Function at 0x434980
Capabilities:
Terminate process

Disassembly:
sub esp, 0x20
cmp byte [esp + 0x2c], 0
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x14], ecx
push edi
mov dword [esp + 0x2c], esi
mov edi, ecx
jne 0x4349cf
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 3
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str._NTFS_Scanner__Detecting_replaced_files_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0x454988
lea eax, ds:[esp + 0x2c]
push str.replaced_files.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x4349f5
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ebx, ebx
xor edx, edx
xor ebp, ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], edx
test esi, esi
jle 0x434c14
mov ecx, dword [esp + 0x38]
nop
xor eax, eax
mov dword [esp + 0x20], eax
test ecx, ecx
jle 0x434bcc
mov esi, ebp
shl esi, 0xb
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + eax*4]
mov eax, dword [edi]
add eax, 0x400
lea ecx, [edx + 0x400]
nop dword [eax + eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x434a62
test bl, bl
je 0x434a5c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x434a62
add eax, 2
add ecx, 2
test bl, bl
jne 0x434a40
xor eax, eax
jmp 0x434a67
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434bab
mov ebx, dword [edi]
mov eax, ebx
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x434a93
test cl, cl
je 0x434a8f
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x434a93
add eax, 2
add edx, 2
test cl, cl
jne 0x434a73
xor eax, eax
jmp 0x434a98
sbb eax, eax
or eax, 1
nop dword [eax + eax]
test eax, eax
jne 0x434bab
xor edi, edi
test ebp, ebp
jle 0x434b3a
mov esi, dword [esp + 0x14]
nop word [eax + eax]
lea ecx, [ebx + 0x400]
lea eax, [esi + 0x400]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x434af3
test dl, dl
je 0x434aef
mov dl, byte ds:[eax + 1]
cmp dl, byte [ecx + 1]
jne 0x434af3
add eax, 2
add ecx, 2
test dl, dl
jne 0x434ad0
xor eax, eax
jmp 0x434af8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434b2b
mov eax, ebx
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x434b22
test dl, dl
je 0x434b1c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x434b22
add ecx, 2
add eax, 2
test dl, dl
jne 0x434b00
xor eax, eax
jmp 0x434b27
sbb eax, eax
or eax, 1
test eax, eax
je 0x434ba3
inc edi
add esi, 0x800
cmp edi, ebp
jl 0x434ac0
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
lea edi, [esi + 0x800]
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
je 0x434c33
mov ebx, eax
add esi, eax
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
mov dword [esp + 0x18], ebx
push dword [eax]
push 0x400
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
mov eax, dword [eax]
add eax, 0x400
push eax
lea eax, [esi + 0x400]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov esi, edi
add esp, 0x20
mov edi, dword [esp + 0x18]
inc ebp
mov dword [esp + 0x1c], esi
jmp 0x434baf
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov eax, dword ds:[esp + 0x20]
mov ecx, dword [esp + 0x38]
inc eax
mov dword [esp + 0x20], eax
cmp eax, ecx
jl 0x434a27
mov edx, dword [esp + 0x24]
inc edx
add edi, 4
mov esi, ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], edi
cmp edx, dword [esp + 0x2c]
jl 0x434a10
test ebp, ebp
jle 0x434c14
nop
push esi
lea eax, [esi + 0x400]
push eax
push str._s___s_n
push dword [esp + 0x34]
call fcn.0041dd20
add esp, 0x10
add esi, 0x800
sub ebp, 1
jne 0x434bf0
push dword [esp + 0x28]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3