [edi + 8], 0x80
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x94]
mov esi, dword [edi + 0x28]
mov dword [esp + 0x50], edx
mov edx, dword [edi + 0x2c]
mov dword [esp + 0x54], ecx
mov ebx, esi
mov ecx, edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ecx
jne 0x42841d
cmp ebp, ecx
jl 0x42841d
jg 0x428413
cmp dword [esp + 0x88], ebx
jb 0x42841d
test al, 2
je 0x42841d
or eax, 0x10
mov dword [edi + 0x18], eax
mov ecx, dword [esp + 0x88]
add ecx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov eax, ebp
adc eax, ebx
cmp eax, edx
jl 0x428499
jg 0x428440
cmp ecx, esi
jbe 0x428499
test byte [edi + 0x18], 0x10
mov edx, 0
setne dl
inc edx
push edx
push eax
push ecx
push edi
call fcn.0042e300
add esp, 0x10
test eax, eax
je 0x428485
push str.Failed_to_enlarge_attribute
push 0
push 0x739
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x14
jmp 0x429237
xor eax, eax
cmp byte [edi + 0xc], al
mov dword [esp + 0x24], 2
setne al
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
je 0x4284e0
mov ecx, dword [edi + 0x40]
mov edx, dword [esp + 0x88]
xor eax, eax
dec ecx
or eax, ebp
or ecx, edx
sub ecx, edx
sbb eax, ebp
add ecx, 1
adc eax, 0
cmp ebx, eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
jl 0x4284e0
jg 0x4284d2
cmp dword [esp + 0x90], ecx
jbe 0x4284e0
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x34]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
test dl, 2
jne 0x4286d1
mov ebx, dword [edi + 4]
xor ebp, ebp
cmp ebx, ebp
jne 0x428537
call fcn.004dc440
push str.NULL_arguments
push ebp
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425280
add esp, 0x14
xor ebx, ebx
jmp 0x42902e
push 0x20
call fcn.004d5c5c
mov esi, eax
add esp, 4
cmp esi, ebp
jne 0x42856b
push ebp
push 0x20
push str.Failed_to_malloc__lld_bytes
push ebp
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425280
add esp, 0x1c
jmp 0x42858f
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov ebx, esi
cmp esi, ebp
je 0x42902e
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push esi
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
push eax
push ecx
call fcn.0042a250
add esp, 0x24
test eax, eax
je 0x4285e3
push str.ntfs_attr_pwrite
push str._s:_lookup_failed
push ebp
push 0x75f
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x42902e
mov ecx, dword [esi + 4]
movzx eax, word [ecx + 0x14]
add eax, ecx
cmp eax, ecx
jb 0x42869a
mov edx, dword [ecx + 0x10]
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 0x1c]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
ja 0x428698
mov edx, dword [esp + 0x90]
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x8c]
push ecx
add edx, eax
push edx
call fcn.004d57a0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esi]
push ecx
push edx
push ebp
call fcn.004255f0
add esp, 0x18
test eax, eax
je 0x42866f
push str.ntfs_attr_pwrite
push str._s:_failed_to_write_mft_record
push 0
push 0x774
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x42902e
push esi
call fcn.004d5b05
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov edx, ecx
pop ebx
add esp, 0x70
ret
xor ebp, ebp
call fcn.004dc440
push str.ntfs_attr_pwrite
push str._s:_Sanity_check_failed
push ebp
push 0x767
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x42902e
mov esi, dword [esp + 0x88]
mov ebp, dword [esp + 0x8c]
mov ebx, esi
add ebx, dword [esp + 0x90]
adc ebp, dword [esp + 0x94]
mov dword [esp + 0x60], ebx
cmp ebp, eax
jl 0x428933
jg 0x428705
cmp ebx, ecx
jbe 0x428933
test dl, 0x10
je 0x428763
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x8c]
call fcn.00515670
cmp dword [esp + 0x18], 0
mov esi, eax
mov ebx, edx
je 0x42873b
movzx eax, byte [edi + 0x45]
neg eax
cdq
and esi, eax
and ebx, edx
mov eax, esi
or eax, ebx
je 0x428747
add esi, 0xffffffff
adc ebx, 0xffffffff
push ebx
push esi
call fcn.004261d0
add esp, 8
test eax, eax
jne 0x42902a
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
jmp 0x428772
mov eax, edi
call fcn.00426450
test eax, eax
jne 0x42902a
cmp dword [esp + 0x18], 0
je 0x428795
mov eax, dword [edi]
push 2
mov ebx, edi
call fcn.00437af0
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x42902a
mov byte [edi + 0x46], 2
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x4287d2
call fcn.004dc440
push str.NULL_arguments
push ebx
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425280
add esp, 0x14
mov dword [esp + 0x14], ebx
jmp 0x42902a
push 0x20
call fcn.004d5c5c
mov esi, eax
add esp, 4
test esi, esi
jne 0x428806
push eax
push 0x20
push str.Failed_to_malloc__lld_bytes
push eax
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425280
add esp, 0x1c
jmp 0x42882c
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
xor eax, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x42902a
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push esi
push 0
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call fcn.0042a250
add esp, 0x24
test eax, eax
jne 0x42902a
mov eax, dword [edi + 0x34]
mov edx, dword [esp + 0x8c]
cmp edx, eax
mov ecx, dword [edi + 0x30]
jl 0x42889b
jg 0x42887b
cmp dword [esp + 0x88], ecx
jbe 0x42889b
mov ebx, dword [esp + 0x88]
sub ebx, ecx
sbb edx, eax
push edx
push ebx
push eax
push ecx
push edi
call fcn.004271a0
add esp, 0x14
test eax, eax
jne 0x42902a
cmp dword [esp + 0x18], 0
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x60]
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ebp
je 0x4288c4
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ebp
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
mov dword [eax + 0x30], edx
mov ecx, dword [eax + 0x3c]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, dword [esp + 0x10]
push edx
push eax
mov eax, dword [esi]
push ebx
call fcn.004255f0
add esp, 0xc
test eax, eax
je 0x42890c
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], edx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esi]
push ecx
push edx
push ebx
call fcn.004255f0
add esp, 0xc
jmp 0x42902a
mov eax, dword [esp + 0x60]
push esi
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebp
call fcn.004d5b05
mov esi, dword [esp + 0x8c]
add esp, 4
or dword [esp + 0x24], 1
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
movzx ecx, byte [ecx + 0x24]
mov ebp, dword [esp + 0x8c]
mov eax, esi
mov edx, ebp
call fcn.00515670
push edx
push eax
mov eax, edi
call fcn.004267e0
mov ebx, eax
add esp, 8
mov dword [esp + 0x1c], ebx
test ebx, ebx
jne 0x4289a6
call fcn.004dc440
cmp dword [eax], 2
jne 0x42902a
call fcn.004dc440
push str.ntfs_attr_pwrite
push str._s:_Failed_to_find_VCN_3
push ebx
push 0x7e4
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x42902a
xor eax, eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x18], eax
je 0x428a71
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
and edx, ecx
cmp edx, 0xffffffff
jne 0x428a15
cmp dword [esp + 0x28], eax
je 0x428a15
movzx ecx, byte [edi + 0x45]
mov eax, ecx
cdq
mov dword [esp + 0x78], eax
mov eax, dword [ebx + 0x14]
cmp eax, edx
jg 0x4289ed
jl 0x4289e6
mov edx, dword [ebx + 0x10]
cmp edx, dword [esp + 0x78]
jae 0x4289ed
sub ecx, dword [ebx + 0x10]
mov eax, ecx
jmp 0x428a4f
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
lea eax, [esp + 0x40]
push eax
push ecx
push edx
push ebp
lea eax, [esp + 0x2c]
push esi
push eax
mov eax, edi
call fcn.004279b0
add esp, 0x18
jmp 0x428a4b
test ecx, ecx
jl 0x428a5b
jg 0x428a21
cmp dword [ebx + 8], 0
jb 0x428a5b
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
push ecx
mov ecx, dword [esp + 0x94]
lea edx, [esp + 0x44]
push edx
push eax
push ecx
push ebp
push esi
lea edx, [esp + 0x34]
push edx
push edi
call fcn.00427db0
add esp, 0x20
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
test eax, eax
jl 0x42902a
test byte [edi + 0x18], 4
je 0x428a71
movzx ecx, byte [edi + 0x45]
cmp eax, ecx
jge 0x428a71
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.004daa70
mov ecx, esi
sub ecx, eax
mov eax, ebp
sbb eax, edx
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x90]
or eax, dword [esp + 0x94]
mov dword [esp + 0x28], ecx
je 0x428ede
cmp dword [ebx + 8], 0xfffffffe
jne 0x428b17
cmp dword [ebx + 0xc], 0xffffffff
jne 0x428b17
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [esp + 0x84]
push ecx
push edx
call fcn.004267e0
mov ebx, eax
add esp, 8
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x428f0a
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 0x24]
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
call fcn.004daa70
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
sub edi, eax
sbb esi, edx
add edi, dword [esp + 0x88]
adc esi, dword [esp + 0x8c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], esi
jmp 0x428b1f
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebp, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ecx, ebp
or ecx, eax
je 0x428f50
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
test edx, edx
jg 0x428b98
jl 0x428b3f
test eax, eax
jae 0x428b98
mov ecx, dword [ebx]
add ecx, ebp
mov dword [esp + 0x60], ecx
mov ecx, dword [ebx + 4]
adc ecx, dword [ebx + 0x14]
and eax, edx
mov dword [esp + 0x64], ecx
cmp eax, 0xffffffff
jne 0x428f85
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x58]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
mov eax, dword [esp + 0x98]
call fcn.00427400
add esp, 0x14
test eax, eax
jne 0x429023
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
cmp dword [esp + 0x18], 0
je 0x428bdf
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
mov ecx, eax
or ecx, edx
je 0x428bdf
mov ecx, dword [esp + 0x10]
movzx ebp, byte [ecx + 0x24]
mov ecx, ebp
call fcn.004daa70
cmp esi, edx
jl 0x428bd7
jg 0x428bc4
cmp edi, eax
jb 0x428bd7
sub edi, eax
mov eax, dword [ebx + 0x28]
sbb esi, edx
mov edx, dword [ebx + 0x2c]
add ebx, 0x18
mov ecx, eax
or ecx, edx
jne 0x428bb3
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
call fcn.004daa70
mov ecx, dword [esp + 0x94]
sub eax, edi
sbb edx, esi
cmp ecx, edx
jg 0x428c19
jl 0x428c0c
cmp dword [esp + 0x90], eax
jae 0x428c19
mov eax, dword [esp + 0x90]
mov dword [esp + 0x34], ecx
jmp 0x428c1d
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x10]
test byte [ecx + 8], 1
jne 0x428e43
mov eax, dword [ebx + 8]
mov edx, ecx
movzx esi, byte [edx + 0x24]
mov edx, dword [ebx + 0xc]
mov ecx, esi
call fcn.004daa70
mov edi, dword [esp + 0x28]
add eax, edi
adc edx, dword [esp + 0x2c]
mov dword [esp + 0x48], eax
mov eax, dword [ebx]
mov dword [esp + 0x4c], edx
mov edx, dword [ebx + 4]
mov ecx, esi
call fcn.004daa70
add eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x18]
mov ebp, edx
adc ebp, dword [esp + 0x34]
add eax, edi
adc ebp, dword [esp + 0x2c]
xor esi, esi
mov edi, ecx
add edi, eax
adc esi, ebp
sub edi, 1
sbb esi, 0
dec ecx
xor edx, edx
not ecx
not edx
and edi, ecx
and esi, edx
sub edi, eax
mov dword [esp + 0x78], eax
sbb esi, ebp
mov eax, edi
or eax, esi
je 0x428dcd
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x84]
cmp ecx, dword [eax + 0x30]
jne 0x428cb7
cmp ebp, dword [eax + 0x34]
je 0x428ce0
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 0x24]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
call fcn.004daa70
cmp ebp, edx
jg 0x428dcd
jl 0x428ce0
cmp dword [esp + 0x78], eax
jae 0x428dcd
add edi, dword [esp + 0x30]
adc esi, dword [esp + 0x34]
call fcn.00434580
mov ebp, eax
mov dword [esp + 0x1c], ebp
test ebp, ebp
je 0x429023
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x98]
push eax
push ecx
push ebp
call fcn.004d57a0
mov eax, dword [esp + 0x3c]
mov edx, edi
sub edx, eax
push edx
add eax, ebp
push 0
push eax
call fcn.004d5720
add esp, 0x18
cmp dword [esp + 0x18], 0
je 0x428d81
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
mov edx, ebp
push edx
mov edx, dword [esp + 0x38]
push esi
push edi
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0xa8]
push ecx
push edx
push ebx
push eax
call fcn.00443060
mov ecx, dword [esp + 0x50]
add esp, 0x34
push ecx
mov ebp, eax
mov dword [esp + 0x60], edx
call fcn.004d5b05
add esp, 4
jmp 0x428e4f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x14]
push esi
push edi
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.00437140
mov ebp, eax
add esp, 0x18
mov dword [esp + 0x5c], edx
cmp ebp, edi
jne 0x428dbb
cmp edx, esi
jne 0x428dbb
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004d5b05
add esp, 4
jmp 0x428e4f
cmp dword [esp + 0x18], 0
mov ecx, dword [esp + 0x98]
je 0x428e1b
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
push eax
push ecx
mov ecx, dword [esp + 0x64]
push eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0xa8]
push ecx
push edx
push ebx
push eax
call fcn.00443060
add esp, 0x34
mov ebp, eax
jmp 0x428e53
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [eax]
push edx
push ecx
call fcn.00437140
add esp, 0x18
mov ebp, eax
jmp 0x428e53
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x5c]
xor eax, eax
cmp edx, eax
jl 0x428e84
jg 0x428e5f
cmp ebp, eax
jbe 0x428e84
add dword [esp + 0x38], ebp
adc dword [esp + 0x3c], edx
sub dword [esp + 0x90], ebp
sbb dword [esp + 0x94], edx
sub dword [esp + 0x50], ebp
sbb dword [esp + 0x54], edx
add dword [esp + 0x98], ebp
cmp ebp, dword [esp + 0x30]
jne 0x428e90
cmp edx, dword [esp + 0x34]
je 0x428eb0
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
jne 0x428fc2
call fcn.004dc440
cmp dword [eax], 4
je 0x428c21
jmp 0x428fd1
mov ecx, dword [esp + 0x90]
add ebx, 0x18
or ecx, dword [esp + 0x94]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
jne 0x428ab1
mov edi, dword [esp + 0x84]
test byte [edi + 0x18], 0x18
je 0x429242
mov ecx, dword [esp + 0x44]
test ecx, ecx
jg 0x4291ef
jl 0x428f01
cmp dword [esp + 0x40], 0
jae 0x4291ef
xor eax, eax
xor ecx, ecx
jmp 0x4291f3
call fcn.004dc440
cmp dword [eax], 2
jne 0x428fd1
call fcn.004dc440
push str.ntfs_attr_pwrite
push str._s:_Failed_to_find_VCN_4
push 0
push 0x82f
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x428fd1
call fcn.004dc440
push str.ntfs_attr_pwrite
push str._s:_Zero_run_length
push 0
push 0x838
mov dword [eax], 5
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
jmp 0x428fd1
call fcn.004dc440
mov dword [eax], 5
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
push edx
push eax
push str.ntfs_attr_pwrite
push str._s:_Unexpected_LCN___lld_
push 0
push 0x842
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x20
jmp 0x428fd1
or ebp, edx
jne 0x428fd1
call fcn.004dc440
mov dword [eax], 5
call fcn.004dc440
mov ecx, dword [esp + 0x38]
mov esi, dword [eax]
mov eax, dword [esp + 0x3c]
mov edx, ecx
or edx, eax
je 0x42901c
test byte [esp + 0x24], 1
je 0x428ed7
add ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
adc eax, dword [esp + 0x8c]
cmp eax, dword [edi + 0x34]
jg 0x428ede
jl 0x42902a
cmp ecx, dword [edi + 0x30]
ja 0x428ede
jmp 0x42902a
call fcn.004dc440
mov dword [eax], esi
mov edi, dword [esp + 0x84]
mov ebx, dword [esp + 0x14]
call fcn.004dc440
test byte [esp + 0x24], 1
mov ebp, dword [eax]
je 0x429166
test ebx, ebx
jne 0x4290e5
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x429081
call fcn.004dc440
push str.NULL_arguments
push ebx
push 0xd72
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_get_search_ctx
mov eax, 0x100
call fcn.00425280
add esp, 0x14
jmp 0x429143
push 0x20
call fcn.004d5c5c
mov esi, eax
add esp, 4
test esi, esi
jne 0x4290b7
push eax
push 0x20
push str.Failed_to_malloc__lld_bytes
push eax
push 0x3b
push str..libntfsmisc.c
push str.ntfs_malloc
mov eax, 0x100
call fcn.00425280
add esp, 0x1c
xor eax, eax
jmp 0x4290dd
mov eax, dword [ebx + 8]
mov dword [esi], eax
movzx ecx, word [eax + 0x14]
add ecx, eax
xor eax, eax
mov dword [esi + 4], ecx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov ebx, esi
cmp esi, eax
jne 0x4290ec
jmp 0x429143
mov eax, ebx
call fcn.0042a3c0
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
push ebx
push 0
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call fcn.0042a250
add esp, 0x24
test eax, eax
jne 0x429143
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], edx
mov eax, dword [ebx + 4]
mov dword [eax + 0x38], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x3c], edx
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebx]
push ecx
call fcn.004255f0
add esp, 0xc
test eax, eax
je 0x429166
push str.Eeek__Failed_to_recover_from_error._Leaving_metadata_in_inconsistent_state__Run_chkdsk__n
push 0
push 0x8ec
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x80
call fcn.00425280
add esp, 0x14
test ebx, ebx
je 0x429173
push ebx
call fcn.004d5b05
add esp, 4
cmp dword [esp + 0x18], 0
je 0x4291e0
mov eax, dword [edi + 0x18]
shr eax, 3
and eax, 1
test eax, eax
je 0x429195
push 0
push 0
mov edx, edi
call fcn.0042d920
add esp, 8
test byte [esp + 0x24], 2
je 0x4291d7
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push edx
push eax
mov edx, edi
call fcn.0042e460
add esp, 8
test eax, eax
je 0x4291d7
push str.Failed_to_restore_data_size
push 0
push 0x8f8
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x14
call fcn.004dc440
mov dword [eax], ebp
jmp 0x429237
mov eax, dword [esp + 0x40]
and eax, dword [esp + 0x44]
cmp eax, 0xffffffff
jne 0x429187
jmp 0x429195
mov eax, dword [esp + 0x40]
push ecx
push eax
mov edx, edi
call fcn.0042d920
add esp, 8
test eax, eax
je 0x429242
jmp 0x429237
call fcn.004dc440
push str.ntfs_attr_pwrite
push 0x548560
push ebx
push 0x6fa
mov dword [eax], 0x16
push str..libntfs_attrib.c
push str.ntfs_attr_pwrite
mov eax, 0x100
call fcn.00425280
add esp, 0x18
or eax, 0xffffffff
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret