Function at 0x445270
Capabilities:
Create directory
Delete directory
Log keystrokes via polling

Disassembly:
mov eax, 0x2cdc
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2cd8], eax
mov eax, dword [esp + 0x2ce0]
push ebx
mov ebx, dword [esp + 0x2cf0]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2cec]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
cmp ecx, 0x4e
jne 0x445e57
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x4cb0fc], ecx
je 0x4452d2
add eax, 4
cmp eax, 0x1c
jb 0x4452c0
jmp 0x4452e5
mov eax, dword [0x4eacd4]
push esi
push esi
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push edi
cmp eax, 0xb0
ja case.0x445300.174
movzx ecx, byte [eax + 0x445e9c]
jmp dword [ecx*4 + 0x445e70]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebp
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [ebx + 0xc], 0x79
jne 0x44534c
test esi, esi
jne 0x445343
test edi, edi
je 0x44535c
mov ecx, dword [esp + 0x10]
call fcn.00441800
test esi, esi
jne case.0x445300.174
test edi, edi
jne case.0x445300.174
test ebp, ebp
jne case.0x445300.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x445300.174
movzx edx, byte [eax + 0x445f70]
jmp dword [edx*4 + 0x445f50]
call fcn.004a5ee5
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x5013b0], eax
call fcn.00444e00
call fcn.004a5ee5
mov dword [0x5013b0], eax
jmp case.0x445300.174
mov ecx, dword [esp + 0x10]
call fcn.00441770
jmp case.0x445300.174
mov eax, dword [0x4eacd4]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x445300.174
mov ecx, dword [esp + 0x10]
call fcn.0043ff90
jmp case.0x445300.174
mov ecx, 0x4f0498
call fcn.00406e10
jmp case.0x445300.174
cmp byte [0x4e9b89], 0
mov ecx, 0x4f04a8
je 0x445402
call fcn.004443b0
jmp case.0x445300.174
call fcn.00443990
jmp case.0x445300.174
cmp dword [0x4ea41c], 0
je case.0x445300.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x445300.174
mov edx, dword [0x4ea41c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x445300.174
push esi
push str.SingleClick
push str.FileList
call fcn.0045ba60
test eax, eax
je case.0x445300.174
mov ecx, ebp
call fcn.0043fe00
test eax, eax
je case.0x445300.174
call fcn.004a5ee5
sub eax, dword [0x5013b0]
cmp eax, 0x3e8
jle case.0x445300.174
push esi
push 1
mov ecx, ebp
call fcn.00444e00
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x2ce0]
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4bb3
add esp, 0x2cdc
ret 0x10
mov ecx, ebp
call fcn.0043fe00
test eax, eax
je case.0x445300.174
jmp 0x445460
call fcn.00423cb0
jmp case.0x445300.174
mov eax, dword [ebx + 0x10]
push eax
mov ecx, ebp
call fcn.004449b0
jmp case.0x445300.174
mov ecx, 0x4f0dd0
call fcn.00411650
mov dword [esp + 0x18], edx
cmp dword [0x4ea434], esi
jne 0x4455b3
cmp byte [ebp + 0x81a], 0
jne 0x4455b3
cmp byte [0x4e9b89], 0
je 0x4454ea
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x4454ea
cmp byte [ebp + 0x18], cl
je 0x4455b3
cmp byte [ebp + 0x18], 0
je 0x4454fb
xor ecx, ecx
mov word [ebp + 0x1a], cx
jmp case.0x445300.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
call edi
test eax, eax
je 0x4455b3
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0xb2c]
push eax
mov ecx, 0x500ad8
call fcn.0043f1b0
push 0x400
lea ecx, [esp + 0xb2c]
push ecx
lea esi, [ebp + 0x1a]
call fcn.00451bd0
push eax
push esi
call fcn.0046ac00
mov edx, dword [ebp]
push 0
push 0
push 0x1018
push edx
call edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4babbc
lea esp, [esp]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4455a6
test cx, cx
je 0x4455a2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4455a6
add esi, 4
add eax, 4
test cx, cx
jne 0x445580
xor eax, eax
jmp 0x4455ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x445300.174
mov eax, 1
jmp 0x44546c
xor eax, eax
mov word [0x500bb0], ax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], esi
mov word [esp + 0x1ce8], cx
lea edi, [ecx + 1]
cmp eax, esi
jne 0x44561c
cmp byte [ebp + 0x18], cl
je case.0x445300.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], 0x500bb0
mov dword [esp + 0x44], 0x400
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x445676
push 0x400
push eax
push 0x500bb0
call fcn.0046ac00
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x500b8c]
jae 0x445676
push eax
lea edx, [esp + 0xb2c]
push edx
mov ecx, 0x500ad8
call fcn.0043f1b0
push 0x400
lea eax, [esp + 0xb2c]
push eax
lea ecx, [esp + 0x1cf0]
push ecx
call fcn.0046ac00
lea edx, [esp + 0x1ce8]
push edx
call fcn.00451bd0
xor ecx, ecx
mov word [eax], cx
cmp word [0x500bb0], si
je case.0x445300.174
cmp byte [ebp + 0x18], 0
je 0x445895
mov byte [ebp + 0x18], 0
cmp byte [0x4e9b89], 0
je 0x44586d
lea edx, [esp + 0xb28]
push edx
push str.Rar_MDXXXXXX
call fcn.004856a0
test al, al
je 0x445b08
xor eax, eax
mov ebx, 2
nop
movzx ecx, word [esp + eax + 0xb28]
mov word [esp + eax + 0x14e8], cx
add eax, ebx
test cx, cx
jne 0x4456c0
lea eax, [esp + 0x14e8]
push eax
call fcn.00451670
mov eax, 0x500bb0
mov edx, eax
jmp 0x4456f0
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x4456f0
lea edi, [esp + 0x14e8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x445706
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x14ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44584d
push 0
call fcn.00481a10
push 0x400
push 0x4f907c
mov ecx, 0x4f0dd0
call fcn.004130a0
mov ecx, dword [0x4f987c]
lea edx, [esp + 0x14e8]
push edx
call fcn.0046b250
push 0x400
push 0x4f58e8
mov ecx, 0x4f0dd0
mov dword [0x4f661c], ebx
mov dword [0x4f6618], ebx
mov byte [0x4f6656], 0
call fcn.00413080
xor eax, eax
movzx ecx, word [eax + 0x4f58e8]
mov word [esp + eax + 0x24e8], cx
add eax, ebx
test cx, cx
jne 0x445790
lea eax, [esp + 0x24e8]
push eax
call fcn.00451670
mov eax, 0x500bb0
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x4457c0
lea edi, [esp + 0x24e8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x4457d6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x445800
movzx ecx, word [esp + eax + 0x24e8]
mov word [eax + 0x500bb0], cx
add eax, ebx
test cx, cx
jne 0x445800
mov ecx, dword [0x4f0fdc]
mov dword [0x4f701c], ecx
push 0
mov ecx, 0x4f0dd0
call fcn.00417250
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x14e8]
push edx
call esi
lea eax, [esp + 0xb28]
push eax
call esi
jmp 0x445b08
lea ecx, [esp + 0x14e8]
push ecx
push 0x1f7
call fcn.004612e0
push eax
call fcn.00493500
add esp, 8
jmp 0x445afe
push esi
push 0x500bb0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x445adf
cmp word [0x500bb0], si
je 0x445b08
push 0x500bb0
jmp 0x445855
cmp byte [0x4e9b89], 0
je 0x445ac9
lea edx, [esp + 0xb28]
push edx
mov ecx, ebp
call fcn.00440780
test al, al
je 0x4458cb
push 0x400
lea eax, [esp + 0xb2c]
push eax
lea ecx, [ebp + 0x1a]
push ecx
call fcn.0046ac00
push esi
call fcn.00481a10
push 0x400
push 0x4f907c
mov ecx, 0x4f0dd0
call fcn.004130a0
mov edx, dword [0x4f0fdc]
push esi
push 0x4bb9d4
push str.FileList
mov dword [0x4f701c], edx
call fcn.0045ba60
test eax, eax
je 0x44592a
xor eax, eax
jmp 0x445910
movzx ecx, word [esp + eax + 0x1ce8]
mov word [esp + eax + 0x24e8], cx
add eax, 2
cmp cx, si
jne 0x445910
jmp 0x44594e
push 0x400
lea eax, [esp + 0x24ec]
push eax
mov ecx, 0x4f0dd0
call fcn.00413080
lea ecx, [esp + 0x24e8]
push ecx
call fcn.00451670
mov ecx, dword [0x4f987c]
lea ebx, [ebp + 0x1a]
push ebx
call fcn.0046b250
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x24e8]
mov word [esp + eax + 0x14e8], cx
add eax, 2
cmp cx, si
jne 0x445960
mov eax, 0x500bb0
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x445980
lea edi, [esp + 0x14e8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4459a0
mov cx, word [edi + 2]
add edi, 2
cmp cx, si
jne 0x4459a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4f988c]
call fcn.0046ae50
mov ecx, dword [0x4f988c]
lea edx, [esp + 0x14e8]
push edx
call fcn.0046b250
push 0
push 0
lea eax, [esp + 0x14f0]
push eax
push 0
mov ecx, 0x500ad8
call fcn.0043f2b0
test al, al
je 0x445a67
lea ecx, [esp + 0x14e8]
push ecx
push ebx
call fcn.00473580
test eax, eax
jne 0x445a40
lea ecx, [esp + 0x14e8]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x445a37
test dx, dx
je 0x445a33
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x445a37
add eax, 4
add ecx, 4
test dx, dx
jne 0x445a11
xor eax, eax
jmp 0x445a3c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x445a67
lea edx, [esp + 0x14e8]
push edx
mov ecx, ebp
call fcn.00442b20
push 0x50d
call fcn.004612e0
push eax
call fcn.00493500
add esp, 4
jmp 0x445b08
cmp word [0x500bb0], 0
mov esi, 0x500bb0
je 0x445a94
movzx eax, word [esi]
push eax
mov eax, dword [str._____:]
push eax
call fcn.004a5b50
add esp, 8
test eax, eax
jne 0x445aa0
add esi, 2
cmp word [esi], ax
jne 0x445a76
push 0
mov ecx, 0x4f0dd0
call fcn.00413d00
xor eax, eax
jmp 0x445ab0
movzx ecx, word [esp + eax + 0x14e8]
mov word [eax + 0x500bb0], cx
add eax, 2
test cx, cx
jne 0x445ab0
jmp 0x445b08
push 0x500bb0
push 0
lea esi, [ebp + 0x1a]
push esi
push 0
call fcn.00431930
test al, al
je 0x445ae5
mov dword [esp + 0x10], edi
jmp 0x445b08
push 0x500bb0
push esi
push 0x207
call fcn.004612e0
push eax
call fcn.00493500
add esp, 0xc
mov ecx, 0x4d76b4
call fcn.00428fc0
mov ecx, dword [0x4eacd4]
push 0x500bb0
push 0
push 0x402
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x44546c
push 0x30
push 0x65
call fcn.004612e0
push eax
push 0x1f4
call fcn.004612e0
mov edx, dword [0x4eacd4]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x445300.174
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x445be4
sub eax, 0x10000
jne case.0x445300.174
cmp dword [0x4cb0f4], 0xffffffff
jne 0x445ba3
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.0045ba60
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4cb0f4], eax
call fcn.0045ba60
mov dword [0x500bac], eax
mov eax, dword [ebx + 0x2c]
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, 0x500ad8
call fcn.0043f1b0
mov eax, dword [eax + 0x810]
test eax, 0x800
je 0x445bcc
mov edx, dword [0x4cb0f4]
mov dword [ebx + 0x30], edx
test eax, 0x4000
je case.0x445300.174
mov eax, dword [0x500bac]
mov dword [ebx + 0x30], eax
jmp case.0x445300.174
movzx eax, byte [0x4f0dc8]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x44546c
test byte [ebx + 0xc], 2
je case.0x445300.174
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x500b8c]
jae case.0x445300.174
push eax
mov ecx, 0x500ad8
call fcn.0043f380
mov ebp, eax
mov ebx, 0x4401
call fcn.0043ee10
cmp eax, 0x501
jb 0x445c37
cmp byte [0x4e9b89], 0
je 0x445c3c
mov ebx, 0x4411
push 0x400
lea ecx, [esp + 0x1cec]
push ecx
call fcn.00485da0
cmp byte [0x4e9b89], 0
mov esi, dword [ebp]
je 0x445c7b
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445c60
sub eax, edx
sar eax, 1
cmp eax, 0x101
ja 0x445cb8
jmp 0x445cf4
lea eax, [esp + 0x1ce8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445c85
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, esi
lea edi, [eax + 2]
jmp 0x445ca0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445ca0
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, 0x101
jbe 0x445d12
push esi
or ebx, 0x10
call fcn.00451f60
mov esi, eax
test esi, esi
je 0x445ce6
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445cd0
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x445ceb
mov esi, str.dummy
cmp byte [0x4e9b89], 0
je 0x445d12
movzx edx, word [esi]
push edx
call fcn.00451640
test al, al
je 0x445d12
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.00451640
test al, al
jne 0x445d01
mov edx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 0x2b4
lea ecx, [esp + 0x87c]
push ecx
push edx
push esi
call edi
test eax, eax
setne al
test al, al
jne 0x445d64
test bl, 0x10
jne 0x445de7
mov ecx, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea eax, [esp + 0x87c]
push eax
push ecx
push esi
call edi
test eax, eax
setne al
test al, al
je 0x445de7
push 0xc8
lea edx, [esp + 0xa8c]
push edx
lea eax, [esp + 0x1360]
push eax
call fcn.0046ac00
cmp word [esp + 0x1358], 0
jne 0x445da3
mov edx, dword [ebp]
push 0xc8
lea ecx, [esp + 0x135c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.0043ffd0
movzx eax, byte [0x4e9b89]
mov esi, dword [esp + 0x14]
add eax, 2
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x135c]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
push 0x1074
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x878]
mov dword [esi + 0x28], eax
jmp 0x445deb
mov esi, dword [esp + 0x14]
or dword [esi + 0xc], 0x1000
push 0x400
lea ecx, [esp + 0xb2c]
push ecx
call fcn.00485da0
lea ecx, [esp + 0xb28]
lea eax, [esp + 0x1ce8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x445e38
test dx, dx
je 0x445e34
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x445e38
add eax, 4
add ecx, 4
test dx, dx
jne 0x445e12
xor eax, eax
jmp 0x445e3d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.0x445300.174
lea edx, [esp + 0x1ce8]
push edx
call fcn.00485d80
jmp case.0x445300.174
mov edx, dword [esp + 0x2cf0]
push ebx
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x44546e