Function at 0x14003fce0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbx
push r12
push r14
push r15
sub rsp, 0x48
cmp byte [rsp + 0x90], 0
mov r12d, r9d
mov r14, r8
mov ebx, edx
mov r15, rcx
jne 0x14003fd4b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._NTFS_Scanner__Detecting_replaced_files_on_the_entire_NTFS_drive..._n
call fcn.14000fc00
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea r8, [0x1400621e0]
lea rdx, str.replaced_files.txt
lea rcx, ds:[rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
je 0x14003fd76
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
xor edi, edi
mov qword [rsp + 0x30], r13
xor r13d, r13d
test ebx, ebx
jle 0x14003ff48
mov eax, dword [rsp + 0x78]
nop dword [rax]
xor ebp, ebp
test r12d, r12d
jle 0x14003ff03
nop dword [rax + rax]
mov r9, qword [r14]
mov r11, qword [r15]
lea r8, [r9 + 0x400]
lea rbx, [r11 + 0x400]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003fde4
inc rax
test ecx, ecx
jne 0x14003fdd0
test edx, edx
jne 0x14003fee8
mov rax, r11
sub r9, r11
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14003fe05
inc rax
test ecx, ecx
jne 0x14003fdf2
test edx, edx
jne 0x14003fee8
xor r10d, r10d
test edi, edi
jle 0x14003fe7f
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, r10d
mov r9, rbx
shl rcx, 0xb
add rcx, rsi
lea rax, [rcx + 0x400]
sub r9, rax
nop word [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x14003fe55
inc rax
test edx, edx
jne 0x14003fe40
test r8d, r8d
jne 0x14003fe77
mov r8, r11
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x14003fe73
inc rcx
test eax, eax
jne 0x14003fe60
test edx, edx
je 0x14003fee8
inc r10d
cmp r10d, edi
jl 0x14003fe20
movsxd rbx, edi
mov rcx, rsi
shl rbx, 0xb
lea rdx, [rbx + 0x800]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14003ff7c
mov r8, qword [r15]
add rbx, rax
mov rcx, rbx
mov r9, 0xffffffffffffffff
mov edx, 0x400
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r8, qword ds:[r15]
lea rcx, [rbx + 0x400]
add r8, 0x400
mov edx, 0x400
mov r9, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
inc edi
inc ebp
add r14, 8
cmp ebp, r12d
jl 0x14003fdb0
mov eax, dword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
inc r13d
add r15, 8
mov rbx, rsi
cmp r13d, eax
jl 0x14003fda0
test edi, edi
jle 0x14003ff48
nop word [rax + rax]
mov rcx, qword [rsp + 0x20]
lea r8, [rbx + 0x400]
mov r9, rbx
lea rdx, str._s___s_n
call fcn.140028b90
add rbx, 0x800
sub rdi, 1
jne 0x14003ff20
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
add rsp, 0x48
pop r15
pop r14
pop r12
pop rbx
ret
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3