Function at 0x14002ac80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbx
push rdi
push r12
push r13
sub rsp, 0x48
mov r12, rcx
mov r13d, r9d
mov ecx, 0xfffffff5
mov rdi, r8
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._NTFS_Scanner__Detecting_replaced_files_on_the_entire_NTFS_drive..._n
call fcn.140021c40
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea r8, [0x140038ddc]
lea rdx, str.replaced_files.txt
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
je 0x14002ad05
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x70], rbp
xor eax, eax
mov qword [rsp + 0x40], rsi
xor ebp, ebp
xor esi, esi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x20], eax
test ebx, ebx
jle 0x14002aed8
mov ecx, dword [rsp + 0x78]
nop
xor r14d, r14d
test r13d, r13d
jle 0x14002ae87
mov r15, rdi
nop
mov r9, qword [r15]
mov r11, qword [r12]
lea r8, [r9 + 0x400]
lea rbx, [r11 + 0x400]
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002ad73
inc rax
test ecx, ecx
jne 0x14002ad60
test edx, edx
jne 0x14002ae67
mov rax, r11
sub r9, r11
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14002ad94
inc rax
test ecx, ecx
jne 0x14002ad81
test edx, edx
jne 0x14002ae67
xor r10d, r10d
test esi, esi
jle 0x14002adff
movsxd rax, r10d
mov r9, rbx
shl rax, 0xb
add rax, rbp
lea rcx, [rax + 0x400]
sub r9, rcx
nop word [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x14002add5
inc rcx
test edx, edx
jne 0x14002adc0
test r8d, r8d
jne 0x14002adf7
mov r8, r11
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002adf3
inc rax
test ecx, ecx
jne 0x14002ade0
test edx, edx
je 0x14002ae67
inc r10d
cmp r10d, esi
jl 0x14002ada3
lea edi, [rsi + 1]
mov rcx, rbp
movsxd rdx, edi
shl rdx, 0xb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14002af0b
mov r8, qword [r12]
mov r9, 0xffffffffffffffff
movsxd rbx, esi
mov edx, 0x400
shl rbx, 0xb
mov rbp, rax
add rbx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r8, qword [r12]
lea rcx, [rbx + 0x400]
add r8, 0x400
mov edx, 0x400
mov r9, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov esi, edi
inc r14d
add r15, 8
cmp r14d, r13d
jl 0x14002ad40
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
inc eax
add r12, 8
mov dword [rsp + 0x20], eax
mov rbx, rbp
cmp eax, ecx
jl 0x14002ad30
test esi, esi
jle 0x14002aed8
mov edi, esi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x28]
lea r8, [rbx + 0x400]
mov r9, rbx
lea rdx, str._s___s_n
call fcn.14002a890
add rbx, 0x800
sub rdi, 1
jne 0x14002aeb0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3