Function at 0x43e821
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
push ebx
push esi
mov eax, dword [ebp + 0x14]
push edi
mov ebx, ecx
push 0x1e
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea edi, [ebp - 0xe8]
push 1
rep movsd dword es:[edi], dword [esi]
mov di, word [ebp + 0xc]
pop esi
cmp di, 0x8504
mov dword [ebp - 4], ebx
mov dword [eax], esi
je 0x43ebab
cmp di, 0x8019
jb 0x43ed81
cmp di, 0x802c
ja 0x43ed81
cmp di, 0x801b
ja 0x43ead5
lea eax, [ebp - 0xc]
push 0x42023
push eax
call dword [sym.imp.SHELL32.dll_SHGetSettings]
xor ebx, ebx
cmp di, 0x8019
jne 0x43e9ef
push 7
mov esi, dword [sym.imp.SHELL32.dll_SHGetSetSettings]
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
mov edi, 0x40021
push ebx
lea eax, [ebp - 0x50]
push edi
push eax
call esi
mov edx, dword [ebp - 0x50]
push 1
mov eax, edx
and edx, 0xfffffff7
not eax
and eax, 1
push edi
mov ecx, eax
and ecx, 1
shl ecx, 3
or ecx, edx
mov edx, eax
xor edx, ecx
and edx, 1
xor edx, ecx
xor ecx, ecx
and dh, 0x7f
cmp eax, ebx
sete cl
and ecx, 1
lea eax, [ebp - 0x50]
shl ecx, 0xf
or edx, ecx
push eax
mov dword [ebp - 0x50], edx
call esi
test byte [ebp - 0xc], 1
je 0x43e900
and dword [ebp - 0x30], 0xfffffff6
jmp 0x43e904
or dword [ebp - 0x30], 9
push 1
lea eax, [ebp - 0x30]
push 0x21
push eax
call esi
mov ecx, dword [ebp - 4]
call fcn.0043f01c
cmp eax, ebx
je 0x43e921
mov ecx, eax
call fcn.004778de
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x70]
push 0x40021
push eax
call esi
mov eax, dword [ebp - 0x70]
xor eax, dword [ebp - 0x50]
test ah, 0x80
jne 0x43e9cb
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe8]
push ebx
push eax
push SHChangeNotifyRegister
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x43e98c
cmp dword [ebp + 0xc], ebx
je 0x43e986
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
push str.ShowSuperHidden
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.00432ee7
push str.SuperHidden
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.00432ee7
mov ecx, dword [ebp - 4]
add esp, 0x18
call fcn.0043f01c
cmp eax, ebx
je 0x43e9c1
mov ecx, eax
call fcn.004778de
cmp dword [ebp + 0xc], ebx
je 0x43e9cb
push dword [ebp + 0xc]
call esi
push 1
pop esi
mov ecx, dword [ebp - 4]
call fcn.0043f01c
cmp eax, ebx
je 0x43ed81
mov ecx, eax
call fcn.00472b92
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
jmp 0x43eb4b
cmp di, 0x801a
jne 0x43ea15
test byte [ebp - 0xc], 2
je 0x43ea02
and dword [ebp - 0x30], 0xfffffffd
jmp 0x43ea06
or dword [ebp - 0x30], 2
push esi
lea eax, [ebp - 0x30]
push 2
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
jmp 0x43e9ce
cmp di, 0x801b
jne 0x43e9ce
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push 0x40021
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe8]
push ebx
push eax
push SHChangeNotifyRegister
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x43ea7c
cmp dword [ebp + 0xc], ebx
je 0x43ea76
push dword [ebp + 0xc]
call edi
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x30]
push str.ShowSuperHidden
not eax
shr eax, 0xf
and eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00432ee7
mov eax, dword [ebp - 0x30]
push str.SuperHidden
shr eax, 0xf
and eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00432ee7
mov ecx, dword [ebp - 4]
add esp, 0x18
call fcn.0043f01c
cmp eax, ebx
je 0x43eac2
mov ecx, eax
call fcn.004778de
cmp dword [ebp + 0xc], ebx
je 0x43e9ce
push dword [ebp + 0xc]
call edi
jmp 0x43e9ce
cmp di, 0x802b
jne 0x43eaf7
xor eax, eax
cmp dword [0x4b7224], eax
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b7224], eax
push str.merke_ansicht
jmp 0x43eb17
cmp di, 0x802c
jne 0x43eb28
xor eax, eax
cmp dword [0x4b7220], eax
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b7220], eax
push str.merke_markierte
call fcn.0040a529
mov ecx, ebx
call fcn.0043519f
jmp 0x43ed81
cmp di, 0x801e
jne 0x43eb52
push 5
push 0
push str.folders
push str.control.exe
push str.open
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, esi
jmp 0x43ed83
cmp di, 0x801f
jne 0x43eb60
xor ebx, ebx
jmp 0x43ed4e
cmp di, 0x8020
jne 0x43eba0
xor ebx, ebx
push esi
push ebx
push ecx
mov edi, str.Folder
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a340
add esp, 0xc
xor ecx, ecx
cmp eax, ebx
sete cl
push esi
push ecx
push ecx
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a340
add esp, 0xc
jmp 0x43ed81
cmp di, 0x8024
jne 0x43ec3d
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push ebx
push 0x3a
push eax
call fcn.00461337
pop ecx
pop ecx
mov ecx, eax
call fcn.0045a4e5
push ecx
mov ecx, esp
push eax
call fcn.0044551c
lea ecx, [ebp - 0x68c]
call fcn.00461e48
lea ecx, [ebp + 0xc]
call fcn.004038fb
cmp di, 0x8504
jne 0x43ec09
cmp dword [ebp - 0x688], ebx
jne 0x43ebf6
mov dword [ebp - 0x650], esi
jmp 0x43ec09
push ebx
push esi
push 0x465
push dword [ebp - 0x688]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [eax + 4]
push edi
call esi
cmp eax, ebx
je 0x43ec21
mov edi, eax
push eax
jmp 0x43ec16
push edi
lea ecx, [ebp - 0x68c]
call fcn.00444d0b
lea ecx, [ebp - 0x68c]
call fcn.004620e0
jmp 0x43ed81
cmp di, 0x8022
jne 0x43ec64
xor ebx, ebx
xor eax, eax
cmp dword [0x4c6848], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c6848], eax
push 0x4b3dc0
jmp 0x43ed41
cmp di, 0x8021
je 0x43ed81
cmp di, 0x8023
jne 0x43ec96
xor ebx, ebx
xor eax, eax
cmp dword [0x4b7230], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b7230], eax
push str.spalten_speichern
jmp 0x43ed41
cmp di, 0x8025
jne 0x43ecbd
xor ebx, ebx
xor eax, eax
cmp dword [0x4c685c], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c685c], eax
push str.fullrow_sel
jmp 0x43ed41
cmp di, 0x8026
jne 0x43ece1
xor ebx, ebx
xor eax, eax
cmp dword [0x4c6854], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c6854], eax
push str.show_linie
jmp 0x43ed41
cmp di, 0x8029
jne 0x43ed1f
xor ebx, ebx
xor eax, eax
cmp dword [0x4b7208], ebx
sete al
push eax
push ecx
mov ecx, esp
push str.adress_tree
mov dword [0x4b7208], eax
call fcn.0040a529
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.0043519f
mov eax, dword [0x4b7208]
mov dword [esi + 0xe4], eax
jmp 0x43ed4e
cmp di, 0x802a
jne 0x43ed81
xor ebx, ebx
xor eax, eax
cmp dword [0x4b721c], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b721c], eax
push str.adress_autosel
call fcn.0040a529
mov ecx, dword [ebp - 4]
call fcn.0043519f
mov esi, dword [ebp - 4]
push ebx
lea ecx, [esi + 0x4ae0]
call fcn.00474859
push ebx
lea ecx, [esi + 0x52ac]
call fcn.00474859
push ebx
lea ecx, [esi + 0x5a78]
call fcn.00474859
push ebx
lea ecx, [esi + 0x6244]
call fcn.00474859
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10