Function at 0x477f90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68c
mov eax, dword [esp + 0x69c]
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x1e
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
mov si, word [esp + 0x6a0]
mov dword [eax], 1
cmp si, 0x8504
je 0x4783d2
cmp si, 0x8019
jb 0x4786b5
cmp si, 0x802c
ja 0x4786b5
cmp si, 0x801b
ja 0x4782c2
lea ecx, [esp + 0x10]
push 0x42023
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSettings]
cmp si, 0x8019
jne 0x47817a
mov esi, dword [sym.imp.SHELL32.dll_SHGetSetSettings]
xor eax, eax
mov ecx, 7
lea edi, [esp + 0x40]
push eax
lea edx, [esp + 0x40]
mov dword [esp + 0x40], 0
push 0x40021
rep stosd dword es:[edi], eax
push edx
call esi
mov edx, dword [esp + 0x3c]
push 1
mov eax, edx
and edx, 0xfffffff7
not eax
and eax, 1
push 0x40021
mov ecx, eax
and ecx, 1
shl ecx, 3
or ecx, edx
mov edx, eax
xor edx, ecx
and edx, 1
xor edx, ecx
xor ecx, ecx
and dh, 0x7f
test eax, eax
sete cl
and ecx, 1
shl ecx, 0xf
or edx, ecx
mov dword [esp + 0x44], edx
lea edx, [esp + 0x44]
push edx
call esi
test byte [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
je 0x478083
and al, 0xf6
jmp 0x478085
or al, 9
mov dword [esp + 0x1c], eax
push 1
lea eax, [esp + 0x20]
push 0x21
push eax
call esi
mov ecx, ebp
call fcn.00478c90
test eax, eax
je 0x4780a6
mov ecx, eax
call fcn.004ef2b0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], 0
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x60]
push 0x40021
push ecx
call esi
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x3c]
xor edx, ecx
test dh, 0x80
jne 0x47828e
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
lea edx, [esp + 0x94]
push 0
push edx
push SHChangeNotifyRegister
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x478132
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47812a
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
push str.ShowSuperHidden
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.00461850
push str.SuperHidden
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00461850
add esp, 0x18
mov ecx, ebp
call fcn.00478c90
test eax, eax
je 0x478169
mov ecx, eax
call fcn.004ef2b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47828e
jmp 0x47828b
cmp si, 0x801a
jne 0x4781b0
mov cl, byte [esp + 0x10]
mov eax, 2
test al, cl
mov ecx, dword [esp + 0x1c]
je 0x478197
and ecx, 0xfffffffd
jmp 0x478199
or ecx, eax
push 1
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
jmp 0x47828e
cmp si, 0x801b
jne 0x47828e
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], 0
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x20]
push 0x40021
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x94]
push 0
push ecx
push SHChangeNotifyRegister
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x478238
mov eax, dword [esp + 0xc]
test eax, eax
je 0x478230
push eax
call esi
mov edx, dword [esp + 0x14]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x1c]
push str.ShowSuperHidden
not eax
shr eax, 0xf
and eax, 1
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00461850
mov edx, dword [esp + 0x28]
push str.SuperHidden
shr edx, 0xf
and edx, 1
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00461850
add esp, 0x18
mov ecx, ebp
call fcn.00478c90
test eax, eax
je 0x478283
mov ecx, eax
call fcn.004ef2b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47828e
push eax
call esi
mov ecx, ebp
call fcn.00478c90
test eax, eax
je 0x4786b5
mov ecx, eax
call fcn.004e5430
mov ecx, dword [esp + 0x6a8]
mov eax, 1
mov dword [ecx], 1
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x802b
jne 0x4782fe
mov esi, dword [0x54f920]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.merke_ansicht
mov dword [0x54f920], eax
call fcn.00412590
mov ecx, ebp
call fcn.00466e90
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x802c
jne 0x47833a
mov esi, dword [0x54f91c]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.merke_markierte
mov dword [0x54f91c], eax
call fcn.00412590
mov ecx, ebp
call fcn.00466e90
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x801e
jne 0x47836f
mov edx, dword [ebp + 4]
push 5
push 0
push str.folders
push 0x54c710
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x801f
je 0x478681
cmp si, 0x8020
jne 0x4783c7
push 1
push 0
push ecx
mov ecx, esp
push str.Folder
call fcn.00405730
call fcn.00470860
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
push 1
push ecx
push ecx
mov ecx, esp
push str.Folder
call fcn.00405730
call fcn.00470860
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x8024
jne 0x478574
push 0
push 0
lea edx, [esp + 0x18]
push 0x3a
push edx
call fcn.004bd990
add esp, 8
mov ecx, eax
call fcn.0042f180
push ecx
mov ecx, esp
push eax
call fcn.00412310
lea ecx, [esp + 0x100]
call fcn.004bf710
mov eax, dword [esp + 0x10]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x478430
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x478430
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
cmp si, 0x8504
jne 0x47845f
mov eax, dword [esp + 0xf8]
test eax, eax
jne 0x47844f
mov dword [esp + 0x130], 1
jmp 0x47845f
push 0
push 1
push 0x465
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push ebp
call esi
test eax, eax
je 0x478478
push eax
mov ebp, eax
call esi
test eax, eax
jne 0x47846f
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
and ch, 0xfb
test eax, eax
mov dword [esp + 0x118], ecx
jne 0x47849b
mov dword [esp + 0x11c], ebp
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x14c]
lea edx, [esp + 0xf4]
mov dword [esp + 0x134], eax
mov dword [esp + 0x12c], ecx
mov dword [esp + 0xfc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x55f3e4
mov dword [esp + 0x104], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x55f418]
lea ecx, [esp + 0xfc]
push 0x55f3e4
mov dword [esp + 0x108], eax
mov dword [0x55f418], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov eax, dword [esp + 0x148]
mov dword [esp + 0x12c], 0
test eax, eax
mov dword [esp + 0x134], 0
je 0x478544
push eax
call fcn.005329d2
add esp, 4
mov dword [esp + 0x148], 0
lea ecx, [esp + 0xf4]
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0
call fcn.004bfc20
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x8022
jne 0x47859b
mov esi, dword [0x55f250]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55f250], eax
push 0x54c008
jmp 0x478675
cmp si, 0x8021
je 0x4786b5
cmp si, 0x8023
jne 0x4785cd
mov esi, dword [0x54f92c]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x54f92c], eax
push str.spalten_speichern
jmp 0x478675
cmp si, 0x8025
jne 0x4785f4
mov esi, dword [0x55f264]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55f264], eax
push str.fullrow_sel
jmp 0x478675
cmp si, 0x8026
jne 0x478618
mov esi, dword [0x55f25c]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55f25c], eax
push str.show_linie
jmp 0x478675
cmp si, 0x8029
jne 0x478653
mov esi, dword [0x54f900]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.adress_tree
mov dword [0x54f900], eax
call fcn.00412590
mov ecx, ebp
call fcn.00466e90
mov eax, dword [0x54f900]
mov dword [ebp + 0xf0], eax
jmp 0x478681
cmp si, 0x802a
jne 0x4786b5
mov esi, dword [0x54f918]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x54f918], eax
push str.adress_autosel
call fcn.00412590
mov ecx, ebp
call fcn.00466e90
push 0
lea ecx, [ebp + 0x49c4]
call fcn.004e9070
push 0
lea ecx, [ebp + 0x507c]
call fcn.004e9070
push 0
lea ecx, [ebp + 0x5734]
call fcn.004e9070
push 0
lea ecx, [ebp + 0x5dec]
call fcn.004e9070
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x68c
ret 0x10