Function at 0x431280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4980dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov byte [esp + 0xfc], 3
call fcn.00433df0
fstp qword [esp + 0xa8]
fldz
fstp qword [esp + 0x50]
call fcn.00433df0
fstp qword [esp + 0x20]
push 0x2fd
lea ecx, [esp + 0x3c]
call fcn.0047be00
mov eax, dword [0x4b0268]
mov ecx, dword [0x4b0240]
add ecx, eax
add ecx, ecx
add ecx, ecx
push ecx
push str.allocate_file_and_folder_lookup_table__d_bytes_n
call fcn.00433c50
mov edx, dword [0x4b0268]
lea eax, [edx*4]
push eax
call fcn.00445590
mov ecx, dword [0x4b0240]
lea edx, [ecx*4]
mov esi, eax
push edx
mov dword [esp + 0x44], esi
call fcn.00445590
mov edi, eax
mov eax, dword [0x4b0268]
lea ecx, [eax*4]
push ecx
push ebp
push esi
mov dword [esp + 0x4c], edi
call fcn.0048a4d0
mov edx, dword [0x4b0240]
lea eax, [edx*4]
push eax
push ebp
push edi
call fcn.0048a4d0
call fcn.004152f0
mov esi, eax
call fcn.00433df0
fsub qword [esp + 0x48]
add esp, 0x20
fstp qword [esp]
push esi
push str.got_longest_path_length__d_in__f_seconds_n
call fcn.00433c50
add esp, 0x10
push esi
lea ecx, [esp + 0x6c]
call fcn.0047be00
push 0x2fd
lea ecx, [esp + 0x44]
call fcn.0047be00
push 0x10000
call fcn.00445590
mov edi, eax
mov dword [esp + 0x20], edi
push 0x40000
call fcn.00445590
push 0x40000
mov esi, eax
push ebp
push esi
mov dword [esp + 0x3c], esi
call fcn.0048a4d0
lea ecx, [esp + 0xc4]
push 0x14
push ecx
call fcn.0044a970
add esp, 0x1c
xor ebx, ebx
cmp dword [0x4b019c], ebp
jle 0x4317cb
mov edi, edi
mov edx, dword [0x4b0194]
mov eax, dword [edx + ebx*4]
cmp byte [eax], 0
jne 0x4317b8
call fcn.00433df0
fstp qword [esp + 0x20]
mov ecx, dword [0x4b0194]
mov edx, dword [ecx + ebx*4]
mov eax, dword [edx + 9]
push 1
push eax
call fcn.004499b0
mov esi, eax
add esp, 8
mov dword [esp + 0x5c], esi
call fcn.00433df0
fsub qword [esp + 0x20]
cmp esi, 0xffffffff
fadd qword [esp + 0x50]
fstp qword [esp + 0x50]
je 0x4317b8
xor esi, esi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
cmp esi, dword [esp + 0x20]
jb 0x43156b
mov ecx, dword [0x4b0194]
xor eax, eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
xor esi, esi
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x88], 0x803fff77
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov eax, dword [ecx + ebx*4]
mov edx, dword [eax + 0x15]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xa0], edx
mov eax, dword [eax + 0x19]
mov edx, dword [esp + 0x64]
mov dword [esp + 0xa4], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
call fcn.00433df0
fstp qword [esp + 0x20]
mov edx, dword [esp + 0x5c]
push esi
lea eax, [esp + 0x7c]
push eax
push 0x10000
push edi
push 0x28
lea ecx, [esp + 0x94]
push ecx
push 0x900bb
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4317ab
call fcn.00433df0
fsub qword [esp + 0x20]
mov eax, dword [edi]
mov edx, dword [esp + 0x78]
fadd qword [esp + 0x50]
mov ecx, dword [edi + 4]
mov dword [esp + 0x60], eax
lea eax, [edx + edi]
lea esi, [edi + 8]
fstp qword [esp + 0x50]
cmp esi, eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x20], eax
je 0x4317ab
test ebp, ebp
je 0x431588
mov eax, dword [esp + 0x48]
cmp eax, dword [esi + 8]
jne 0x431588
mov ecx, dword [esp + 0x4c]
cmp ecx, dword [esi + 0xc]
jne 0x431588
add esi, dword [esi]
jmp 0x431460
test byte [esi + 0x34], 0x10
je 0x43161d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x7c]
push edx
push eax
push ecx
push ebx
call fcn.00406320
add esp, 0x10
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
je 0x43173d
mov ebp, dword [esp + 0x30]
cmp dword [ebp + eax*4], 0
je 0x4315d5
mov eax, dword [ebp + eax*4]
mov edx, dword [esi + 0x20]
mov dword [eax + 1], edx
mov ecx, dword [esi + 0x24]
mov dword [eax + 5], ecx
jmp 0x431791
push 0x4b02b8
call fcn.004308f0
mov edx, dword [esp + 0x30]
mov dword [ebp + edx*4], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + eax*4]
mov edx, dword [esp + 0x80]
mov dword [ecx + 9], edx
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + eax*4]
mov byte [ecx], 1
mov edx, dword [esp + 0x30]
mov eax, dword [ebp + edx*4]
mov ecx, dword [esi + 0x20]
mov dword [eax + 1], ecx
mov edx, dword [esi + 0x24]
mov dword [eax + 5], edx
jmp 0x43178e
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov cl, 0x24
call fcn.0048a9f0
mov ecx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esi + 8]
and eax, 0xfff
and ebp, 0xf000
or ebp, eax
mov eax, dword [ecx + ebp*4]
test eax, eax
je 0x43166d
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
lea ecx, [ecx]
mov edi, dword [eax + 4]
cmp edi, ecx
jne 0x431666
mov edi, dword [eax + 8]
cmp edi, edx
jne 0x431666
cmp dword [eax], ebx
je 0x431700
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x431650
lea edx, [esp + 0xb0]
push edx
call fcn.004308f0
mov edi, eax
mov eax, dword [esi + 8]
mov dword [edi + 4], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x2c]
mov dword [edi + 8], ecx
mov edx, dword [eax + ebp*4]
mov dword [edi + 0xc], edx
mov dword [edi], ebx
mov dword [eax + ebp*4], edi
movzx eax, word [esi + 0x38]
movzx ecx, word [esi + 0x3a]
mov edx, dword [esp + 0x3c]
shr eax, 1
push eax
mov eax, dword [esp + 0x44]
add ecx, esi
push ecx
push edx
push eax
call fcn.0047ba60
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x5c]
push ecx
push edx
push eax
call fcn.0047a610
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x50]
push ecx
push eax
push edx
mov edx, dword [esi + 0x14]
lea eax, [esp + 0xa0]
push eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x9c]
push ecx
push edx
push eax
push ebx
call fcn.004173b0
mov ebp, eax
add esp, 0x44
test ebp, ebp
jne 0x431719
mov dword [edi + 0x10], eax
jmp 0x431739
mov eax, dword [eax + 0x10]
test eax, eax
mov edi, dword [esp + 0x1c]
je 0x43173d
mov edx, dword [esi + 0x20]
mov dword [eax + 1], edx
mov ecx, dword [esi + 0x24]
mov dword [eax + 5], ecx
jmp 0x43173d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp dword [ecx + eax*4], 0
je 0x431757
mov eax, dword [ecx + eax*4]
mov dword [edi + 0x10], eax
mov ecx, dword [esi + 0x20]
mov dword [eax + 1], ecx
mov edx, dword [esi + 0x24]
mov dword [eax + 5], edx
mov edi, dword [esp + 0x1c]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add esi, dword [esi]
mov ebp, 1
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
jmp 0x431460
push 0x4b02b8
call fcn.004308f0
mov dword [edi + 0x10], eax
mov dword [eax + 9], ebp
mov edx, dword [edi + 0x10]
mov byte [edx], 0
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0x20]
mov dword [eax + 1], ecx
mov edx, dword [esi + 0x24]
mov dword [eax + 5], edx
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x20]
mov dword [edx + ecx*4], eax
add esp, 4
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add esi, dword [esi]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
mov ebp, 1
jmp 0x431460
mov edx, dword [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
add ebx, 1
cmp ebx, dword [0x4b019c]
jl 0x431400
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
push eax
call fcn.004455d0
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004455d0
lea edx, [esp + 0xb8]
push edx
call fcn.0044aa40
push esi
call fcn.004455d0
push edi
call fcn.004455d0
mov dword [0x4b0294], 1
call fcn.00433df0
fstp qword [esp + 0x34]
push 0x4b02b8
call fcn.0044a9e0
mov ebx, eax
call fcn.00433df0
fsub qword [esp + 0x38]
add esp, 0x10
fstp qword [esp]
push ebx
push str.calc_count__d_changes_in__f_seconds_n
call fcn.00433c50
call fcn.00433df0
fstp qword [esp + 0x30]
lea eax, [ebx*4]
push eax
call fcn.00445590
mov ebp, dword [0x4b02b8]
add esp, 0x14
test ebp, ebp
mov edi, eax
mov esi, edi
je 0x4318a3
jmp 0x431860
xor edx, edx
mov eax, 0xfffc
div dword [0x4b02c4]
mov edx, dword [0x4b02c0]
lea ecx, [ebp + 4]
imul eax, dword [0x4b02c4]
cmp edx, ecx
lea eax, [eax + ebp + 4]
jb 0x43188b
cmp edx, eax
jae 0x43188b
mov eax, edx
cmp ecx, eax
je 0x43189c
nop
mov dword [esi], ecx
add ecx, 0xd
add esi, 4
cmp ecx, eax
jne 0x431890
mov ebp, dword [ebp]
test ebp, ebp
jne 0x431860
call fcn.00433df0
fsub qword [esp + 0x20]
sub esp, 8
sub esi, edi
fstp qword [esp]
push ebx
sar esi, 2
push esi
push str.allocate_and_initialize_indexes__d_____d___f_seconds_n
call fcn.00433c50
call fcn.00433df0
fstp qword [esp + 0x34]
push 0x431180
push 4
push ebx
push edi
call fcn.0048a610
add esp, 0x24
mov ecx, 0x4b0298
call fcn.0047c080
mov ecx, 0x4b02a8
call fcn.0047c080
call fcn.00433df0
fsub qword [esp + 0x20]
sub esp, 8
fstp qword [esp]
push str.sort_time_indexes__f_seconds_n
call fcn.00433c50
call fcn.00433df0
fstp qword [esp + 0x2c]
push 0x4b02c8
mov esi, edi
lea ebp, [edi + ebx*4]
call fcn.004020b0
xor eax, eax
xor ecx, ecx
add esp, 0x10
cmp edi, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
jae 0x4319c8
lea esp, [esp]
cmp eax, ecx
mov edx, dword [esi]
mov dword [esp + 0x30], edx
jne 0x4319b0
push 0x10000
call fcn.00445590
add esp, 4
cmp dword [0x4b02d4], 0
lea ecx, [eax + 0x10000]
je 0x431979
mov edx, dword [0x4b02d8]
mov dword [edx], eax
mov edx, dword [0x4b02d8]
mov dword [eax + 4], edx
jmp 0x431985
mov dword [0x4b02d4], eax
mov dword [eax + 4], 0
mov dword [0x4b02d8], eax
mov dword [eax], 0
mov dword [eax + 8], 0
mov edx, dword [0x4b02cc]
imul edx, edx, 0x3ffb
mov dword [eax + 0x10], edx
add dword [0x4b02cc], 1
add eax, 0x14
mov edx, dword [esp + 0x30]
mov dword [eax], edx
add esi, 4
add eax, 4
cmp esi, ebp
jb 0x431940
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0x4b02c8
call fcn.00402210
call fcn.00433df0
fsub qword [esp + 0x2c]
add esp, 4
fstp qword [esp]
push str.build_time_array__f_seconds_n
call fcn.00433c50
call fcn.00433df0
fstp qword [esp + 0x2c]
push 0x430b70
push 4
push ebx
push edi
call fcn.0048a610
call fcn.00433df0
fsub qword [esp + 0x3c]
add esp, 0x14
fstp qword [esp]
push str.sort_pointer_indexes__f_seconds_n
call fcn.00433c50
call fcn.00433df0
fstp qword [esp + 0x2c]
push 0x4b02dc
mov esi, edi
call fcn.004020b0
xor eax, eax
xor ecx, ecx
add esp, 0x10
cmp edi, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
jae 0x431ad1
cmp eax, ecx
mov ebx, dword [esi]
jne 0x431abd
push 0x10000
call fcn.00445590
add esp, 4
cmp dword [0x4b02e8], 0
lea ecx, [eax + 0x10000]
je 0x431a86
mov edx, dword [0x4b02ec]
mov dword [edx], eax
mov edx, dword [0x4b02ec]
mov dword [eax + 4], edx
jmp 0x431a92
mov dword [0x4b02e8], eax
mov dword [eax + 4], 0
mov dword [0x4b02ec], eax
mov dword [eax], 0
mov dword [eax + 8], 0
mov edx, dword [0x4b02e0]
imul edx, edx, 0x3ffb
mov dword [eax + 0x10], edx
add dword [0x4b02e0], 1
add eax, 0x14
mov dword [eax], ebx
add esi, 4
add eax, 4
cmp esi, ebp
jb 0x431a51
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0x4b02dc
call fcn.00402210
call fcn.00433df0
fsub qword [esp + 0x2c]
add esp, 4
fstp qword [esp]
push str.build_pointer_array__f_seconds_n
call fcn.00433c50
push edi
call fcn.004455d0
fld qword [esp + 0x60]
add esp, 8
fstp qword [esp]
call fcn.00433df0
fsub qword [esp + 0xb0]
sub esp, 8
fstp qword [esp]
push str.loaded_changes_from_USN_Journal__f_seconds__systemtime:__f_seconds__n
call fcn.00433c50
mov esi, dword [0x4b02d4]
mov eax, esi
add esp, 0x14
xor edx, edx
test eax, eax
je 0x431b49
jmp 0x431b40
add edx, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x431b40
mov eax, esi
xor ecx, ecx
test eax, eax
je 0x431b5a
add ecx, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x431b51
imul edx, edx, 0xd
imul ecx, ecx, 0xd
push edx
mov edx, dword [0x4b02cc]
shl edx, 0xe
add edx, dword [0x4b02d0]
lea eax, [ecx + edx*4]
push eax
push str.recent_changes_memory_usage:__d_bytes__d_data__n
call fcn.00433c50
mov ecx, dword [0x4b02e0]
shl ecx, 0xe
add ecx, dword [0x4b02e4]
add ecx, ecx
add ecx, ecx
push ecx
push str.pointer_sorted_recent_changes_memory_usage:__d_n
call fcn.00433c50
add esp, 0x14
lea ecx, [esp + 0x38]
mov byte [esp + 0xfc], 2
call fcn.0047ca90
lea ecx, [esp + 0x70]
mov byte [esp + 0xfc], 1
call fcn.0047ca90
lea ecx, [esp + 0x68]
mov byte [esp + 0xfc], 0
call fcn.0047ca90
lea ecx, [esp + 0x40]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0xf4]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret