Function at 0x140045728
Capabilities:
Create directory
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2d58
call fcn.1400ba8b0
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2d40], rax
mov rbp, qword [rsp + 0x2dc0]
mov rsi, r9
mov eax, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x140046318
mov ecx, dword [rbp + 0x10]
xor esi, esi
mov rax, rsi
lea rdx, [0x1400df2c8]
mov r15d, 0x400
cmp dword [rax + rdx], ecx
je 0x140045798
add rax, 4
cmp rax, 0x1c
jb 0x14004577a
jmp 0x1400457ae
mov rcx, qword [0x1400ffd80]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rbp + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x1400461ee
je 0x1400461e7
cmp eax, 0xffffff4f
je 0x140045fb8
cmp eax, 0xffffff50
je 0x140045aa1
cmp eax, 0xffffff51
je 0x1400459ad
cmp eax, 0xffffff65
je 0x14004583e
cmp eax, 0xffffff8e
jne 0x140046251
lea rdx, str.SingleClick
lea rcx, str.FileList
xor r8d, r8d
call fcn.14005c420
cmp eax, esi
je 0x140046251
mov rcx, rbx
call fcn.14003fc4c
cmp eax, esi
je 0x140046251
call fcn.1400a95fc
sub eax, dword [0x140116b10]
cmp eax, 0x3e8
jle 0x140046251
jmp 0x140046244
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
mov r12w, ax
shr r12d, 0xf
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13w, ax
shr r13d, 0xf
and r13d, 1
cmp word [rbp + 0x18], 0x79
jne 0x140045898
cmp edi, esi
jne 0x140045890
cmp r12d, esi
je 0x1400458a9
mov rcx, rbx
call fcn.140041850
cmp edi, esi
jne 0x140046251
cmp r12d, esi
jne 0x140046251
cmp r13d, esi
jne 0x140046251
movzx ecx, word [rbp + 0x18]
sub ecx, 9
je 0x14004597f
sub ecx, 4
je 0x140045957
sub ecx, 0x13
je 0x14004594a
sub ecx, 0xd
je 0x14004594a
sub ecx, 0x43
je 0x14004592c
sub ecx, 1
je 0x14004591f
sub ecx, 2
je 0x14004590e
cmp ecx, 1
jne 0x140046251
lea rcx, [0x140105570]
cmp byte [0x1400fec05], sil
je 0x140045904
call fcn.14004475c
jmp 0x140046251
call fcn.140043cbc
jmp 0x140046251
lea rcx, [0x1400ffd88]
call fcn.140006df4
jmp 0x140046251
mov rcx, rbx
call fcn.14003fdf4
jmp 0x140046251
mov rcx, qword [0x1400ffd80]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140046251
mov rcx, rbx
call fcn.140041798
jmp 0x140046251
call fcn.1400a95fc
xor r8d, r8d
mov dl, 1
mov rcx, rbx
mov dword [0x140116b10], eax
call fcn.140045214
call fcn.1400a95fc
mov dword [0x140116b10], eax
jmp 0x140046251
cmp qword [0x1400ff4a8], rsi
je 0x140046251
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx]
jne 0x140046251
mov rcx, qword [0x1400ff4a8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140046251
lea rcx, [0x140105fb0]
call fcn.140010f84
cmp dword [0x1400ff4a4], esi
jne 0x140045a92
cmp byte [rbx + 0x82a], sil
jne 0x140045a92
cmp byte [0x1400fec05], sil
je 0x1400459e9
test al, 0x40
jne 0x1400459e9
cmp byte [rbx + 0x28], sil
je 0x140045a92
cmp byte [rbx + 0x28], sil
je 0x1400459f8
mov word [rbx + 0x2a], si
jmp 0x140046251
mov eax, dword [rbp + 0x1c]
mov rcx, qword [rbx]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, esi
je 0x140045a92
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0xb70]
lea rcx, [0x140116170]
call fcn.14003efb8
lea rcx, [rsp + 0xb70]
lea rsi, [rbx + 0x2a]
call fcn.140052abc
mov r8, r15
mov rcx, rsi
mov rdx, rax
call fcn.14006b580
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdi, [0x1400c39c0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
jne 0x140046251
movabs rax, 1
jmp 0x140046329
mov word [0x140116310], si
mov rdx, qword [rbp + 0x30]
mov word [rsp + 0x2540], si
cmp rdx, rsi
jne 0x140045aff
cmp byte [rbx + 0x28], sil
je 0x140046251
mov eax, dword [rbp + 0x1c]
mov rcx, qword [rbx]
lea r12, [0x140116310]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140045b5d
lea r12, [0x140116310]
mov r8, r15
mov rcx, r12
call fcn.14006b580
mov eax, dword [rbp + 0x40]
cmp rax, qword [0x1401162d8]
jae 0x140045b5d
mov r8, qword [rbp + 0x40]
lea rdx, [rsp + 0xb70]
lea rcx, [0x140116170]
call fcn.14003efb8
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0x2540]
mov r8, r15
call fcn.14006b580
lea rcx, [rsp + 0x2540]
call fcn.140052abc
mov word [rax], si
cmp word [0x140116310], si
je 0x140046251
cmp byte [rbx + 0x28], sil
je 0x140045d58
mov byte [rbx + 0x28], sil
cmp byte [0x1400fec05], sil
je 0x140045d29
lea rdx, [rsp + 0xb70]
lea rcx, str.Rar_MDXXXXXX
call fcn.140086c74
cmp al, sil
je 0x140045f98
mov rcx, rsi
movzx eax, word [rsp + rcx + 0xb70]
add rcx, 2
mov word [rsp + rcx + 0x153e], ax
cmp ax, si
jne 0x140045ba5
lea rcx, [rsp + 0x1540]
call fcn.14005254c
or r13, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1540]
mov rcx, r13
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045be1
lea rcx, [rsp + 0x1540]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x140045d0a
xor ecx, ecx
call fcn.140082924
lea r14, [0x140105fb0]
lea rdx, [0x14010e6bc]
mov rcx, r14
mov r8, r15
call fcn.1400129d4
mov rcx, qword [0x14010eec0]
lea rdx, [rsp + 0x1540]
call fcn.14006ba5c
lea rdi, [0x14010af48]
mov r8, r15
mov rcx, r14
mov rdx, rdi
mov dword [0x14010bc7c], 2
mov dword [0x14010bc78], 2
mov byte [0x14010bcc2], sil
call fcn.1400129b4
mov rdx, rsi
movzx eax, word [rdx + rdi]
add rdx, 2
mov word [rsp + rdx + 0x1d3e], ax
cmp ax, si
jne 0x140045c73
lea rcx, [rsp + 0x1d40]
call fcn.14005254c
xor eax, eax
lea rdi, [rsp + 0x1d40]
mov rcx, r13
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045ca7
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x1d40]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, si
jne 0x140045cbd
mov eax, dword [0x1401063c4]
xor edx, edx
mov rcx, r14
mov dword [0x14010c654], eax
call fcn.140016b48
lea rcx, [rsp + 0x1540]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140045f98
mov ecx, 0x1f7
call fcn.140061d2c
lea rdx, [rsp + 0x1540]
mov rcx, rax
call fcn.140095e68
jmp 0x140045f8c
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x140045f6c
cmp word [0x140116310], si
je 0x140045f98
mov ecx, 0x1f7
call fcn.140061d2c
mov rdx, r12
jmp 0x140045d1c
cmp byte [0x1400fec05], sil
je 0x140045f56
lea rdx, [rsp + 0xb70]
mov rcx, rbx
call fcn.140040690
cmp al, sil
je 0x140045d8e
lea rcx, [rbx + 0x2a]
lea rdx, [rsp + 0xb70]
mov r8, r15
call fcn.14006b580
xor ecx, ecx
call fcn.140082924
lea r14, [0x140105fb0]
lea rdx, [0x14010e6bc]
mov rcx, r14
mov r8, r15
call fcn.1400129d4
mov edx, dword [0x1401063c4]
lea rcx, str.FileList
mov dword [0x14010c654], edx
lea rdx, str.FlatView
xor r8d, r8d
call fcn.14005c420
cmp eax, esi
je 0x140045df2
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x2540]
add rcx, 2
mov word [rsp + rcx + 0x1d3e], ax
cmp ax, si
jne 0x140045dd7
jmp 0x140045e12
lea rdx, [rsp + 0x1d40]
mov r8, r15
mov rcx, r14
call fcn.1400129b4
lea rcx, [rsp + 0x1d40]
call fcn.14005254c
mov rcx, qword [0x14010eec0]
lea rbp, [rbx + 0x2a]
mov rdx, rbp
call fcn.14006ba5c
mov rdx, rsi
movzx eax, word [rsp + rdx + 0x1d40]
add rdx, 2
mov word [rsp + rdx + 0x153e], ax
cmp ax, si
jne 0x140045e28
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1540]
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045e54
mov rcx, qword [0x14010eee0]
call fcn.14006b784
mov rcx, qword [0x14010eee0]
lea rdx, [rsp + 0x1540]
call fcn.14006ba5c
lea r8, [rsp + 0x1540]
lea rcx, [0x140116170]
xor r9d, r9d
xor edx, edx
mov byte [rsp + 0x20], sil
call fcn.14003f0c0
cmp al, sil
je 0x140045f08
lea rdx, [rsp + 0x1540]
mov rcx, rbp
call fcn.140073da4
cmp eax, esi
jne 0x140045ee1
lea rdx, [rsp + 0x1540]
sub rdx, rbp
movzx eax, word [rbp]
movzx ecx, word [rdx + rbp]
sub eax, ecx
jne 0x140045edd
add rbp, 2
test ecx, ecx
jne 0x140045ec9
cmp eax, esi
jne 0x140045f08
lea rdx, [rsp + 0x1540]
mov rcx, rbx
call fcn.140042d6c
mov ecx, 0x50d
call fcn.140061d2c
mov rcx, rax
call fcn.140095e68
jmp 0x140045f98
mov rdi, r12
cmp word [0x140116310], si
je 0x140045f31
movzx edx, word [rdi]
mov rcx, qword [str.py_f_]
call fcn.1400a95dc
cmp rax, rsi
jne 0x140045f3b
add rdi, 2
cmp word [rdi], si
jne 0x140045f14
xor edx, edx
mov rcx, r14
call fcn.1400135c8
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x1540]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, si
jne 0x140045f3e
jmp 0x140045f98
lea rdx, [rbx + 0x2a]
mov r9, r12
xor r8d, r8d
xor ecx, ecx
call fcn.1400312d8
cmp al, sil
je 0x140045f73
mov esi, 1
jmp 0x140045f98
mov ecx, 0x207
call fcn.140061d2c
lea rdx, [rbx + 0x2a]
mov r8, r12
mov rcx, rax
call fcn.140095e68
lea rcx, [0x1400ec668]
call fcn.1400286c0
mov rcx, qword [0x1400ffd80]
mov r9, r12
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rax, esi
jmp 0x140046329
test byte [rbp + 0x18], 2
je 0x140046251
mov rdx, qword [rbp + 0x40]
cmp rdx, qword [0x1401162d8]
jae 0x140046251
lea rcx, [0x140116170]
call fcn.14003f194
mov r14d, 0x4401
mov r12, rax
mov qword [rsp + 0x30], rax
call fcn.14003ec88
cmp eax, 0x501
jb 0x140046002
cmp byte [0x1400fec05], sil
je 0x140046008
mov r14d, 0x4411
lea rcx, [rsp + 0x2540]
mov edx, r15d
call fcn.140087408
mov r12, qword [r12]
or r13, 0xffffffffffffffff
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
mov r15d, 0x101
not rcx
cmp byte [0x1400fec05], sil
je 0x140046047
dec rcx
cmp rcx, r15
ja 0x140046067
jmp 0x1400460a7
lea rdx, [rcx - 1]
lea rdi, [rsp + 0x2540]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, r15
jbe 0x1400460b6
mov rcx, r12
or r14d, 0x10
call fcn.140052e80
mov r12, rax
cmp rax, rsi
je 0x140046091
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, r15
jbe 0x140046098
lea r12, str.dummy
cmp byte [0x1400fec05], sil
je 0x1400460b6
jmp 0x1400460a7
add r12, 2
movzx ecx, word [r12]
call fcn.140052530
cmp al, sil
jne 0x1400460a3
mov rdi, qword [rsp + 0x30]
mov r13d, 0x2b8
lea r8, [rsp + 0x8b0]
mov edx, dword [rdi + 0x20]
mov r9d, r13d
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rsi
setne al
cmp al, sil
jne 0x14004611d
test r14b, 0x10
jne 0x140046197
mov edx, dword [rdi + 0x20]
lea r8, [rsp + 0x8b0]
or r14d, 0x10
mov r9d, r13d
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rsi
setne al
cmp al, sil
je 0x140046197
mov r12d, 0xc8
lea rdx, [rsp + 0xac8]
lea rcx, [rsp + 0x13b0]
mov r8, r12
call fcn.14006b580
cmp word [rsp + 0x13b0], si
jne 0x14004615b
mov rdx, qword [rdi]
lea r8, [rsp + 0x13b0]
mov r9, r12
mov rcx, rbx
call fcn.14003fe48
movzx eax, byte [0x1400fec05]
movsxd r8, dword [rbp + 0x1c]
mov rcx, qword [rbx]
add eax, 2
lea r9, [rsp + 0x38]
mov edx, 0x1074
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x13b0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x8b8]
mov dword [rbp + 0x3c], edx
bts dword [rbp + 0x18], 0xc
lea rcx, [rsp + 0xb70]
mov edx, 0x400
call fcn.140087408
lea rdx, [rsp + 0x2540]
lea rdi, [rsp + 0xb70]
sub rdi, rdx
movzx eax, word [rdx]
movzx ecx, word [rdx + rdi]
sub eax, ecx
jne 0x1400461d4
add rdx, 2
test ecx, ecx
jne 0x1400461c1
cmp eax, esi
je 0x140046251
lea rcx, [rsp + 0x2540]
call fcn.1400873f0
jmp 0x140046251
call fcn.140023334
jmp 0x140046251
cmp eax, 0xffffff94
je 0x140046308
cmp eax, 0xfffffff4
je 0x140046258
cmp eax, 0xfffffffd
je 0x140046238
cmp eax, 0xffffffff
jne 0x140046251
mov ecx, 0x65
call fcn.140061d2c
mov ecx, 0x1f4
mov rdi, rax
call fcn.140061d2c
mov rcx, qword [0x1400ffd80]
mov r9d, 0x30
mov r8, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140046251
mov rcx, rbx
call fcn.14003fc4c
cmp eax, esi
je 0x140046251
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140045214
xor eax, eax
jmp 0x140046329
mov eax, dword [rbp + 0x18]
sub eax, 1
je 0x1400462f8
cmp eax, 0x10000
jne 0x140046251
or r13, 0xffffffffffffffff
cmp dword [0x1400df2b8], r13d
jne 0x1400462b6
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xff0000
call fcn.14005c420
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xd9213
mov dword [0x1400df2b8], eax
call fcn.14005c420
mov dword [0x14011630c], eax
mov r8, qword [rbp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [0x140116170]
call fcn.14003efb8
mov ecx, dword [rax + 0x810]
bt ecx, 0xb
jae 0x1400462e0
mov eax, dword [0x1400df2b8]
mov dword [rbp + 0x50], eax
bt ecx, 0xe
jae 0x140046251
mov eax, dword [0x14011630c]
mov dword [rbp + 0x50], eax
jmp 0x140046251
mov al, byte [0x140105fa4]
neg al
sbb rax, rax
and eax, 0x20
jmp 0x140046329
mov edx, dword [rbp + 0x1c]
mov rcx, rbx
call fcn.140044d24
jmp 0x140046251
mov r9, rbp
mov r8, rsi
mov edx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x2d40]
xor rcx, rsp
call fcn.1400a8530
add rsp, 0x2d58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret