Function at 0x434e00
Capabilities:
Delete file
Execute command

Disassembly:
sub esp, 0x10c
mov eax, dword [0x467040]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push 0x104
lea eax, [esp + 0x10]
mov bh, dl
push 0
push eax
mov bl, cl
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 3
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movsx esi, bl
push esi
push str._NTFS_Scanner__Running_journal_query_for_drive__c._n
call fcn.0042fd40
add esp, 8
test bh, bh
je 0x434fae
push str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
nop dword [eax]
call fcn.0042fd40
push esi
lea eax, [esp + 0x14]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push esi
lea eax, [esp + 0x24]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x38]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
push eax
call fcn.004357c0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_Glorious_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x4c]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.mcf_____.glorious.txt
push eax
call fcn.004357c0
add esp, 0x48
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_Logitech_macro_traces_on_the_entire_NTFS_drive..._n
nop dword [eax]
call fcn.0042fd40
push esi
lea eax, [esp + 0x18]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_settings.db_____.logitech.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x20]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_Bloody_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x2c]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.amc2_____._bloody.txt
push eax
call fcn.004357c0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_Corsair_macro_traces_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x40]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_.cuecfg_____.corsair.txt
push eax
call fcn.004357c0
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x40
push str._NTFS_Scanner__Detecting_renamed_and_deleted_Prefetch_folders_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x14]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_Prefetch_____.prefetch.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x14
jmp 0x43505b
push str._NTFS_Scanner__Skipping_macro_trace_detection_based_on_user_input._n
call fcn.0042fd40
push str._NTFS_Scanner__Detecting_file_rename_modifications_in_the_entire_NTFS_drive..._n
nop dword [eax]
call fcn.0042fd40
push esi
lea eax, [esp + 0x18]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00001000____.old_renamed_files.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x20]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push esi
lea eax, [esp + 0x28]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__c:0x00002000____._new_renamed_files.txt
push eax
call fcn.004357c0
lea eax, ds:[esp + 0x30]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_every_file_modification_with_any_special_character..._n
call fcn.0042fd40
push esi
lea eax, [esp + 0x3c]
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_______._special_characters.txt
push eax
call fcn.004357c0
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str._NTFS_Scanner__Detecting_renamed_and_deleted_Prefetch_folders_on_the_entire_NTFS_drive..._n
call fcn.0042fd40
add esp, 0x40
lea eax, [esp + 0xc]
push esi
push str.fsutil_usn_readjournal__c:_csv__findstr__i__C:_Prefetch_____.prefetch.txt
push eax
call fcn.004357c0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x10
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push 0x458de4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x4350d2
mov eax, dword [esp + 8]
test eax, eax
je 0x4350d2
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x4350d2
push 0x458de4
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push 0x458dcc
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x435134
mov eax, dword [esp + 8]
test eax, eax
je 0x435134
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x435134
push 0x458dcc
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push str.special_characters.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x43519b
mov eax, dword ds:[esp + 8]
test eax, eax
je 0x43519b
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword ds:[esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x43519b
push str.special_characters.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push str.glorious.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x4351fd
mov eax, dword [esp + 8]
test eax, eax
je 0x4351fd
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x4351fd
push str.glorious.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push str.logitech.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x435269
mov eax, dword [esp + 8]
test eax, eax
je 0x435269
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword ds:[esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x435269
push str.logitech.txt
nop
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push str.bloody.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x4352d2
mov eax, dword [esp + 8]
test eax, eax
je 0x4352d2
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x4352d2
push str.bloody.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push 0x458d5c
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push str.corsair.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x435334
mov eax, dword [esp + 8]
test eax, eax
je 0x435334
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
test esi, esi
jne 0x435334
push str.corsair.txt
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
mov ecx, dword ds:[esp + 0x110]
pop esi
pop ebx
xor ecx, esp
call fcn.00444aa0
add esp, 0x10c
ret