Function at 0x43e4f0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4ce480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
xor esi, esi
mov dword [esp + 0x5c], esi
mov eax, dword [esp + 0x68]
cmp eax, esi
je 0x43e51c
mov eax, dword [eax + 4]
jmp 0x43e51e
xor eax, eax
cmp eax, esi
je 0x43e525
sub eax, 2
test eax, 0xfffffffe
jne 0x43e583
mov eax, dword [esp + 0x64]
push 0x30
push 0x4d9784
push 0x4e0c20
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esp + 0x5c], 0xffffffff
mov eax, dword [esp + 0x68]
cmp eax, esi
je 0x43ead8
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43ead8
push esi
call fcn.0049e96f
add esp, 4
pop esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
add esp, 0x5c
ret 8
push ebp
mov dword [esp + 8], esi
push ebx
mov byte [esp + 0x64], 1
xor ebp, ebp
push edi
mov edi, dword [esi + 0x4e0c9c]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43e5a0
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43e5be
add eax, 8
jne 0x43e5c3
mov eax, 0x4d9064
push ebx
push edi
push eax
call fcn.004a0f54
add esp, 0xc
test eax, eax
je 0x43e5e4
add esi, 0xc
inc ebp
cmp esi, 0x3c
jb 0x43e591
mov ebp, dword [esp + 0x10]
jmp 0x43e80a
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], 0
test eax, eax
je 0x43e5fb
lea edi, [eax + 8]
test edi, edi
jne 0x43e600
mov edi, 0x4d9064
lea esi, [ebp + ebp*2]
lea ecx, [esp + 0x18]
lea edi, [edi + ebx*2]
add esi, esi
mov eax, dword [esi + esi + 0x4e0ca4]
push ecx
lea edx, [edi + 2]
add esi, esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
lea ebx, [esp + 0x18]
mov ebp, eax
call fcn.00402bd0
mov byte [esp + 0x68], 2
mov ecx, dword [esi + 0x4e0ca0]
push ecx
lea ebx, [esp + 0x24]
call fcn.00402bd0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
push ecx
mov bl, 3
push eax
mov byte [esp + 0x74], bl
call fcn.004907a0
mov esi, eax
mov byte [esp + 0x68], 4
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43e67e
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43e67e
push edi
call fcn.0049e96f
add esp, 4
mov esi, dword [esi]
mov dword [esp + 0x74], esi
test esi, esi
je 0x43e68f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x68], bl
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x43e6b3
push eax
mov esi, eax
call edi
test eax, eax
jne 0x43e6b3
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x68], 2
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43e6d2
push eax
mov esi, eax
call edi
test eax, eax
jne 0x43e6d2
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x68], 1
mov esi, dword [esp + 0x14]
test esi, esi
je 0x43e6ef
push esi
call edi
test eax, eax
jne 0x43e6ef
push esi
call fcn.0049e96f
add esp, 4
test ebp, ebp
jne 0x43e715
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4e0aa0
lea eax, [esp + 0x74]
call fcn.004905d0
mov ebp, dword [esp + 0x10]
jmp 0x43e80a
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43e722
add eax, 8
jne 0x43e727
mov eax, 0x4d9064
push 0x5c
push eax
call fcn.0049ec5c
add esp, 8
add eax, 2
je 0x43e755
mov ecx, eax
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x43e740
sub ecx, esi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
jmp 0x43e757
xor ecx, ecx
push eax
mov eax, ecx
lea ebx, [esp + 0x14]
call fcn.00490250
mov esi, dword [esp + 0x74]
test esi, esi
je 0x43e770
mov eax, dword [esi + 4]
jmp 0x43e772
xor eax, eax
mov ecx, eax
test ecx, ecx
je 0x43e77b
sub ecx, 2
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x43e788
mov edx, dword [ebp + 4]
jmp 0x43e78a
xor edx, edx
test edx, edx
je 0x43e791
sub edx, 2
test esi, esi
je 0x43e79c
lea eax, [esi + 8]
test eax, eax
jne 0x43e7a1
mov eax, 0x4d9064
shr ecx, 1
shr edx, 1
sub ecx, edx
dec ecx
lea esi, [esp + 0x20]
call fcn.00442d80
mov esi, eax
mov byte [esp + 0x68], 5
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43e7d6
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43e7d6
push edi
call fcn.0049e96f
add esp, 4
mov esi, dword [esi]
mov dword [esp + 0x74], esi
test esi, esi
je 0x43e7e7
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x68], 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x43e80a
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43e80a
push esi
call fcn.0049e96f
add esp, 4
push 0x38
lea eax, [esp + 0x2c]
push 0
push eax
mov dword [esp + 0x30], 0
call fcn.004a30a0
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
add esp, 0xc
push 0
push str.RegEdit_RegEdit
call edi
mov esi, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x43e88f
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], 0x40
mov dword [esp + 0x34], str.open
mov dword [esp + 0x38], str.regedit.exe
mov dword [esp + 0x44], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [esp + 0x5c]
push 0xffffffffffffffff
push edx
call esi
push 0
push str.RegEdit_RegEdit
call edi
mov ebx, eax
mov dword [esp + 0x14], ebx
jmp 0x43e8ae
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x5c], eax
test ebx, ebx
jne 0x43e8ea
mov edx, dword [esp + 0x70]
push 0x10
push 0x4d9784
push 0x4e0d10
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [esp + 0x68], bl
test ebp, ebp
je 0x43eaaf
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43eaaf
push ebp
jmp 0x43eaa7
push ebx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43e8f9
push 1
jmp 0x43e8fb
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call ebp
push 0
push str.SysTreeView32
push 0
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
push edi
call ebp
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x5c]
push 0xffffffffffffffff
push eax
call esi
push 0
push 0x10288
push 0x111
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push ecx
call esi
mov ebp, 0x1e
push 0
push 0x25
push 0x100
push edi
call ebx
mov edx, dword [esp + 0x5c]
push 0xffffffffffffffff
push edx
call esi
sub ebp, 1
jne 0x43e953
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43e9c2
lea ebp, [eax + 8]
test ebp, ebp
je 0x43e9c2
cmp word [ebp], 0
je 0x43e9c2
movzx eax, word [ebp]
cmp ax, 0x5c
jne 0x43e998
push 0
push 0x27
push 0x100
jmp 0x43e9ac
movzx eax, ax
push eax
call fcn.004a10ae
add esp, 4
push 0
push eax
push 0x102
push edi
call ebx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push ecx
call esi
add ebp, 2
cmp word [ebp], 0
jne 0x43e983
mov edx, dword [esp + 0x5c]
push 0xffffffffffffffff
push edx
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43e9d8
mov eax, dword [eax + 4]
jmp 0x43e9da
xor eax, eax
test eax, eax
je 0x43e9e1
sub eax, 2
test eax, 0xfffffffe
je 0x43ea7c
mov eax, dword [esp + 0x14]
push 0
push str.SysListView32
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push ecx
call esi
push 0
push 0x24
push 0x100
push edi
call ebx
mov edx, dword [esp + 0x5c]
push 0xffffffffffffffff
push edx
call esi
cmp dword [esp + 0x10], 0
je 0x43ea7c
mov ebp, dword [esp + 0x10]
add ebp, 8
je 0x43ea7c
movzx eax, word [ebp]
test ax, ax
je 0x43ea7c
movzx eax, ax
lea ebx, [ebx]
movzx eax, ax
push eax
call fcn.004a10ae
add esp, 4
push 0
push eax
push 0x102
push edi
call ebx
mov ecx, dword [esp + 0x5c]
push 0xffffffffffffffff
push ecx
call esi
movzx eax, word [ebp + 2]
add ebp, 2
test ax, ax
jne 0x43ea50
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esp + 0x68], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x43eaaf
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43eaaf
push esi
call fcn.0049e96f
add esp, 4
mov dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x74]
test eax, eax
je 0x43ead5
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x43ead5
push esi
call fcn.0049e96f
add esp, 4
pop edi
pop ebx
pop ebp
mov ecx, dword [esp + 0x54]
pop esi
mov dword fs:[0], ecx
add esp, 0x5c
ret 8