Function at 0x431470
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebfda
mov eax, dword fs:[0]
push eax
sub esp, 0x578
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x574], edi
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [ebp - 0x580], eax
xorps xmm0, xmm0
lea eax, [edi + 0x15c]
movq qword [ebp - 0x28], xmm0
mov ecx, eax
mov dword [ebp - 0x20], 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Registry_backups
mov dword [ebp - 0x570], eax
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc520
push 0x260
lea eax, [ebp - 0x564]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x564]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x564]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, eax
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x314], edx
cmp edx, 0xffffffff
je 0x4315e2
mov ecx, 5
mov dword [ebp - 0x310], ecx
cmp word [ebp - 0x538], 0x2e
jne 0x43158b
mov ax, word [ebp - 0x536]
test ax, ax
je 0x4315b5
cmp ax, 0x2e
jne 0x43158b
cmp word [ebp - 0x534], 0
je 0x4315b5
test ecx, ecx
je 0x4315e2
mov eax, dword [ebp - 0x564]
test cl, 1
je 0x4315a1
test eax, 0x400
jne 0x4315b5
test cl, 2
je 0x4315ac
test al, 0x10
je 0x4315e2
jmp 0x4315b5
test cl, 4
je 0x4315e2
test al, 0x10
jne 0x4315e2
lea eax, [ebp - 0x564]
push eax
push edx
call esi
test eax, eax
je 0x4315d1
mov ecx, dword [ebp - 0x310]
mov edx, dword [ebp - 0x314]
jmp 0x431565
push dword [ebp - 0x314]
call ebx
or edx, 0xffffffff
mov dword [ebp - 0x314], edx
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
jne 0x431622
sub esp, 8
mov ecx, edi
push 0x8c
push 0x190
push 0
push dword [edi + 0x14e4]
push 1
push str.You_do_not_have_any_registry_backups_available_r_n_r_nDo_you_want_to_create_a_registry_backup_now_
call fcn.0043e2e0
cmp eax, 1
jne 0x43161a
mov ecx, edi
call fcn.00431db0
or esi, 0xffffffff
jmp 0x431c76
push ecx
mov ecx, edi
call fcn.0043e540
push 0x270
mov ebx, eax
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.00420090
add esp, 8
lea eax, [edi + 0x14a8]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x568], eax
push ebx
push 0xffffffffffffffff
push 0xc80000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x14a
push 0x1f4
push str.Registry_backup_manager
push str.UVK_DLG_CLASS
push eax
call fcn.005c6220
mov byte [ebp - 4], 2
test ebx, ebx
je 0x4316b3
push 0
push 0
lea ecx, [ebp - 0x304]
call fcn.005c5730
mov edx, ebx
mov ecx, eax
call fcn.005d3010
push 0
lea ecx, [ebp - 0x304]
call fcn.005c5730
mov ecx, dword [edi + 0x14e4]
push eax
call fcn.005c6150
movsd xmm1, qword [0x6edb08]
lea ecx, [ebp - 0x304]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push ecx
push 0xffffffffffffffff
push 0x20
push 0x20
push 5
push 8
push ecx
push 0xcc
mov ecx, edi
call fcn.004363b0
push eax
lea ecx, [ebp - 0x304]
call fcn.005c0240
push 0xffffffffffffffff
push 0x10000101
push 0x12
push 0x1ae
push 0xa
push 0x32
push str.Restore_Delete_registry_backups
lea ecx, [ebp - 0x304]
call fcn.005c0890
movsd xmm1, qword [0x6edae8]
lea ecx, [ebp - 0x304]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push 0x24
push 0x1080000d
push 0xf3
push 0x1db
push 0x31
push 0xd
push 0x62794c
push str.__Backup_time__Backup_name__Size__Backup_type_Backup_location
lea ecx, [ebp - 0x304]
call fcn.005c0620
push 0x96
push 0
push 0x101e
push 0xffffffffffffffff
lea ecx, [ebp - 0x304]
mov ebx, eax
call fcn.005befd0
push 0x8c
push 1
push 0x101e
push 0xffffffffffffffff
lea ecx, [ebp - 0x304]
call fcn.005befd0
push 0x3c
push 2
push 0x101e
push 0xffffffffffffffff
lea ecx, [ebp - 0x304]
call fcn.005befd0
push 0x64
push 3
push 0x101e
push 0xffffffffffffffff
lea ecx, [ebp - 0x304]
call fcn.005befd0
push 0
push 4
push 0x101e
push 0xffffffffffffffff
lea ecx, [ebp - 0x304]
call fcn.005befd0
push 1
push ebx
lea ecx, [ebp - 0x304]
call fcn.005ba360
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0x4c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x40]
movq qword [ebp - 0x40], xmm0
call fcn.005dc5e0
mov edi, dword [ebp - 0x570]
mov byte [ebp - 4], 6
nop
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BackupInfo.ini
lea eax, [ebp - 0x538]
mov ecx, edi
push eax
push str.Registry_backups_
call fcn.005dc190
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc200
push 0x38
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x90]
call fcn.005dd680
push 0
push str.Date
push str.BackupInfo
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x34]
call fcn.005db160
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
push str.Name
push str.BackupInfo
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x58]
call fcn.005db160
push 0
push str.Size
push str.BackupInfo
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x4c]
call fcn.005db160
push 0
push str.Type
push str.BackupInfo
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x40]
call fcn.005db160
lea ecx, [ebp - 0x34]
call fcn.005dbeb0
test al, al
jne 0x4319e8
lea ecx, [ebp - 0x4c]
call fcn.005dbeb0
test al, al
jne 0x4319e8
lea ecx, [ebp - 0x40]
call fcn.005dbeb0
test al, al
jne 0x4319e8
push 0
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x2710
push 0
lea ecx, [ebp - 0x34]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x304]
call fcn.005bbb80
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.005dc190
push eax
push esi
push ebx
lea ecx, [ebp - 0x304]
call fcn.005ba4f0
push 2
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
push esi
push ebx
lea ecx, [ebp - 0x304]
call fcn.005ba4f0
push 3
lea ecx, [ebp - 0x40]
call fcn.005dc190
push eax
push esi
push ebx
lea ecx, [ebp - 0x304]
call fcn.005ba4f0
push 4
push 0
lea ecx, [ebp - 0x28]
call fcn.005dbed0
mov ecx, eax
call fcn.005dc190
push eax
push esi
push ebx
lea ecx, [ebp - 0x304]
call fcn.005ba4f0
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x4319ec
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x90]
call fcn.005dd5d0
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x431a3b
lea ecx, [ebp - 0x564]
push ecx
push eax
call esi
test eax, eax
je 0x431a25
lea ecx, [ebp - 0x564]
call fcn.004011a0
test al, al
jne 0x431850
jmp 0x431a3b
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x314], 0xffffffff
push 0xfffffffffffffffe
push ebx
lea ecx, [ebp - 0x304]
call fcn.005c5730
xor edx, edx
mov ecx, eax
call fcn.005c8de0
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x304]
push 0
push str.Arial
push 1
push 0x190
call fcn.005c42b0
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x78
push 0x12a
push 0x23
push str.Restore_highlighted
lea ecx, [ebp - 0x304]
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x78
push 0x12a
push 0xbe
push str.Delete_checked
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x578], eax
call fcn.005c1a50
push ecx
push 0xffffffffffffffff
push 0x1a
push 0x78
push 0x12a
push 0x159
push str.Close___Cancel
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x57c], eax
call fcn.005c1a50
mov edi, eax
mov byte [ebp - 0x1c], 1
mov eax, 0x1b
mov dword [ebp - 0x570], edi
mov word [ebp - 0x1a], ax
lea ecx, [ebp - 0x304]
push 1
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], di
push eax
call fcn.005c47a0
push 0x3c
push 0
push dword [ebp - 0x568]
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x304]
push 1
push 1
call fcn.005c3f80
mov esi, dword [ebp - 0x574]
mov ecx, esi
push 0
call fcn.004771c0
test eax, eax
je 0x431c42
mov eax, dword [esi + 0x14a8]
cmp eax, 0xfffffffa
je 0x431c42
lea ecx, [ebp - 0x304]
cmp dword [esi + 0x14d8], ecx
jne 0x431c31
cmp eax, dword [ebp - 0x578]
jne 0x431ba8
push 2
push 0xffffffffffffffff
push ebx
call fcn.005bb4c0
mov edi, eax
cmp edi, 0xffffffff
jne 0x431d56
sub esp, 8
lea eax, [ebp - 0x304]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.Please_select_one_of_the_backups_before_using_this_feature.
call fcn.0043e2e0
jmp 0x431c2b
cmp eax, dword [ebp - 0x57c]
jne 0x431d49
xorps xmm0, xmm0
lea ecx, [ebp - 0x304]
push ebx
movlpd qword [ebp - 0x56c], xmm0
call fcn.005bb7f0
mov edi, eax
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x56c], edi
mov byte [ebp - 4], 8
test edi, edi
je 0x431d14
cmp dword [edi], 0
je 0x431d14
sub esp, 8
lea eax, [ebp - 0x304]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_delete_the_selected_backups_
call fcn.0043e2e0
test eax, eax
jne 0x431cac
mov byte [ebp - 4], 6
push edi
call fcn.0041e1c3
add esp, 4
mov edi, dword [ebp - 0x570]
push 0
mov ecx, esi
call fcn.004771c0
test eax, eax
jne 0x431b41
or esi, 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005dc430
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0x34]
call fcn.005dc430
lea ecx, [ebp - 0x304]
call fcn.005c1c60
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x431c84
push eax
call ebx
lea ecx, [ebp - 0x28]
call fcn.005dc430
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
mov esi, dword [edi]
test esi, esi
jle 0x431cff
push 4
push dword [edi + esi*4]
lea ecx, [ebp - 0x304]
push ebx
call fcn.005bb510
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc1c0
lea ecx, [ebp - 0x28]
call fcn.005dbeb0
test al, al
jne 0x431ce9
push 3
call fcn.005dc190
push eax
call fcn.005771e0
test eax, eax
je 0x431cfa
push 0
push dword [edi + esi*4]
lea ecx, [ebp - 0x304]
push ebx
call fcn.005bb970
dec esi
test esi, esi
jg 0x431cb2
push edi
mov byte [ebp - 4], 6
call fcn.0041e1c3
mov esi, dword [ebp - 0x574]
jmp 0x431c28
sub esp, 8
lea eax, [ebp - 0x304]
mov ecx, esi
push 0x8c
push 0x190
push 0
push eax
push 4
push str.Please_check_at_least_one_of_the_backups_before_using_this_feature.
call fcn.0043e2e0
mov byte [ebp - 4], 6
test edi, edi
je 0x431c2b
jmp 0x431c22
cmp eax, edi
je 0x431c42
jmp 0x431c31
push 1
push 0
lea ecx, [ebp - 0x304]
call fcn.005c3f80
push 0
push 1
mov ecx, esi
call fcn.0043d720
push 4
push edi
push ebx
lea ecx, [ebp - 0x304]
call fcn.005bb510
push eax
lea ecx, [ebp - 0x28]
call fcn.005dc1c0
push dword [ebp - 0x580]
lea ecx, [ebp - 0x28]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.004309e0
mov esi, eax
jmp 0x431c45