Function at 0x4309e0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebf57
mov eax, dword fs:[0]
push eax
sub esp, 0x57c
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x560], edi
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x588], eax
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
push 0
push 0
push 0x624284
push 0x624b44
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.BackupInfo.ini
push ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.005dc200
mov ecx, eax
call fcn.005da270
push 0x800
push 0
push str.Name
push str.BackupInfo
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x30]
call fcn.005db1d0
mov ecx, eax
call fcn.005dbeb0
test al, al
je 0x430acc
xor ebx, ebx
jmp 0x4313b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x1290]
push str..dat
push ecx
mov ecx, eax
mov dword [ebp - 0x578], eax
call fcn.0057c2d0
push eax
push str.Users_
push ebx
lea ecx, [ebp - 0x24]
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627ca8
push dword [ebp - 0x570]
lea ecx, [ebp - 0x24]
mov ebx, eax
call fcn.005dc200
lea ecx, [ebp - 0x24]
call fcn.005dc190
push eax
call esi
push ecx
mov ecx, edi
mov dword [ebp - 0x56c], eax
call fcn.0043e540
push 0x270
mov esi, eax
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.00420090
add esp, 8
lea eax, [edi + 0x14a8]
lea ecx, [ebp - 0x2f0]
push esi
push 0xffffffffffffffff
push 0xc80000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x154
push 0x1f4
push str.Registry_restore
push str.UVK_DLG_CLASS
push eax
call fcn.005c6220
push 0
push 0
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 2
call fcn.005c5730
mov edx, esi
mov ecx, eax
call fcn.005d3010
test esi, esi
je 0x430bda
push 0
lea ecx, [ebp - 0x2f0]
call fcn.005c5730
mov ecx, dword [edi + 0x14e4]
push eax
call fcn.005c6150
movsd xmm1, qword [0x6edb20]
lea ecx, [ebp - 0x2f0]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push ecx
push 0xffffffffffffffff
push 0x28
push 0x28
push 0xa
push 0xa
push ecx
push 0x8e
mov ecx, edi
call fcn.004363b0
push eax
lea ecx, [ebp - 0x2f0]
call fcn.005c0240
push 0xffffffffffffffff
push 0x10000101
push 0x37
push 0x1b8
push 0xa
push 0x32
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2f0]
call fcn.005c0890
movsd xmm1, qword [0x6edaf8]
lea ecx, [ebp - 0x2f0]
push 0
push str.Arial
push 1
push 0x320
call fcn.005c42b0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12
push 0x140
push 0x46
push 0x1e
push str.Please_select_below_the_rootkeys_you_wish_to_restore.
lea ecx, [ebp - 0x2f0]
call fcn.005c0890
sub esp, 8
lea ecx, [ebp - 0x2f0]
push 0x10
push 0x1ae
push 0x64
push 0x28
push str._HKEY_CURRENT_USER._This_is_where_the_system_saves_your_settings
call fcn.005c19a0
mov dword [ebp - 0x580], eax
lea ecx, [ebp - 0x2f0]
mov esi, 4
test ebx, ebx
mov eax, esi
mov edi, 0x40
cmove eax, edi
push eax
push 0xffffffffffffffff
call fcn.005bd3f0
sub esp, 8
lea ecx, [ebp - 0x2f0]
push 0x10
push 0x1ae
push 0x82
push 0x28
push str._HKEY_LOCAL_MACHINE._This_is_where_the_system_saves_global_settings
call fcn.005c19a0
cmp dword [ebp - 0x56c], 0
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x584], eax
cmove esi, edi
push esi
push 0xffffffffffffffff
call fcn.005bd3f0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x10
push 0x1cc
push 0xaf
push 0x1e
push str.You_may_also_select_below_any_additional_users_you_want_to_restore:
lea ecx, [ebp - 0x2f0]
call fcn.005c0890
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x54]
movq qword [ebp - 0x54], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x48]
movq qword [ebp - 0x48], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Users.dat
push dword [ebp - 0x570]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.005dc200
push 0x260
lea eax, [ebp - 0x550]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.005dc190
push 0x250
mov esi, eax
lea eax, [ebp - 0x550]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea eax, [ebp - 0x550]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edx, eax
mov dword [ebp - 0x300], edx
cmp edx, 0xffffffff
je 0x430e85
mov eax, 3
mov dword [ebp - 0x2fc], eax
nop
cmp word [ebp - 0x524], 0x2e
jne 0x430e26
mov cx, word [ebp - 0x522]
test cx, cx
je 0x430e53
cmp cx, 0x2e
jne 0x430e26
cmp word [ebp - 0x520], 0
je 0x430e53
test eax, eax
je 0x430e85
mov ecx, dword [ebp - 0x550]
test al, 1
je 0x430e3c
test ecx, 0x400
jne 0x430e53
test al, 2
je 0x430e47
test cl, 0x10
je 0x430e85
jmp 0x430e53
test al, 4
je 0x430e85
test ecx, 0x10
jne 0x430e85
lea eax, [ebp - 0x550]
push eax
push edx
call ebx
test eax, eax
je 0x430e6f
mov eax, dword [ebp - 0x2fc]
mov edx, dword [ebp - 0x300]
jmp 0x430e00
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x300], 0xffffffff
push 4
push 0x10804000
push 0x5f
push 0x1cc
push 0xc3
push 0x14
xor ebx, ebx
mov byte [ebp - 4], 6
push ebx
push ebx
lea ecx, [ebp - 0x2f0]
call fcn.005c0620
movaps xmm0, xmmword [0x6edcc0]
lea ecx, [ebp - 0x2f0]
mov edi, eax
mov dword [ebp - 0x7c], 0x28
push edi
mov dword [ebp - 0x568], edi
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x74], 3
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 2
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], 2
call fcn.005c5730
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 4
push 0x108e
push eax
mov dword [ebp - 0x564], eax
call esi
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0x10a2
push dword [ebp - 0x564]
call esi
cmp dword [ebp - 0x300], 0xffffffff
je 0x43102a
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
push ecx
mov ecx, dword [ebp - 0x578]
call fcn.0057c2d0
push eax
push 4
push 1
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x48]
call fcn.005dc260
mov ecx, eax
call fcn.005dadc0
mov ecx, eax
call fcn.005dc4c0
test al, al
jne 0x430fae
push 0
lea ecx, [ebp - 0x48]
call fcn.005dc190
push eax
push 0x104
lea ecx, [ebp - 0x30]
call fcn.005db9a0
mov ecx, eax
call fcn.0059c550
test al, al
je 0x430fae
push 0
push edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x2710
push 0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x2f0]
call fcn.005bbb80
not eax
shr eax, 0x1f
add ebx, eax
mov eax, dword [ebp - 0x300]
cmp eax, 0xffffffff
je 0x430ff2
lea ecx, [ebp - 0x550]
push ecx
push eax
call esi
test eax, eax
je 0x430fdc
lea ecx, [ebp - 0x550]
call fcn.004011a0
test al, al
jne 0x430f30
jmp 0x430ff2
push dword [ebp - 0x300]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x300], 0xffffffff
test ebx, ebx
je 0x43102a
mov ebx, dword [ebp - 0x560]
movsd xmm0, qword [0x6edab0]
comisd xmm0, xmmword [ebx + 8]
jbe 0x43108e
push ecx
push dword [ebp - 0x564]
lea ecx, [ebp - 0x2f0]
push 1
push 0x590010
call fcn.005b8c90
jmp 0x43108e
push edi
lea ecx, [ebp - 0x2f0]
call fcn.005bf2f0
or edi, 0xffffffff
lea ecx, [ebp - 0x2f0]
push edi
push 0x10000101
push 0x12
push 0x1a4
push 0xeb
push 0x28
push str.There_are_no_other_users_in_this_backup.
mov dword [ebp - 0x568], edi
call fcn.005c0890
movsd xmm0, qword [0x6edb20]
sub esp, 0xc
movsd qword [esp + 4], xmm0
push 0
push ecx
push 0x320
push edi
lea ecx, [ebp - 0x2f0]
call fcn.005beb10
mov ebx, dword [ebp - 0x560]
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x64
push 0x12c
push 0x64
push 0x6557e4
lea ecx, [ebp - 0x2f0]
call fcn.005c1a50
push 0xffffffffffffffff
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x57c], eax
call fcn.005c4370
push ecx
push 0xffffffffffffffff
push 0x1e
push 0x64
push 0x12c
push 0x12c
push str.Cancel
lea ecx, [ebp - 0x2f0]
call fcn.005c1a50
mov esi, eax
mov byte [ebp - 0x18], 1
mov eax, 0x1b
mov dword [ebp - 0x564], esi
mov word [ebp - 0x16], ax
lea ecx, [ebp - 0x2f0]
push 1
lea eax, [ebp - 0x18]
mov word [ebp - 0x14], si
push eax
call fcn.005c47a0
push 1
push 1
lea ecx, [ebp - 0x2f0]
call fcn.005c3f80
lea eax, [ebx + 0x14f0]
mov ecx, eax
mov dword [ebp - 0x56c], eax
call fcn.005b6bd0
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov byte [ebp - 0x559], al
test al, al
je 0x43114a
push 1
lea ecx, [ebx + 0x14f0]
call fcn.005b6250
push 0
mov ecx, ebx
call fcn.004771c0
test eax, eax
je 0x431378
nop dword [eax + eax]
mov eax, dword [ebx + 0x14a8]
cmp eax, 0xfffffffa
je 0x431378
lea ecx, [ebp - 0x2f0]
cmp ecx, dword [ebx + 0x14d8]
jne 0x4312df
cmp eax, dword [ebp - 0x57c]
jne 0x431370
push 4
push dword [ebp - 0x580]
call fcn.005bc500
mov esi, eax
lea ecx, [ebp - 0x2f0]
xor ebx, ebx
test esi, esi
push 4
push dword [ebp - 0x584]
setne bl
mov dword [ebp - 0x574], ebx
call fcn.005bc500
test eax, eax
je 0x4311d0
xor ebx, ebx
test esi, esi
setne bl
ret
add ebx, 2
mov dword [ebp - 0x574], ebx
lea ecx, [ebp - 0x3c]
call fcn.005dc400
xorps xmm0, xmm0
lea ecx, [ebp - 0x2f0]
push edi
movlpd qword [ebp - 0x558], xmm0
call fcn.005bb7f0
mov esi, eax
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x558], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x43127e
mov edi, 1
cmp dword [esi], edi
jl 0x431278
mov ebx, dword [ebp - 0x568]
nop dword [eax + eax]
push 0
push dword [esi + edi*4]
lea ecx, [ebp - 0x2f0]
push ebx
call fcn.005bb510
push eax
lea ecx, [ebp - 0x30]
call fcn.005dc1c0
lea ecx, [ebp - 0x30]
call fcn.005dbeb0
test al, al
jne 0x43126d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62794c
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005da780
inc edi
cmp edi, dword [esi]
jle 0x431220
mov ebx, dword [ebp - 0x574]
mov edi, dword [ebp - 0x568]
push 1
lea ecx, [ebp - 0x3c]
call fcn.005dadc0
test ebx, ebx
jne 0x4312ff
lea ecx, [ebp - 0x3c]
call fcn.005dbeb0
test al, al
je 0x4312ff
mov ecx, dword [ebp - 0x560]
lea eax, [ebp - 0x2f0]
sub esp, 8
push 0x8c
push 0x190
push ebx
push eax
push 1
push str.You_didnt_select_any_hives_to_restore._r_n_r_nClose_this_window_
call fcn.0043e2e0
cmp eax, 1
je 0x4313e0
mov byte [ebp - 4], 6
test esi, esi
je 0x4312d9
push esi
call fcn.0041e1c3
add esp, 4
mov esi, dword [ebp - 0x564]
mov ecx, dword [ebp - 0x560]
push 0
call fcn.004771c0
test eax, eax
je 0x431378
mov ebx, dword [ebp - 0x560]
jmp 0x431160
mov ecx, dword [ebp - 0x560]
lea eax, [ebp - 0x2f0]
sub esp, 8
push 0x8c
push 0x96
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_restore_the_selected_keys__r_n_r_nYour_computer_may_be_automatically_rebooted_to_complete_the_restore_process.
call fcn.0043e2e0
test eax, eax
je 0x4312c8
cmp byte [ebp - 0x559], 0
jne 0x4313ef
mov eax, dword [ebp - 0x560]
mov ecx, eax
push 0
push 0xffffffffffffffba
sub esp, 8
push 0x46
push 0x1c2
push dword [eax + 0x14e4]
push 0x62439c
call fcn.0043da60
mov ecx, eax
call fcn.005b66e0
mov edi, dword [ebp - 0x56c]
jmp 0x4313ff
cmp eax, esi
jne 0x4312df
or ebx, 0xffffffff
mov eax, dword [ebp - 0x300]
cmp eax, 0xffffffff
je 0x43138d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x48]
call fcn.005dc430
lea ecx, [ebp - 0x54]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x2f0]
call fcn.005c1c60
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x24]
call fcn.005dc430
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
test esi, esi
je 0x431378
push esi
call fcn.0041e1c3
add esp, 4
jmp 0x431378
mov edi, dword [ebp - 0x56c]
sub esp, 8
mov ecx, edi
call fcn.005b62b0
push 1
push 0
lea ecx, [ebp - 0x2f0]
call fcn.005c3f80
mov ecx, dword [ebp - 0x560]
push 0
push 1
call fcn.0043d720
push dword [ebp - 0x588]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, dword [ebp - 0x578]
push eax
push ebx
push dword [ebp - 0x570]
call fcn.0054c8e0
cmp byte [ebp - 0x559], 0
mov ebx, eax
jne 0x431452
push 2
mov ecx, edi
call fcn.005b6250
test esi, esi
je 0x43137b
push esi
call fcn.0041e1c3
add esp, 4
jmp 0x43137b