Function at 0x441580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
movzx edx, word [esi + 0xc]
mov ecx, dword [eax + 0x14]
and ecx, 0x800
push edi
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
test eax, eax
je 0x441eac
cmp dword [eax + 0xc], 0
je 0x441eac
cmp dword [esp + 0xa4], 0
je 0x441eac
cmp dl, 1
jne 0x441eac
cmp dword [esp + 0x98], 0
jl 0x441eac
mov ecx, dword [esp + 0x94]
jg 0x4415eb
test ecx, ecx
jb 0x441eac
mov ebx, dword [esp + 0xa0]
test ebx, ebx
jl 0x441eac
mov edi, dword [esp + 0x9c]
jg 0x44160b
test edi, edi
jb 0x441eac
mov eax, esi
call fcn.004256c0
test eax, eax
je 0x441630
call fcn.004ff09d
pop edi
mov dword [eax], 0xd
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
mov eax, edi
or eax, ebx
jne 0x441642
pop edi
pop esi
xor edx, edx
pop ebx
add esp, 0x84
ret
mov eax, dword [esi + 0x2c]
mov edx, ecx
add edx, edi
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x98]
adc edx, ebx
cmp edx, eax
push ebp
mov ebp, dword [esi + 0x28]
jl 0x44169c
jg 0x441666
cmp dword [esp + 0x58], ebp
jbe 0x44169c
mov edx, dword [esp + 0x9c]
cmp edx, eax
jl 0x441686
jg 0x441677
cmp ecx, ebp
jb 0x441686
pop ebp
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x84
ret
sub ebp, ecx
sbb eax, edx
mov edi, ebp
mov ebx, eax
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], ebx
test byte [esi + 0x18], 2
jne 0x4416c9
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0x9c]
push edx
push ebx
push edi
push eax
push ecx
push esi
call fcn.004270c0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov ebp, dword [esi + 0x34]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x9c]
mov edx, ecx
add edx, edi
adc eax, ebx
cmp eax, ebp
jl 0x441766
jg 0x4416f6
cmp edx, dword [esi + 0x30]
jbe 0x441766
mov edx, dword [esp + 0x9c]
cmp edx, ebp
jl 0x44172a
jg 0x441708
cmp ecx, dword [esi + 0x30]
jb 0x44172a
mov ecx, dword [esp + 0xa8]
push edi
push 0
push ecx
call fcn.004f8090
add esp, 0xc
pop ebp
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x84
ret
mov eax, ecx
sub eax, dword [esi + 0x30]
mov ecx, edx
mov edx, dword [esp + 0xa8]
sbb ecx, ebp
add eax, edi
adc ecx, ebx
sub edi, eax
push eax
sbb ebx, ecx
mov dword [esp + 0xa4], edi
add edi, edx
push 0
push edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0xb0], ebx
call fcn.004f8090
add esp, 0xc
mov eax, dword [esi + 4]
movzx edx, byte [esi + 0x45]
mov edi, dword [esi + 0x40]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], edi
lea ebx, [edi - 1]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x80], edx
call fcn.00434550
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x4417b2
call fcn.00434550
mov dword [esp + 0x28], eax
test eax, eax
jne 0x4417c2
push ebp
call fcn.004f84cf
add esp, 4
or eax, 0xffffffff
or edx, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x24]
mov edi, ebx
not edi
not ebp
mov eax, edi
and eax, dword [esp + 0x98]
mov edx, ebp
and edx, dword [esp + 0x9c]
call fcn.004f84b0
and ebx, dword [esp + 0x98]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x3c]
and edx, dword [esp + 0x9c]
mov dword [esp + 0x50], eax
mov eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
xor edx, edx
add eax, dword [esp + 0x98]
adc edx, dword [esp + 0x9c]
add eax, dword [esp + 0xa0]
adc edx, dword [esp + 0xa4]
add eax, 0xffffffff
adc edx, 0xffffffff
and eax, edi
movzx edi, byte [ecx + 0x24]
and edx, ebp
mov ecx, edi
call fcn.004f84b0
sub eax, dword [esp + 0x50]
mov ecx, edi
sbb edx, dword [esp + 0x54]
call fcn.004f9360
movzx ecx, byte [esi + 0x44]
call fcn.005382a0
mov edx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
add edx, eax
mov dword [esp + 0x84], edx
jmp 0x441880
mov eax, dword [esp + 0x50]
dec dword [esp + 0x4c]
mov edx, dword [esp + 0x54]
mov edi, dword [esp + 0x18]
mov ebp, eax
add eax, dword [esp + 0x80]
mov ecx, edx
mov dword [esp + 0x50], eax
mov eax, 0
adc edx, eax
push ecx
push ebp
mov eax, esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x5c], edx
call fcn.004267b0
add esp, 8
test eax, eax
je 0x441e68
mov edx, dword [eax + 0xc]
cmp edx, 0xffffffff
mov ecx, dword [eax + 8]
jl 0x441e68
jg 0x4418e4
cmp ecx, 0xffffffff
jb 0x441e68
and ecx, edx
cmp ecx, 0xffffffff
jne 0x441951
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0xa4]
sub edi, ebx
mov eax, 0
sbb eax, dword [esp + 0x30]
cmp ebp, eax
jg 0x441919
jl 0x441910
cmp dword [esp + 0xa0], edi
jae 0x441919
mov edi, dword [esp + 0xa0]
jmp 0x44191b
mov ebp, eax
mov ecx, dword [esp + 0xa8]
push edi
xor ebx, ebx
push ebx
push ecx
call fcn.004f8090
add esp, 0xc
add dword [esp + 0x10], edi
adc dword [esp + 0x14], ebp
sub dword [esp + 0xa0], edi
sbb dword [esp + 0xa4], ebp
add dword [esp + 0xa8], edi
jmp 0x441c61
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x64]
push edx
push ecx
push ebp
push esi
mov ecx, eax
call fcn.004414b0
add esp, 0x10
test eax, eax
jne 0x441ab0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0xa4]
sub ecx, ebx
sbb eax, dword [esp + 0x30]
cmp edx, eax
jg 0x4419a3
jl 0x441992
cmp dword [esp + 0xa0], ecx
jae 0x4419a3
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jmp 0x4419ab
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x34]
movzx ecx, byte [ecx + 0x24]
mov edx, dword [esp + 0x64]
mov eax, ebp
call fcn.004f9360
add ebx, eax
adc dword [esp + 0x30], edx
mov eax, esi
call fcn.004256a0
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [esi + 0x34]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x78], ecx
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x7c], edx
mov edx, eax
mov dword [esi + 0x30], eax
mov eax, ecx
mov byte [esi + 0xc], 0
mov dword [esi + 0x34], ecx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push ebx
push esi
call fcn.004270c0
mov edi, edx
add esp, 0x18
mov ebp, eax
test edi, edi
jl 0x441ca2
jg 0x441a38
test ebp, ebp
jbe 0x441ca2
add dword [esp + 0x10], ebp
mov eax, dword [esp + 0x20]
adc dword [esp + 0x14], edi
sub dword [esp + 0xa0], ebp
sbb dword [esp + 0xa4], edi
add dword [esp + 0xa8], ebp
sub dword [esp + 0x1c], ebp
sbb eax, edi
add ebx, ebp
adc dword [esp + 0x30], edi
mov dword [esp + 0x20], eax
test eax, eax
jg 0x441a01
jl 0x441a76
cmp dword [esp + 0x1c], 0
ja 0x441a01
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x78]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x7c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x34], edx
or dword [eax + 0x14], ecx
mov dx, word [esp + 0x44]
xor ebx, ebx
mov word [esi + 0xc], dx
mov dword [esp + 0x30], ebx
jmp 0x441c65
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov eax, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
call fcn.004256a0
mov eax, dword [esi + 0x28]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x74], eax
mov eax, dword [esi + 0x30]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x34]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x34]
mov byte [esi + 0xc], cl
mov dword [esi + 0x2c], eax
jmp 0x441b04
mov ebp, dword [esp + 0x60]
push edi
push ecx
mov ecx, dword [esp + 0x3c]
movzx ecx, byte [ecx + 0x24]
mov eax, edi
sub eax, dword [esp + 0x20]
push edx
cdq
mov edi, eax
mov eax, edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x94], eax
mov eax, ebp
call fcn.004f9360
add edi, eax
mov eax, dword [esp + 0x94]
adc eax, edx
push eax
push edi
push esi
call fcn.004270c0
mov ebp, edx
add esp, 0x18
mov edi, eax
mov dword [esp + 0x8c], edi
test ebp, ebp
jl 0x441d5b
jg 0x441b5f
test edi, edi
jbe 0x441d5b
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add edi, eax
sub edx, eax
sbb ecx, ebp
mov dword [esp + 0x40], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
test ecx, ecx
jg 0x441b00
jl 0x441b96
test edx, edx
ja 0x441b00
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x34], edx
or dword [eax + 0x14], ecx
mov dx, word [esp + 0x44]
lea eax, [edi + 2]
mov word [esi + 0xc], dx
cmp eax, dword [esp + 0x84]
ja 0x441bd6
xor ecx, ecx
mov word [edi], cx
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push ebp
mov eax, edi
mov edx, edi
call fcn.00441230
add esp, 4
test eax, eax
jl 0x441e25
sub edi, ebx
mov eax, 0
sbb eax, dword [esp + 0x30]
cmp dword [esp + 0xa4], eax
jg 0x441c26
jl 0x441c16
cmp dword [esp + 0xa0], edi
jae 0x441c26
mov edi, dword [esp + 0xa0]
mov ebp, dword [esp + 0xa4]
jmp 0x441c28
mov ebp, eax
mov edx, dword [esp + 0x28]
add ebx, edx
push edi
push ebx
mov ebx, dword [esp + 0xb0]
push ebx
call fcn.004f8140
add esp, 0xc
add dword [esp + 0x10], edi
adc dword [esp + 0x14], ebp
sub dword [esp + 0xa0], edi
sbb dword [esp + 0xa4], ebp
add ebx, edi
mov dword [esp + 0xa8], ebx
xor ebx, ebx
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x4c], 0
jne 0x441880
mov edx, dword [esp + 0x18]
push edx
call fcn.004f84cf
mov eax, dword [esp + 0x2c]
push eax
call fcn.004f84cf
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
add esp, 8
add eax, dword [esp + 0x10]
pop ebp
adc edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov eax, ebp
or eax, edi
jne 0x441ce6
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push ebx
push edx
push eax
push str.Failed_to_read_an_uncompressed_cluster__inode__lld_offs_0x_llx_n
push 0
push 0x2f3
push str..libntfscompress.c
push str.ntfs_compressed_attr_pread
mov eax, 0x80
call fcn.00425250
add esp, 0x24
call fcn.004ff09d
mov dword [eax], 5
call fcn.004ff09d
mov ebx, dword [eax]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x78]
mov dword [esi + 0x28], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x2c], edx
mov edx, dword [esp + 0x48]
mov dword [esi + 0x34], ecx
or dword [eax + 0x14], edx
mov ecx, dword [esp + 0x18]
mov ax, word [esp + 0x44]
push ecx
mov word [esi + 0xc], ax
call fcn.004f84cf
mov edx, dword [esp + 0x2c]
push edx
call fcn.004f84cf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417b7
call fcn.004ff09d
mov dword [eax], ebx
mov eax, ebp
pop ebp
mov edx, edi
pop edi
pop esi
pop ebx
add esp, 0x84
ret
mov edx, edi
or edx, ebp
jne 0x441db0
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x24]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
call fcn.004f9360
push edx
push eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
push str.Failed_to_read_a_compressed_cluster___inode__lld_offs_0x_llx_n
push 0
push 0x32e
push str..libntfscompress.c
push str.ntfs_compressed_attr_pread
mov eax, 0x80
call fcn.00425250
add esp, 0x24
call fcn.004ff09d
mov dword [eax], 5
call fcn.004ff09d
mov ebx, dword [eax]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x30], edx
or dword [eax + 0x14], ecx
mov eax, dword [esp + 0x18]
mov dx, word [esp + 0x44]
push eax
mov word [esi + 0xc], dx
call fcn.004f84cf
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004f84cf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417b7
call fcn.004ff09d
mov dword [eax], ebx
mov edx, ebp
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x84
ret
call fcn.004ff09d
mov edx, dword [esp + 0x18]
mov esi, dword [eax]
push edx
call fcn.004f84cf
push ebp
call fcn.004f84cf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417b7
call fcn.004ff09d
pop ebp
pop edi
mov dword [eax], esi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004f84cf
mov edx, dword [esp + 0x2c]
push edx
call fcn.004f84cf
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, eax
add esp, 8
or ecx, edx
jne 0x4417b7
call fcn.004ff09d
pop ebp
pop edi
mov dword [eax], 5
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret
call fcn.004ff09d
pop edi
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
add esp, 0x84
ret