Function at 0x420800
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48e4d4
mov eax, dword fs:[0]
push eax
sub esp, 0x6c8
mov eax, dword [0x4b5930]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0x6d8]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x1c], esi
add esi, 0x130
mov dword [esp + 0x14], ebx
mov edi, dword [esi + 8]
cmp dword [esi + 4], edi
mov dword [esp + 0x2c], esi
jbe 0x420863
call fcn.0046ecbd
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
mov dword [esp + 0x24], eax
jbe 0x420878
call fcn.0046ecbd
mov eax, dword [esp + 0x24]
push edi
push esi
push eax
push esi
lea eax, [esp + 0x54]
push eax
push esi
call fcn.0040e450
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 0xe8]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x14b
push ecx
call esi
mov edx, dword [edi + 0xe8]
push str.__Select_the_date__
push ebx
push 0x143
push edx
call esi
mov eax, dword [edi + 0xe8]
push ebx
push ebx
push 0x14e
push eax
call esi
mov ecx, dword [edi + 0xe8]
push 0xffffffffffffffff
push ebx
push 0x151
push ecx
call esi
push 0x410
lea edx, [esp + 0x2b8]
push ebx
push edx
call fcn.00473530
add esp, 0xc
push 0x410
lea eax, [esp + 0x2b8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.Registry_Backups_
lea ecx, [esp + 0x24]
push 0x4bb3b0
push ecx
call fcn.00408f40
mov dword [esp + 0x6ec], ebx
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
push eax
call fcn.0040ae10
add eax, 0x10
add esp, 0x10
mov dword [esp + 0x24], eax
cmp byte [ebp + 8], bl
mov byte [esp + 0x6e0], 1
push 5
lea ecx, [esp + 0x24]
je 0x420953
push str..rbu
jmp 0x420958
push str..reg
call fcn.0040ef80
call fcn.00457afe
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x420977
push 0x80004005
call fcn.00405140
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x6e0], 2
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x174]
push ecx
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x1b], bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
je 0x420c39
jmp 0x4209c0
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.00408f40
add esp, 0xc
lea ecx, [esp + 0x4c]
mov byte [esp + 0x6e0], 3
mov eax, dword [eax]
push ecx
push eax
call fcn.004590fe
mov esi, eax
mov byte [esp + 0x6e0], 2
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420a31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x420d48
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x1a0]
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x420a53
sub eax, edx
push eax
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x20]
call fcn.0040b1d0
push 4
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040e150
mov byte [esp + 0x6e0], 4
mov eax, dword [eax]
or dword [esp + 0x14], 1
push str.FULL
push eax
call fcn.0046ee13
add esp, 8
cmp eax, ebx
sete al
cmp al, bl
je 0x420aab
cmp byte [ebp + 8], bl
jne 0x420ade
push 4
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x20]
call fcn.0040e150
mov eax, dword [eax]
or dword [esp + 0x14], 2
push str.FULL
push eax
call fcn.0046ee13
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x420ae5
cmp byte [ebp + 8], bl
jne 0x420ae5
mov byte [esp + 0x12], 1
jmp 0x420ae9
mov byte [esp + 0x12], bl
test byte [esp + 0x14], 2
je 0x420b15
mov eax, dword [esp + 0x40]
and dword [esp + 0x14], 0xfffffffd
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420b15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x6e0], 2
test byte [esp + 0x14], 1
je 0x420b4c
mov eax, dword [esp + 0x44]
and dword [esp + 0x14], 0xfffffffe
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420b4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x12], bl
je 0x420c12
lea ecx, [esp + 0x34]
push ecx
mov esi, str._A___B__d___Y___H:_M:_S
lea edi, [esp + 0x34]
call fcn.0040f680
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x6e0], 5
mov edx, dword [esp + 0x30]
mov ecx, dword [eax + 0xe8]
push edx
push ebx
push 0x143
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x2c]
lea ebx, [esp + 0x18]
call fcn.0040e210
mov eax, dword [esi + 4]
test eax, eax
jne 0x420ba5
xor esi, esi
jmp 0x420bad
mov esi, dword [esi + 8]
sub esi, eax
sar esi, 2
mov ebx, dword [esp + 0x1c]
mov edx, dword [ebx + 0xe8]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x146
push edx
call edi
sub eax, 1
add esi, 0xffffffff
push esi
push eax
mov eax, dword [ebx + 0xe8]
push 0x151
push eax
call edi
mov byte [esp + 0x6e0], 2
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x13], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x174]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4209c0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x13], bl
jne 0x420ca8
mov ecx, dword [0x4bb2a0]
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.004365c0
mov byte [esp + 0x6e0], 6
mov eax, dword [eax]
push 0x40
push eax
push str.No_backups_present_for_restore.
mov ecx, edi
call fcn.00453095
mov byte [esp + 0x6e0], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420c98
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 2
mov ecx, edi
mov byte [edi + 0x144], 1
call fcn.004570b9
mov byte [esp + 0x6e0], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420cd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x6e0], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420cf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x6e0], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x6d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c0]
xor ecx, esp
call fcn.0046da06
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x420c12