Function at 0x45bd14
Capabilities:
Check for time delay via gettickcount
Create directory
Delete directory
Get common file path
Get file system object information
Log keystrokes via polling
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x45bd1d
mov eax, dword [ebp - 4]
add esp, 0xfffff668
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
cmp ecx, 0x4e
jne 0x45c92b
mov ebx, esi
xor eax, eax
mov edx, dword [eax*4 + 0x498040]
cmp edx, dword [ebx + 8]
jne 0x45bd68
push 0
push 0
push 0x400
push dword [0x4ad5a8]
call sub.USER32.DLL_PostMessageA
jmp 0x45bd6e
inc eax
cmp eax, 7
jl 0x45bd46
mov ecx, dword [ebx + 8]
cmp ecx, 0xffffff94
jg 0x45bda4
je 0x45bfa6
sub ecx, 0xffffff65
je 0x45bdcb
sub ecx, 5
je 0x45c534
sub ecx, 0x24
je 0x45bf2d
sub ecx, 5
je 0x45bf9c
jmp 0x45c927
sub ecx, 0xffffff96
je 0x45c057
dec ecx
je 0x45bfb8
sub ecx, 0x66
je 0x45bf7d
sub ecx, 2
je 0x45c50c
jmp 0x45c927
mov ebx, esi
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x12
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov edi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
mov dword [ebp - 8], eax
cmp word [ebx + 0xc], 0x79
jne 0x45be1b
test esi, esi
jne 0x45be13
test edi, edi
je 0x45be1b
mov eax, dword [ebp - 4]
call fcn.0045d6e4
test esi, esi
jne 0x45c927
test edi, edi
jne 0x45c927
cmp dword [ebp - 8], 0
jne 0x45c927
movzx edx, word [ebx + 0xc]
cmp edx, 0x70
jg 0x45be5d
je 0x45bea1
sub edx, 9
je 0x45bf00
sub edx, 4
je 0x45be6f
sub edx, 0x13
je 0x45be94
sub edx, 0xd
je 0x45be94
jmp 0x45c927
sub edx, 0x71
je 0x45bebd
sub edx, 2
je 0x45beca
dec edx
je 0x45bed9
jmp 0x45c927
call fcn.0048e410
mov dword [0x49803c], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045c940
call fcn.0048e410
mov dword [0x49803c], eax
jmp 0x45c927
mov eax, dword [ebp - 4]
call fcn.0045d658
jmp 0x45c927
push 0
push 0x91
push 0x111
push dword [0x4ad5a8]
call sub.USER32.DLL_SendMessageA
jmp 0x45c927
mov eax, dword [ebp - 4]
call fcn.0045dd48
jmp 0x45c927
mov eax, 0x4adb04
call fcn.0046d294
jmp 0x45c927
cmp dword [0x4afc0c], 0
je 0x45bef1
mov eax, 0x4ad5bc
call fcn.0045b6f8
jmp 0x45c927
mov eax, 0x4ad5bc
call fcn.0045ac70
jmp 0x45c927
cmp dword [0x4ad5ac], 0
je 0x45c927
call sub.USER32.DLL_GetFocus
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jne 0x45c927
push dword [0x4ad5ac]
call sub.USER32.DLL_SetFocus
jmp 0x45c927
mov edx, 0x498196
mov eax, 0x498107
xor ecx, ecx
call fcn.00460c28
test eax, eax
je 0x45c927
mov eax, dword [ebp - 4]
call fcn.0045db88
test eax, eax
je 0x45c927
call fcn.0048e410
sub eax, dword [0x49803c]
cmp eax, 0x3e8
jle 0x45c927
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045c940
jmp 0x45c927
mov eax, dword [ebp - 4]
call fcn.0045db88
test eax, eax
je 0x45bf95
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045c940
xor eax, eax
jmp 0x45c936
call fcn.0045324c
jmp 0x45c927
mov eax, dword [esi + 0x10]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0045dffc
jmp 0x45c927
mov eax, 0x4adfd0
call fcn.00454f7c
cmp dword [0x4afc14], 0
jne 0x45bfea
cmp dword [0x4afc0c], 0
je 0x45bff4
cmp dword [0x4ae1d8], 0
jne 0x45bfe1
test al, 0x40
jne 0x45bff4
mov edx, dword [ebp - 4]
cmp byte [edx + 0x20], 0
jne 0x45bff4
mov eax, 1
jmp 0x45c936
mov edx, dword [ebp - 4]
cmp byte [edx + 0x20], 0
je 0x45c006
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x21], 0
jmp 0x45c050
mov eax, esi
mov eax, dword [eax + 0x10]
xor edx, edx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x20], 0x400
mov ebx, dword [ebp - 4]
add ebx, 0x21
mov dword [ebp - 0x24], ebx
push edx
push eax
push 0x102d
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
push 0x498104
push ebx
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c050
mov eax, 1
jmp 0x45c936
xor eax, eax
jmp 0x45c936
mov ebx, esi
xor esi, esi
xor edi, edi
mov byte [0x4bb388], 0
cmp dword [ebx + 0x20], 0
jne 0x45c0a1
mov eax, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x4c], 0x4bb388
mov dword [ebp - 0x48], 0x400
mov dword [ebp - 0x60], 1
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0x1005
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
jmp 0x45c0d1
push dword [ebx + 0x20]
push 0x4bb388
call fcn.00482a00
add esp, 8
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x4bb380]
jae 0x45c0d1
lea ecx, [ebp - 0xc90]
mov edx, eax
mov eax, 0x4bb27c
call fcn.0046036c
mov edi, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20], 0
je 0x45c246
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], 0
cmp dword [0x4afc0c], 0
je 0x45c1f8
lea edx, [ebp - 0x1490]
mov eax, str.Rar_MDXXXXXX
call fcn.004629ac
test al, al
je 0x45c4ee
lea ecx, [ebp - 0x1490]
push ecx
lea eax, [ebp - 0x1090]
push eax
call fcn.00482a00
add esp, 8
lea eax, [ebp - 0x1090]
call fcn.0040adfc
push 0x4bb388
lea edx, [ebp - 0x1090]
push edx
call fcn.00482924
add esp, 8
push 0
lea ecx, [ebp - 0x1090]
push ecx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45c1cf
call fcn.0044f680
mov edx, 0x4a84b8
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
lea edx, [ebp - 0x1090]
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
mov dword [0x4a76f0], 1
mov dword [0x4a76ec], 1
mov edx, 0x4a6e3c
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
mov eax, dword [0x4ae1d8]
mov dword [0x4a7c9c], eax
mov eax, 0x4adfd0
xor edx, edx
call fcn.00454c40
lea ecx, [ebp - 0x1090]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
lea eax, [ebp - 0x1490]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
jmp 0x45c4ee
lea edx, [ebp - 0x1090]
mov eax, 0x1f7
push edx
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
mov eax, 0x49e7d8
call fcn.004277c0
jmp 0x45c4ee
push 0
push 0x4bb388
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45c212
mov esi, 1
jmp 0x45c4ee
cmp byte [0x4bb388], 0
je 0x45c4ee
push 0x4bb388
mov eax, 0x1f7
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
mov eax, 0x49e7d8
call fcn.004277c0
jmp 0x45c4ee
cmp dword [ebx + 0x20], 0
je 0x45c4ee
cmp dword [0x4afc0c], 0
je 0x45c4af
mov edx, dword [ebp - 4]
add edx, 0x21
push edx
call fcn.00482a30
pop ecx
mov ebx, eax
test edi, 4
je 0x45c29b
cmp ebx, 4
jle 0x45c29b
push 0x498134
mov eax, dword [ebp - 4]
add eax, ebx
add eax, 0x1d
push eax
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c29b
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 0x1d], 0
test edi, 1
je 0x45c2ca
cmp ebx, 2
jle 0x45c2ca
push 0x49812c
mov ecx, dword [ebp - 4]
add ecx, ebx
add ecx, 0x1f
push ecx
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c2ca
mov eax, dword [ebp - 4]
mov byte [eax + ebx + 0x1f], 0
push 0x4bb388
call fcn.00482a30
pop ecx
mov ebx, eax
test edi, 4
je 0x45c304
cmp ebx, 4
jle 0x45c304
push 0x498134
mov eax, 0x4bb384
add eax, ebx
push eax
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c304
mov byte [ebx + 0x4bb384], 0
test edi, 1
je 0x45c331
cmp ebx, 2
jle 0x45c331
push 0x49812c
mov edx, 0x4bb386
add edx, ebx
push edx
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c331
mov byte [ebx + 0x4bb386], 0
mov edx, 0x4bb388
mov eax, dword [ebp - 4]
call fcn.0045ab8c
test eax, eax
je 0x45c380
mov edx, 0x4bb388
mov ebx, dword [ebp - 4]
add ebx, 0x21
mov eax, ebx
call fcn.0040d81c
test eax, eax
jne 0x45c36a
push 0x4bb388
push ebx
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45c380
mov eax, 0x50d
call fcn.00410804
push eax
call fcn.00447a48
pop ecx
jmp 0x45c4ee
call fcn.0044f218
mov ecx, 0x4a88b8
mov edx, 0x4a84b8
mov eax, 0x4adfd0
call fcn.0045900c
mov edx, dword [0x4ae1d8]
xor ecx, ecx
mov dword [0x4a7c9c], edx
mov byte [0x4a7c8a], 0
mov dword [0x4a7778], ecx
xor eax, eax
mov dword [0x4a779c], eax
lea edx, [ebp - 0x1890]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
lea eax, [ebp - 0x1890]
call fcn.0040adfc
mov edx, dword [ebp - 4]
add edx, 0x21
push edx
lea ecx, [ebp - 0x1890]
push ecx
call fcn.00482924
add esp, 8
lea edx, [ebp - 0x1890]
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
lea edx, [ebp - 0x1890]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
lea eax, [ebp - 0x1890]
call fcn.0040adfc
push 0x4bb388
lea edx, [ebp - 0x1890]
push edx
call fcn.00482924
add esp, 8
lea edx, [ebp - 0x1890]
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
mov byte [ebp - 9], 1
mov ebx, 0x4bb388
jmp 0x45c486
and eax, 0xff
push eax
push dword [0x49805c]
call fcn.00482b3d
add esp, 8
test eax, eax
je 0x45c468
mov byte [ebp - 9], 0
jmp 0x45c48c
mov edi, ebx
cmp byte [0x4a0724], 0
je 0x45c481
mov eax, 0x4a0624
mov edx, edi
call fcn.0040eedc
jmp 0x45c484
lea eax, [edi + 1]
mov ebx, eax
mov al, byte [ebx]
test al, al
jne 0x45c44a
cmp byte [ebp - 9], 0
je 0x45c4ee
lea eax, [ebp - 0x1890]
xor edx, edx
call fcn.0040ad6c
test al, al
jne 0x45c4ee
mov eax, 0x4adfd0
call fcn.00454fb0
jmp 0x45c4ee
push 0x4bb388
mov ebx, dword [ebp - 4]
add ebx, 0x21
push ebx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je 0x45c4cb
mov esi, 1
jmp 0x45c4ee
push 0x4bb388
push ebx
mov eax, 0x207
call fcn.00410804
push eax
call fcn.00447a48
add esp, 0xc
mov eax, 0x49e7d8
call fcn.004277c0
push 0x4bb388
push 0
push 0x402
push dword [0x4ad5a8]
call sub.USER32.DLL_PostMessageA
mov eax, esi
jmp 0x45c936
push 0x30
mov eax, 0x65
call fcn.00410804
push eax
mov eax, 0x1f4
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
jmp 0x45c927
mov eax, esi
lea ebx, [eax + 0xc]
test byte [ebx], 2
je 0x45c927
lea ecx, [ebp - 0x24c0]
mov edx, dword [ebx + 0x20]
mov eax, 0x4bb27c
call fcn.0046036c
cmp dword [0x498060], 0
jne 0x45c582
mov dword [0x498060], 0x4401
call fcn.0040e9e0
cmp eax, 5
jl 0x45c57b
cmp dword [0x4b057c], 1
jae 0x45c582
or dword [0x498060], 0x10
call fcn.0040e9e0
test eax, eax
je 0x45c6c2
cmp word [ebp - 0x20c0], 0
je 0x45c6c2
lea eax, [ebp - 0x2f74]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
cmp dword [0x498064], 0
jne 0x45c5dc
push str.shell32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45c5dc
push str.SHGetFileInfoW
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x498064], eax
cmp dword [0x498064], 0
je 0x45c687
push dword [0x498060]
lea edx, [ebp - 0x2774]
push 0x2b4
push edx
lea ecx, [ebp - 0x20c0]
push dword [ebp - 0x18b0]
push ecx
call dword [0x498064]
test eax, eax
je 0x45c687
lea edx, [ebp - 0x303c]
lea eax, [ebp - 0x2560]
mov ecx, 0x10000000
call fcn.0040ea34
cmp byte [ebp - 0x303c], 0
jne 0x45c645
lea ecx, [ebp - 0x303c]
lea edx, [ebp - 0x24c0]
mov eax, dword [ebp - 4]
call fcn.0045dd7c
mov eax, dword [0x4afc0c]
lea edx, [ebp - 0x303c]
add eax, 2
lea ecx, [ebp - 0x3064]
mov dword [ebp - 0x305c], eax
mov dword [ebp - 0x3050], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x2770]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x3864]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea edx, [ebp - 0x3864]
lea eax, [ebp - 0x2f74]
call fcn.0040eb14
test eax, eax
je 0x45c792
lea ecx, [ebp - 0x2f74]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
jmp 0x45c792
lea eax, [ebp - 0x3dc4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [0x498060]
lea edx, [ebp - 0x39c4]
push 0x160
push edx
lea ecx, [ebp - 0x24c0]
push dword [ebp - 0x18b0]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45c75a
cmp byte [ebp - 0x38b4], 0
jne 0x45c718
lea ecx, [ebp - 0x38b4]
lea edx, [ebp - 0x24c0]
mov eax, dword [ebp - 4]
call fcn.0045dd7c
mov eax, dword [0x4afc0c]
lea edx, [ebp - 0x38b4]
add eax, 2
lea ecx, [ebp - 0x3dec]
mov dword [ebp - 0x3de4], eax
mov dword [ebp - 0x3dd8], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x39c0]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x41ec]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x41ec]
push eax
lea edx, [ebp - 0x3dc4]
push edx
call fcn.004829b4
add esp, 8
test eax, eax
je 0x45c792
lea ecx, [ebp - 0x3dc4]
push ecx
call fcn.00484424
pop ecx
test byte [ebx + 1], 0x10
jne 0x45c927
lea ecx, [ebp - 0x42b4]
lea edx, [ebp - 0x24c0]
mov eax, dword [ebp - 4]
call fcn.0045dd7c
mov eax, dword [0x4afc0c]
lea edx, [ebp - 0x42b4]
add eax, 2
lea ecx, [ebp - 0x42dc]
mov dword [ebp - 0x42d4], eax
mov dword [ebp - 0x42c8], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x20c0]
lea eax, [ebp - 0x24c0]
call fcn.00409c88
mov esi, eax
cmp esi, 0xffffffff
je 0x45c927
lea eax, [ebp - 0x46dc]
mov edx, 0x400
call fcn.00462ca0
lea eax, [ebp - 0x46dc]
call fcn.0040adfc
push str._rar_icon_
lea edx, [ebp - 0x46dc]
push edx
call fcn.00482924
add esp, 8
mov eax, esi
call fcn.004099cc
test al, al
je 0x45c8ac
cmp dword [0x498068], 0xffffffff
jne 0x45c88f
push 0
lea edx, [ebp - 0x46dc]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45c883
push 0x4001
lea ecx, [ebp - 0x483c]
push 0x160
push ecx
lea eax, [ebp - 0x46dc]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45c883
mov edx, dword [ebp - 0x4838]
mov dword [0x498068], edx
lea ecx, [ebp - 0x46dc]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
cmp dword [0x498068], 0xffffffff
je 0x45c927
or dword [ebx], 0x1000
mov eax, dword [0x498068]
mov dword [ebx + 0x1c], eax
jmp 0x45c927
cmp dword [0x49806c], 0xffffffff
jne 0x45c910
push 0x4981df
lea edx, [ebp - 0x46dc]
push edx
call fcn.004849c0
add esp, 8
test eax, eax
je 0x45c903
push eax
call fcn.00484510
pop ecx
push 0x4001
lea ecx, [ebp - 0x499c]
push 0x160
push ecx
lea eax, [ebp - 0x46dc]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45c903
mov edx, dword [ebp - 0x4998]
mov dword [0x49806c], edx
lea ecx, [ebp - 0x46dc]
push ecx
call fcn.00485848
pop ecx
cmp dword [0x49806c], 0xffffffff
je 0x45c927
or dword [ebx], 0x1000
mov eax, dword [0x49806c]
mov dword [ebx + 0x1c], eax
xor eax, eax
jmp 0x45c936
push esi
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8