Function at 0x40b610
Capabilities:
Enumerate files on windows
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x461fec]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b0], ecx
lea ecx, [ebp - 0x188]
call fcn.00401880
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x190]
call fcn.00401880
mov byte [ebp - 4], 2
mov eax, 0x7e7
mov word [ebp - 0x3c], ax
mov ecx, 0xb
mov word [ebp - 0x3a], cx
xor edx, edx
mov word [ebp - 0x38], dx
mov eax, 9
mov word [ebp - 0x36], ax
mov ecx, 3
mov word [ebp - 0x34], cx
xor edx, edx
mov word [ebp - 0x32], dx
xor eax, eax
mov word [ebp - 0x30], ax
xor ecx, ecx
mov word [ebp - 0x2e], cx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x4c8]
call fcn.0040cbe0
test eax, eax
je 0x40b6ef
mov dword [ebp - 0x194], 6
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x20], ecx
jmp 0x40b703
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 6
jg 0x40b9a3
cmp dword [ebp - 0x20], 6
jge 0x40b765
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x198]
push ecx
mov edx, dword [ebp - 0x1b0]
mov ecx, dword [edx + 0x4c8]
call fcn.0040cc80
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1b8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00403530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x198]
call fcn.004018a0
jmp 0x40b7b1
lea edx, [ebp - 0x19c]
push edx
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0x4c8]
call fcn.0040cc40
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1c0]
push edx
lea ecx, [ebp - 0x40]
call fcn.00403530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x19c]
call fcn.004018a0
push 0x454470
lea ecx, [ebp - 0x40]
call fcn.00401920
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.00421c90
add esp, 0xc
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1c8], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1c8]
push edx
lea ecx, [ebp - 0x188]
call fcn.00403530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a0]
call fcn.004018a0
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x188]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24], eax
xor ecx, ecx
cmp dword [ebp - 0x24], 0xffffffff
setne cl
mov dword [ebp - 0x18c], ecx
cmp dword [ebp - 0x18c], 0
je 0x40b994
mov edx, dword [ebp - 0x184]
and edx, 0x10
jne 0x40b978
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x40]
call fcn.00401920
push eax
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.00421c90
add esp, 0xc
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d0], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x190]
call fcn.00403530
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a4]
call fcn.004018a0
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x190]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40b916
mov ecx, 0x30
mov word [ebp - 0x1a6], cx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x190]
call fcn.004018a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004018a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.004018a0
mov ax, word [ebp - 0x1a6]
jmp 0x40b9e0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x40b96e
mov ecx, 0x30
mov word [ebp - 0x1a8], cx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x190]
call fcn.004018a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004018a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.004018a0
mov ax, word [ebp - 0x1a8]
jmp 0x40b9e0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x184]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x18c], eax
jmp 0x40b830
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40b6fa
xor eax, eax
mov word [ebp - 0x1aa], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x190]
call fcn.004018a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004018a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.004018a0
mov ax, word [ebp - 0x1aa]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00435c3d
mov esp, ebp
pop ebp
ret