Function at 0x4776c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68c
mov eax, dword [esp + 0x69c]
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x1e
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
mov si, word [esp + 0x6a0]
mov dword [eax], 1
cmp si, 0x8504
je 0x477b02
cmp si, 0x8019
jb 0x477de5
cmp si, 0x802c
ja 0x477de5
cmp si, 0x801b
ja 0x4779f2
lea ecx, [esp + 0x10]
push 0x42023
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSettings]
cmp si, 0x8019
jne 0x4778aa
mov esi, dword [sym.imp.SHELL32.dll_SHGetSetSettings]
xor eax, eax
mov ecx, 7
lea edi, [esp + 0x40]
push eax
lea edx, [esp + 0x40]
mov dword [esp + 0x40], 0
push 0x40021
rep stosd dword es:[edi], eax
push edx
call esi
mov edx, dword [esp + 0x3c]
push 1
mov eax, edx
and edx, 0xfffffff7
not eax
and eax, 1
push 0x40021
mov ecx, eax
and ecx, 1
shl ecx, 3
or ecx, edx
mov edx, eax
xor edx, ecx
and edx, 1
xor edx, ecx
xor ecx, ecx
and dh, 0x7f
test eax, eax
sete cl
and ecx, 1
shl ecx, 0xf
or edx, ecx
mov dword [esp + 0x44], edx
lea edx, [esp + 0x44]
push edx
call esi
test byte [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
je 0x4777b3
and al, 0xf6
jmp 0x4777b5
or al, 9
mov dword [esp + 0x1c], eax
push 1
lea eax, [esp + 0x20]
push 0x21
push eax
call esi
mov ecx, ebp
call fcn.004783c0
test eax, eax
je 0x4777d6
mov ecx, eax
call fcn.004ee6f0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x5c], 0
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x60]
push 0x40021
push ecx
call esi
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x3c]
xor edx, ecx
test dh, 0x80
jne 0x4779be
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
lea edx, [esp + 0x94]
push 0
push edx
push SHChangeNotifyDeregister
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x477862
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47785a
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
push str.ShowSuperHidden
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.00460f70
push str.SuperHidden
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00460f70
add esp, 0x18
mov ecx, ebp
call fcn.004783c0
test eax, eax
je 0x477899
mov ecx, eax
call fcn.004ee6f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4779be
jmp 0x4779bb
cmp si, 0x801a
jne 0x4778e0
mov cl, byte [esp + 0x10]
mov eax, 2
test al, cl
mov ecx, dword [esp + 0x1c]
je 0x4778c7
and ecx, 0xfffffffd
jmp 0x4778c9
or ecx, eax
push 1
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
jmp 0x4779be
cmp si, 0x801b
jne 0x4779be
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], 0
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x20]
push 0x40021
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSetSettings]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
lea ecx, [esp + 0x94]
push 0
push ecx
push SHChangeNotifyDeregister
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x477968
mov eax, dword [esp + 0xc]
test eax, eax
je 0x477960
push eax
call esi
mov edx, dword [esp + 0x14]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x1c]
push str.ShowSuperHidden
not eax
shr eax, 0xf
and eax, 1
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00460f70
mov edx, dword [esp + 0x28]
push str.SuperHidden
shr edx, 0xf
and edx, 1
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00460f70
add esp, 0x18
mov ecx, ebp
call fcn.004783c0
test eax, eax
je 0x4779b3
mov ecx, eax
call fcn.004ee6f0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4779be
push eax
call esi
mov ecx, ebp
call fcn.004783c0
test eax, eax
je 0x477de5
mov ecx, eax
call fcn.004e4870
mov ecx, dword [esp + 0x6a8]
mov eax, 1
mov dword [ecx], 1
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x802b
jne 0x477a2e
mov esi, dword [0x54e8b0]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.merke_ansicht
mov dword [0x54e8b0], eax
call fcn.00412740
mov ecx, ebp
call fcn.004665c0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x802c
jne 0x477a6a
mov esi, dword [0x54e8ac]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.merke_markierte
mov dword [0x54e8ac], eax
call fcn.00412740
mov ecx, ebp
call fcn.004665c0
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x801e
jne 0x477a9f
mov edx, dword [ebp + 4]
push 5
push 0
push str.folders
push 0x54b6c8
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x801f
je 0x477db1
cmp si, 0x8020
jne 0x477af7
push 1
push 0
push ecx
mov ecx, esp
push str.Folder
call fcn.00405730
call fcn.0046ff90
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
push 1
push ecx
push ecx
mov ecx, esp
push str.Folder
call fcn.00405730
call fcn.0046ff90
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x8024
jne 0x477ca4
push 0
push 0
lea edx, [esp + 0x18]
push 0x3a
push edx
call fcn.004bc8d0
add esp, 8
mov ecx, eax
call fcn.0046fbf0
push ecx
mov ecx, esp
push eax
call fcn.004124c0
lea ecx, [esp + 0x100]
call fcn.004be680
mov eax, dword [esp + 0x10]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x477b60
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x477b60
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
cmp si, 0x8504
jne 0x477b8f
mov eax, dword [esp + 0xf8]
test eax, eax
jne 0x477b7f
mov dword [esp + 0x130], 1
jmp 0x477b8f
push 0
push 1
push 0x465
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_GetParent]
push ebp
call esi
test eax, eax
je 0x477ba8
push eax
mov ebp, eax
call esi
test eax, eax
jne 0x477b9f
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
and ch, 0xfb
test eax, eax
mov dword [esp + 0x118], ecx
jne 0x477bcb
mov dword [esp + 0x11c], ebp
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x14c]
lea edx, [esp + 0xf4]
mov dword [esp + 0x134], eax
mov dword [esp + 0x12c], ecx
mov dword [esp + 0xfc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x55e32c
mov dword [esp + 0x104], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x55e360]
lea ecx, [esp + 0xfc]
push 0x55e32c
mov dword [esp + 0x108], eax
mov dword [0x55e360], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
mov eax, dword [esp + 0x148]
mov dword [esp + 0x12c], 0
test eax, eax
mov dword [esp + 0x134], 0
je 0x477c74
push eax
call fcn.00531ee2
add esp, 4
mov dword [esp + 0x148], 0
lea ecx, [esp + 0xf4]
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0
call fcn.004beb90
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x68c
ret 0x10
cmp si, 0x8022
jne 0x477ccb
mov esi, dword [0x55e198]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55e198], eax
push 0x54afc0
jmp 0x477da5
cmp si, 0x8021
je 0x477de5
cmp si, 0x8023
jne 0x477cfd
mov esi, dword [0x54e8bc]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x54e8bc], eax
push str.spalten_speichern
jmp 0x477da5
cmp si, 0x8025
jne 0x477d24
mov esi, dword [0x55e1ac]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55e1ac], eax
push str.fullrow_sel
jmp 0x477da5
cmp si, 0x8026
jne 0x477d48
mov esi, dword [0x55e1a4]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x55e1a4], eax
push str.show_linie
jmp 0x477da5
cmp si, 0x8029
jne 0x477d83
mov esi, dword [0x54e890]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
push str.adress_tree
mov dword [0x54e890], eax
call fcn.00412740
mov ecx, ebp
call fcn.004665c0
mov eax, dword [0x54e890]
mov dword [ebp + 0xf0], eax
jmp 0x477db1
cmp si, 0x802a
jne 0x477de5
mov esi, dword [0x54e8a8]
xor eax, eax
test esi, esi
sete al
push eax
push ecx
mov ecx, esp
mov dword [0x54e8a8], eax
push str.adress_autosel
call fcn.00412740
mov ecx, ebp
call fcn.004665c0
push 0
lea ecx, [ebp + 0x49c4]
call fcn.004e84b0
push 0
lea ecx, [ebp + 0x507c]
call fcn.004e84b0
push 0
lea ecx, [ebp + 0x5734]
call fcn.004e84b0
push 0
lea ecx, [ebp + 0x5dec]
call fcn.004e84b0
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x68c
ret 0x10