Function at 0x43e8d1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
push ebx
push esi
mov eax, dword [ebp + 0x14]
push edi
mov ebx, ecx
push 0x1e
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea edi, [ebp - 0xe8]
push 1
rep movsd dword es:[edi], dword [esi]
mov di, word [ebp + 0xc]
pop esi
cmp di, 0x8504
mov dword [ebp - 4], ebx
mov dword [eax], esi
je 0x43ec5b
cmp di, 0x8019
jb 0x43ee31
cmp di, 0x802c
ja 0x43ee31
cmp di, 0x801b
ja 0x43eb85
lea eax, [ebp - 0xc]
push 0x42023
push eax
call dword [sym.imp.SHELL32.dll_SHGetSettings]
xor ebx, ebx
cmp di, 0x8019
jne 0x43ea9f
push 7
mov esi, dword [sym.imp.SHELL32.dll_SHGetSetSettings]
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
mov edi, 0x40021
push ebx
lea eax, [ebp - 0x50]
push edi
push eax
call esi
mov edx, dword [ebp - 0x50]
push 1
mov eax, edx
and edx, 0xfffffff7
not eax
and eax, 1
push edi
mov ecx, eax
and ecx, 1
shl ecx, 3
or ecx, edx
mov edx, eax
xor edx, ecx
and edx, 1
xor edx, ecx
xor ecx, ecx
and dh, 0x7f
cmp eax, ebx
sete cl
and ecx, 1
lea eax, [ebp - 0x50]
shl ecx, 0xf
or edx, ecx
push eax
mov dword [ebp - 0x50], edx
call esi
test byte [ebp - 0xc], 1
je 0x43e9b0
and dword [ebp - 0x30], 0xfffffff6
jmp 0x43e9b4
or dword [ebp - 0x30], 9
push 1
lea eax, [ebp - 0x30]
push 0x21
push eax
call esi
mov ecx, dword [ebp - 4]
call fcn.0043f0cc
cmp eax, ebx
je 0x43e9d1
mov ecx, eax
call fcn.00477dbe
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x70], ebx
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x70]
push 0x40021
push eax
call esi
mov eax, dword [ebp - 0x70]
xor eax, dword [ebp - 0x50]
test ah, 0x80
jne 0x43ea7b
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe8]
push ebx
push eax
push SHChangeNotifyRegister
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x43ea3c
cmp dword [ebp + 0xc], ebx
je 0x43ea36
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
push str.ShowSuperHidden
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.00432eff
push str.SuperHidden
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.00432eff
mov ecx, dword [ebp - 4]
add esp, 0x18
call fcn.0043f0cc
cmp eax, ebx
je 0x43ea71
mov ecx, eax
call fcn.00477dbe
cmp dword [ebp + 0xc], ebx
je 0x43ea7b
push dword [ebp + 0xc]
call esi
push 1
pop esi
mov ecx, dword [ebp - 4]
call fcn.0043f0cc
cmp eax, ebx
je 0x43ee31
mov ecx, eax
call fcn.00473072
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
jmp 0x43ebfb
cmp di, 0x801a
jne 0x43eac5
test byte [ebp - 0xc], 2
je 0x43eab2
and dword [ebp - 0x30], 0xfffffffd
jmp 0x43eab6
or dword [ebp - 0x30], 2
push esi
lea eax, [ebp - 0x30]
push 2
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
jmp 0x43ea7e
cmp di, 0x801b
jne 0x43ea7e
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push 0x40021
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe8]
push ebx
push eax
push SHChangeNotifyRegister
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x43eb2c
cmp dword [ebp + 0xc], ebx
je 0x43eb26
push dword [ebp + 0xc]
call edi
mov eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x30]
push str.ShowSuperHidden
not eax
shr eax, 0xf
and eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00432eff
mov eax, dword [ebp - 0x30]
push str.SuperHidden
shr eax, 0xf
and eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00432eff
mov ecx, dword [ebp - 4]
add esp, 0x18
call fcn.0043f0cc
cmp eax, ebx
je 0x43eb72
mov ecx, eax
call fcn.00477dbe
cmp dword [ebp + 0xc], ebx
je 0x43ea7e
push dword [ebp + 0xc]
call edi
jmp 0x43ea7e
cmp di, 0x802b
jne 0x43eba7
xor eax, eax
cmp dword [0x4b82b4], eax
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b82b4], eax
push str.merke_ansicht
jmp 0x43ebc7
cmp di, 0x802c
jne 0x43ebd8
xor eax, eax
cmp dword [0x4b82b0], eax
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b82b0], eax
push str.merke_markierte
call fcn.0040a4e8
mov ecx, ebx
call fcn.004351d3
jmp 0x43ee31
cmp di, 0x801e
jne 0x43ec02
push 5
push 0
push str.folders
push str.control.exe
push str.open
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, esi
jmp 0x43ee33
cmp di, 0x801f
jne 0x43ec10
xor ebx, ebx
jmp 0x43edfe
cmp di, 0x8020
jne 0x43ec50
xor ebx, ebx
push esi
push ebx
push ecx
mov edi, str.Folder
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
xor ecx, ecx
cmp eax, ebx
sete cl
push esi
push ecx
push ecx
mov ecx, esp
push edi
call fcn.00403927
call fcn.0043a3c2
add esp, 0xc
jmp 0x43ee31
cmp di, 0x8024
jne 0x43eced
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push ebx
push 0x3a
push eax
call fcn.00461770
pop ecx
pop ecx
mov ecx, eax
call fcn.0043a2eb
push ecx
mov ecx, esp
push eax
call fcn.00413efb
lea ecx, [ebp - 0x68c]
call fcn.004622c5
lea ecx, [ebp + 0xc]
call fcn.004038fb
cmp di, 0x8504
jne 0x43ecb9
cmp dword [ebp - 0x688], ebx
jne 0x43eca6
mov dword [ebp - 0x650], esi
jmp 0x43ecb9
push ebx
push esi
push 0x465
push dword [ebp - 0x688]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov edi, dword [eax + 4]
push edi
call esi
cmp eax, ebx
je 0x43ecd1
mov edi, eax
push eax
jmp 0x43ecc6
push edi
lea ecx, [ebp - 0x68c]
call fcn.00444dbb
lea ecx, [ebp - 0x68c]
call fcn.0046255d
jmp 0x43ee31
cmp di, 0x8022
jne 0x43ed14
xor ebx, ebx
xor eax, eax
cmp dword [0x4c7928], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c7928], eax
push 0x4b4de0
jmp 0x43edf1
cmp di, 0x8021
je 0x43ee31
cmp di, 0x8023
jne 0x43ed46
xor ebx, ebx
xor eax, eax
cmp dword [0x4b82c0], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b82c0], eax
push str.spalten_speichern
jmp 0x43edf1
cmp di, 0x8025
jne 0x43ed6d
xor ebx, ebx
xor eax, eax
cmp dword [0x4c793c], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c793c], eax
push str.fullrow_sel
jmp 0x43edf1
cmp di, 0x8026
jne 0x43ed91
xor ebx, ebx
xor eax, eax
cmp dword [0x4c7934], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4c7934], eax
push str.show_linie
jmp 0x43edf1
cmp di, 0x8029
jne 0x43edcf
xor ebx, ebx
xor eax, eax
cmp dword [0x4b8294], ebx
sete al
push eax
push ecx
mov ecx, esp
push str.adress_tree
mov dword [0x4b8294], eax
call fcn.0040a4e8
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.004351d3
mov eax, dword [0x4b8294]
mov dword [esi + 0xe4], eax
jmp 0x43edfe
cmp di, 0x802a
jne 0x43ee31
xor ebx, ebx
xor eax, eax
cmp dword [0x4b82ac], ebx
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x4b82ac], eax
push str.adress_autosel
call fcn.0040a4e8
mov ecx, dword [ebp - 4]
call fcn.004351d3
mov esi, dword [ebp - 4]
push ebx
lea ecx, [esi + 0x49c0]
call fcn.00474d39
push ebx
lea ecx, [esi + 0x506c]
call fcn.00474d39
push ebx
lea ecx, [esi + 0x5718]
call fcn.00474d39
push ebx
lea ecx, [esi + 0x5dc4]
call fcn.00474d39
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10