Function at 0x140028ac0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140048040]
xor rax, rsp
mov qword [rsp + 0x130], rax
movzx edi, dl
movsx ebx, cl
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, ebx
lea rcx, str._NTFS_Scanner__Running_journal_query_for_drive__c._n
call fcn.140022e10
test dil, dil
je 0x140028c32
lea rcx, str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Glorious_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.mcf_____.glorious.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Logitech_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_settings.db_____.logitech.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Bloody_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.amc2_____._bloody.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_Corsair_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.140022e10
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.cuecfg_____.corsair.txt
jmp 0x140028c9b
lea rcx, str._NTFS_Scanner__Skipping_macro_trace_detection_based_on_user_input._n
call fcn.140022e10
lea rcx, str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
call fcn.140022e10
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r8d, ebx
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.140022e10
lea rdx, str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
mov r8d, ebx
lea rcx, [rsp + 0x20]
call fcn.140029400
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14003b0a8]
call fcn.140028570
lea rcx, [0x14003b0c0]
call fcn.140028570
lea rcx, str.special_characters.txt
call fcn.140028570
lea rcx, str.glorious.txt
call fcn.140028570
lea rcx, str.logitech.txt
call fcn.140028570
lea rcx, str.bloody.txt
call fcn.140028570
lea rcx, str.corsair.txt
call fcn.140028570
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140030fb0
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret