Function at 0x423af0
Capabilities:
Execute command
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x423dbb
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor bl, bl
push edi
lea edi, [ebp - 0x20c]
mov byte [ebp - 0x311], bl
cmp byte [ebp - 0x20c], bl
je 0x423d75
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423b45
sub ecx, edx
cmp ecx, 3
jne 0x423d53
cmp byte [edi + 1], 0x3a
jne 0x423d53
cmp byte [edi + 2], 0x5c
jne 0x423d53
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x423d53
lea eax, [ebp - 0x310]
push str.NTFS
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x423d4b
mov bl, byte [edi]
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 3
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call esi
movsx esi, bl
push esi
push str._NTFS_Scanner__Running_journal_query_for_drive__c._n
call fcn.0041f350
push str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
call fcn.0041f350
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
push eax
call fcn.00423a40
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [ebp - 0x108]
push eax
call ebx
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
push str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.0041f350
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0x40
push str._NTFS_Scanner__Detecting_glorious_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0041f350
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.mcf_____.glorious.txt
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
push str._NTFS_Scanner__Detecting_Logitech_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0041f350
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_settings.db_____.logitech.txt
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
push str._NTFS_Scanner__Detecting_Bloody_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0041f350
push esi
lea eax, [ebp - 0x108]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.amc2_____._bloody.txt
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
push str._NTFS_Scanner__Detecting_Corsair_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0041f350
add esp, 0x40
push esi
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.cuecfg_____.corsair.txt
lea eax, [ebp - 0x108]
push eax
call fcn.00423a40
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0x10
push 7
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call esi
push str.old_renamed_files.txt
call fcn.00423a80
push str.new_renamed_files.txt
call fcn.00423a80
push str.special_characters.txt
call fcn.00423a80
push str.glorious.txt
call fcn.00423a80
push str.logitech.txt
call fcn.00423a80
push str.bloody.txt
call fcn.00423a80
push str.corsair.txt
call fcn.00423a80
mov bl, byte [ebp - 0x311]
add esp, 0x1c
jmp 0x423d53
mov bl, 1
mov byte [ebp - 0x311], bl
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423d58
sub eax, edx
inc edi
add edi, eax
cmp byte [edi], cl
jne 0x423b40
test bl, bl
je 0x423d75
call fcn.004243a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 3
push 0xfffffffffffffff5
call ebx
push eax
call esi
push str._NTFS_Scanner__File_modifications_will_be_output_to_your_current_working_directory._n
call fcn.0041f350
push str._NTFS_Scanner__You_can_see_your_current_working_directory_path_in_the_line_where_you_specified_the_file_path_in_the_command_prompt._n
call fcn.0041f350
push str._NTFS_Scanner__If_you_opened_this_exe_without_opening_first_a_command_prompt__then_the_.txt_files_are_in_the_same_path_as_the_Screenshare_Tool._n
call fcn.0041f350
push str._NTFS_Scanner__Order_the_folder_by__Date_modified__and_open_the_most_recent__.txt__files._n
call fcn.0041f350
add esp, 0x10
push 7
push 0xfffffffffffffff5
call ebx
push eax
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426399
mov esp, ebp
pop ebp
ret