Function at 0x45d160
Capabilities:
Check for time delay via gettickcount
Create directory
Delete directory
Get common file path
Get file system object information
Log keystrokes via polling
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x45d169
mov eax, dword [ebp - 4]
add esp, 0xfffff60c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
cmp ecx, 0x4e
jne 0x45de7a
mov ebx, esi
xor eax, eax
mov edx, dword [eax*4 + 0x4b21a4]
cmp edx, dword [ebx + 8]
jne 0x45d1b4
push 0
push 0
push 0x400
push dword [0x4cfe34]
call sub.USER32.DLL_PostMessageA
jmp 0x45d1ba
inc eax
cmp eax, 7
jl 0x45d192
mov ecx, dword [ebx + 8]
cmp ecx, 0xffffff96
jg 0x45d1fe
je 0x45d4b0
cmp ecx, 0xffffff8e
jg 0x45d1e9
je 0x45d389
sub ecx, 0xffffff65
je 0x45d227
sub ecx, 5
je 0x45da9b
jmp 0x45de76
sub ecx, 0xffffff93
je 0x45d3f8
dec ecx
je 0x45d402
jmp 0x45de76
sub ecx, 0xffffff97
je 0x45d414
sub ecx, 0x5d
je 0x45d9eb
sub ecx, 9
je 0x45d3d9
sub ecx, 2
je 0x45d9c3
jmp 0x45de76
mov ebx, esi
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x12
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov edi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
mov dword [ebp - 8], eax
cmp word [ebx + 0xc], 0x79
jne 0x45d277
test esi, esi
jne 0x45d26f
test edi, edi
je 0x45d277
mov eax, dword [ebp - 4]
call fcn.0045f2a4
test esi, esi
jne 0x45de76
test edi, edi
jne 0x45de76
cmp dword [ebp - 8], 0
jne 0x45de76
movzx edx, word [ebx + 0xc]
cmp edx, 0x70
jg 0x45d2b9
je 0x45d2fd
sub edx, 9
je 0x45d35c
sub edx, 4
je 0x45d2cb
sub edx, 0x13
je 0x45d2f0
sub edx, 0xd
je 0x45d2f0
jmp 0x45de76
sub edx, 0x71
je 0x45d319
sub edx, 2
je 0x45d326
dec edx
je 0x45d335
jmp 0x45de76
call fcn.004a82c8
mov dword [0x4b21a0], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045de90
call fcn.004a82c8
mov dword [0x4b21a0], eax
jmp 0x45de76
mov eax, dword [ebp - 4]
call fcn.0045f21c
jmp 0x45de76
push 0
push 0xb4
push 0x111
push dword [0x4cfe34]
call sub.USER32.DLL_SendMessageA
jmp 0x45de76
mov eax, dword [ebp - 4]
call fcn.0045f908
jmp 0x45de76
mov eax, 0x4d03a8
call fcn.0047963c
jmp 0x45de76
cmp dword [0x4d27d4], 0
je 0x45d34d
mov eax, 0x4cfe48
call fcn.0045cb14
jmp 0x45de76
mov eax, 0x4cfe48
call fcn.0045bf60
jmp 0x45de76
cmp dword [0x4cfe38], 0
je 0x45de76
call sub.USER32.DLL_GetFocus
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jne 0x45de76
push dword [0x4cfe38]
call sub.USER32.DLL_SetFocus
jmp 0x45de76
mov edx, 0x4b22fb
mov eax, 0x4b2263
xor ecx, ecx
call fcn.00463dec
test eax, eax
je 0x45de76
mov eax, dword [ebp - 4]
call fcn.0045f7b4
test eax, eax
je 0x45de76
call fcn.004a82c8
sub eax, dword [0x4b21a0]
cmp eax, 0x3e8
jle 0x45de76
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045de90
jmp 0x45de76
mov eax, dword [ebp - 4]
call fcn.0045f7b4
test eax, eax
je 0x45d3f1
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045de90
xor eax, eax
jmp 0x45de85
call fcn.00452774
jmp 0x45de76
mov eax, dword [esi + 0x10]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0045fbd4
jmp 0x45de76
mov eax, 0x4d0b94
call fcn.0045536c
cmp dword [0x4d27dc], 0
jne 0x45d43d
cmp dword [0x4d27d4], 0
je 0x45d447
test al, 0x40
jne 0x45d447
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
jne 0x45d447
mov eax, 1
jmp 0x45de85
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
je 0x45d459
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x1d], 0
jmp 0x45d4a9
mov eax, esi
mov eax, dword [eax + 0x10]
xor edx, edx
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x1c], 0x400
mov ecx, dword [ebp - 4]
add ecx, 0x1d
mov dword [ebp - 0x20], ecx
push edx
push eax
push 0x102d
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
push 0x4b2260
mov ecx, dword [ebp - 4]
add ecx, 0x1d
push ecx
call fcn.0049fd88
add esp, 8
test eax, eax
jne 0x45d4a9
mov eax, 1
jmp 0x45de85
xor eax, eax
jmp 0x45de85
mov ebx, esi
xor edi, edi
xor esi, esi
mov byte [0x4d49bc], 0
mov byte [ebp - 0x434], 0
cmp dword [ebx + 0x20], 0
jne 0x45d513
mov eax, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0x4d49bc
mov dword [ebp - 0x444], 0x400
mov dword [ebp - 0x45c], 1
lea ecx, [ebp - 0x45c]
push ecx
push 0
push 0x1005
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
jmp 0x45d56b
push dword [ebx + 0x20]
push 0x4d49bc
call fcn.0049fdd4
add esp, 8
mov edx, dword [ebx + 0x2c]
cmp edx, dword [0x4d49b4]
jae 0x45d56b
lea ecx, [ebp - 0x108c]
mov edx, dword [ebx + 0x2c]
mov eax, 0x4d48b0
call fcn.00463494
mov esi, dword [ebp - 0x470]
lea edx, [ebp - 0x108c]
lea eax, [ebp - 0x434]
mov ecx, 0x400
call fcn.0040ffdc
lea eax, [ebp - 0x434]
call fcn.0040c4d0
mov byte [eax], 0
cmp byte [0x4d49bc], 0
jne 0x45d57b
xor eax, eax
jmp 0x45de85
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
je 0x45d6fb
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x1c], 0
cmp dword [0x4d27d4], 0
je 0x45d6ad
lea edx, [ebp - 0x188c]
mov eax, str.Rar_MDXXXXXX
call fcn.004667e4
test al, al
je 0x45d9a5
lea ecx, [ebp - 0x188c]
push ecx
lea eax, [ebp - 0x148c]
push eax
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0x148c]
call fcn.0040ca00
push 0x4d49bc
lea edx, [ebp - 0x148c]
push edx
call fcn.0049fcf8
add esp, 8
push 0
lea ecx, [ebp - 0x148c]
push ecx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45d684
call fcn.0044b66c
mov edx, 0x4c7888
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d64
lea edx, [ebp - 0x148c]
mov eax, dword [0x4c8488]
call fcn.004107b8
mov dword [0x4c5a54], 1
mov dword [0x4c5a50], 1
mov byte [0x4c5a90], 0
mov edx, 0x4c49a0
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d38
mov eax, dword [0x4d0d9c]
mov dword [0x4c6438], eax
mov eax, 0x4d0b94
xor edx, edx
call fcn.00454e90
lea ecx, [ebp - 0x148c]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
lea eax, [ebp - 0x188c]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
jmp 0x45d9a5
lea edx, [ebp - 0x148c]
mov eax, 0x1f7
push edx
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
mov eax, 0x4bb2e4
call fcn.0042ed78
jmp 0x45d9a5
push 0
push 0x4d49bc
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45d6c7
mov edi, 1
jmp 0x45d9a5
cmp byte [0x4d49bc], 0
je 0x45d9a5
push 0x4d49bc
mov eax, 0x1f7
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
mov eax, 0x4bb2e4
call fcn.0042ed78
jmp 0x45d9a5
cmp dword [ebx + 0x20], 0
je 0x45d9a5
cmp dword [0x4d27d4], 0
je 0x45d960
lea edx, [ebp - 0x24bc]
mov eax, dword [ebp - 4]
call fcn.00460994
test al, al
je 0x45d73a
lea edx, [ebp - 0x24bc]
mov eax, dword [ebp - 4]
add eax, 0x1d
mov ecx, 0x400
call fcn.0040ffdc
push 0x4d49bc
call fcn.0049fe04
pop ecx
mov ebx, eax
test esi, 4
je 0x45d774
cmp ebx, 4
jle 0x45d774
push 0x4b2290
mov eax, 0x4d49b8
add eax, ebx
push eax
call fcn.0049fd88
add esp, 8
test eax, eax
jne 0x45d774
mov byte [ebx + 0x4d49b8], 0
test esi, 1
je 0x45d7a1
cmp ebx, 2
jle 0x45d7a1
push 0x4b2288
mov edx, 0x4d49ba
add edx, ebx
push edx
call fcn.0049fd88
add esp, 8
test eax, eax
jne 0x45d7a1
mov byte [ebx + 0x4d49ba], 0
xor eax, eax
call fcn.0044b600
call fcn.0044bbdc
mov ecx, 0x4c7c88
mov edx, 0x4c7888
mov eax, 0x4d0b94
call fcn.00458d64
mov edx, dword [0x4d0d9c]
mov eax, 0x4b2263
mov dword [0x4c6438], edx
mov edx, str.FlatView
xor ecx, ecx
call fcn.00463dec
test eax, eax
setne al
and eax, 1
test al, al
je 0x45d802
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x28bc]
push ecx
call fcn.0049fdd4
add esp, 8
jmp 0x45d81f
lea edx, [ebp - 0x28bc]
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d38
lea eax, [ebp - 0x28bc]
call fcn.0040ca00
mov edx, dword [ebp - 4]
mov eax, dword [0x4c8488]
add edx, 0x1d
call fcn.004107b8
lea edx, [ebp - 0x28bc]
push edx
lea ecx, [ebp - 0x2cbc]
push ecx
call fcn.0049fdd4
add esp, 8
push 0x4d49bc
lea eax, [ebp - 0x2cbc]
push eax
call fcn.0049fcf8
add esp, 8
mov eax, dword [0x4c8498]
call fcn.00410788
lea edx, [ebp - 0x2cbc]
mov eax, dword [0x4c8498]
call fcn.004107b8
push 0
push 0
lea edx, [ebp - 0x2cbc]
mov eax, 0x4d48b0
xor ecx, ecx
call fcn.00463570
test al, al
je 0x45d8e1
lea edx, [ebp - 0x2cbc]
mov eax, dword [ebp - 4]
add eax, 0x1d
call fcn.0040fdc0
test eax, eax
jne 0x45d8bc
lea edx, [ebp - 0x2cbc]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x1d
push ecx
call fcn.0049fd88
add esp, 8
test eax, eax
jne 0x45d8e1
mov edx, 0x4d49bc
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0045be34
mov eax, 0x50d
call fcn.00413388
push eax
call fcn.0048a820
pop ecx
jmp 0x45d9a5
mov byte [ebp - 9], 1
mov ebx, 0x4d49bc
jmp 0x45d927
xor eax, eax
mov al, byte [ebx]
push eax
push dword [0x4b21c0]
call fcn.0049fea1
add esp, 8
test eax, eax
je 0x45d909
mov byte [ebp - 9], 0
jmp 0x45d92c
mov esi, ebx
cmp byte [0x4bd230], 0
je 0x45d922
mov eax, 0x4bd130
mov edx, esi
call fcn.0041192c
jmp 0x45d925
lea eax, [esi + 1]
mov ebx, eax
cmp byte [ebx], 0
jne 0x45d8ec
cmp byte [ebp - 9], 0
je 0x45d9a5
lea eax, [ebp - 0x28bc]
xor edx, edx
call fcn.0040c974
test al, al
jne 0x45d9a5
mov eax, dword [ebp - 4]
add eax, 0x1d
xor edx, edx
call fcn.0040c974
test al, al
jne 0x45d9a5
mov eax, 0x4d0b94
call fcn.00455394
jmp 0x45d9a5
push 0x4d49bc
mov edx, dword [ebp - 4]
add edx, 0x1d
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je 0x45d97c
mov edi, 1
jmp 0x45d9a5
push 0x4d49bc
mov eax, dword [ebp - 4]
add eax, 0x1d
push eax
mov eax, 0x207
call fcn.00413388
push eax
call fcn.0048a820
add esp, 0xc
mov eax, 0x4bb2e4
call fcn.0042ed78
push 0x4d49bc
push 0
push 0x402
push dword [0x4cfe34]
call sub.USER32.DLL_PostMessageA
mov eax, edi
jmp 0x45de85
push 0x30
mov eax, 0x65
call fcn.00413388
push eax
mov eax, 0x1f4
call fcn.00413388
push eax
push dword [0x4cfe34]
call sub.USER32.DLL_MessageBoxA
jmp 0x45de76
mov ebx, esi
mov eax, dword [ebx + 0xc]
dec eax
je 0x45d9ff
sub eax, 0x10000
je 0x45da19
jmp 0x45de76
cmp byte [0x4d036c], 0
jne 0x45da0f
xor eax, eax
jmp 0x45de85
mov eax, 0x20
jmp 0x45de85
cmp dword [0x4b21c4], 0xffffffff
jne 0x45da54
mov edx, str.AltColor
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, 0xff0000
call fcn.00463dec
mov dword [0x4b21c4], eax
mov edx, str.AltEncryptionColor
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, 0xd9213
call fcn.00463dec
mov dword [0x4d4dbc], eax
lea ecx, [ebp - 0x38ec]
mov edx, dword [ebx + 0x2c]
mov eax, 0x4d48b0
call fcn.00463494
lea eax, [ebp - 0x38ec]
mov eax, dword [eax + 0xc10]
test ah, 8
je 0x45da81
mov edx, dword [0x4b21c4]
mov dword [ebx + 0x30], edx
test ah, 0x40
je 0x45da8f
mov ecx, dword [0x4d4dbc]
mov dword [ebx + 0x30], ecx
xor eax, eax
jmp 0x45de85
mov eax, esi
lea ebx, [eax + 0xc]
test byte [ebx], 2
je 0x45de76
lea ecx, [ebp - 0x451c]
mov edx, dword [ebx + 0x20]
mov eax, 0x4d48b0
call fcn.00463494
cmp dword [0x4b21c8], 0
jne 0x45dadf
mov dword [0x4b21c8], 0x4401
call fcn.0046701c
test al, al
jne 0x45dadf
or dword [0x4b21c8], 0x10
call fcn.0041113c
test eax, eax
je 0x45dc1a
cmp word [ebp - 0x411c], 0
je 0x45dc1a
lea eax, [ebp - 0x4fd0]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
cmp dword [0x4b21cc], 0
jne 0x45db34
push 0x4b236e
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x45db34
push str.SHGetFileInfoW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4b21cc], eax
cmp dword [0x4b21cc], 0
je 0x45dbdf
push dword [0x4b21c8]
lea eax, [ebp - 0x47d0]
push 0x2b4
push eax
lea edx, [ebp - 0x411c]
push dword [ebp - 0x390c]
push edx
call dword [0x4b21cc]
test eax, eax
je 0x45dbdf
lea edx, [ebp - 0x5098]
lea eax, [ebp - 0x45bc]
mov ecx, 0x1000000
call fcn.004111a0
cmp byte [ebp - 0x5098], 0
jne 0x45db9d
lea ecx, [ebp - 0x5098]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045f93c
mov eax, dword [0x4d27d4]
lea edx, [ebp - 0x5098]
add eax, 2
lea ecx, [ebp - 0x50c0]
mov dword [ebp - 0x50b8], eax
mov dword [ebp - 0x50ac], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x47cc]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x58c0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea edx, [ebp - 0x58c0]
lea eax, [ebp - 0x4fd0]
call fcn.004114d8
test eax, eax
je 0x45dcea
lea ecx, [ebp - 0x4fd0]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
jmp 0x45dcea
lea eax, [ebp - 0x5e20]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [0x4b21c8]
lea edx, [ebp - 0x5a20]
push 0x160
push edx
lea ecx, [ebp - 0x451c]
push dword [ebp - 0x390c]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45dcb2
cmp byte [ebp - 0x5910], 0
jne 0x45dc70
lea ecx, [ebp - 0x5910]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045f93c
mov eax, dword [0x4d27d4]
lea edx, [ebp - 0x5910]
add eax, 2
lea ecx, [ebp - 0x5e48]
mov dword [ebp - 0x5e40], eax
mov dword [ebp - 0x5e34], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x5a1c]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x6248]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x6248]
push eax
lea edx, [ebp - 0x5e20]
push edx
call fcn.0049fd88
add esp, 8
test eax, eax
je 0x45dcea
lea ecx, [ebp - 0x5e20]
push ecx
call fcn.004a186c
pop ecx
test byte [ebx + 1], 0x10
jne 0x45de76
lea ecx, [ebp - 0x6310]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045f93c
mov eax, dword [0x4d27d4]
lea edx, [ebp - 0x6310]
add eax, 2
lea ecx, [ebp - 0x6338]
mov dword [ebp - 0x6330], eax
mov dword [ebp - 0x6324], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x411c]
lea eax, [ebp - 0x451c]
call fcn.0040ad8c
mov esi, eax
lea eax, [ebp - 0x6738]
mov edx, 0x400
call fcn.00466df0
lea eax, [ebp - 0x6738]
call fcn.0040ca00
push str._rar_icon_
lea edx, [ebp - 0x6738]
push edx
call fcn.0049fcf8
add esp, 8
mov eax, esi
call fcn.0040aa90
test al, al
je 0x45ddfb
cmp dword [0x4b21d0], 0xffffffff
jne 0x45ddde
push 0
lea edx, [ebp - 0x6738]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45ddd2
push 0x4001
lea ecx, [ebp - 0x6898]
push 0x160
push ecx
lea eax, [ebp - 0x6738]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45ddd2
mov edx, dword [ebp - 0x6894]
mov dword [0x4b21d0], edx
lea ecx, [ebp - 0x6738]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
cmp dword [0x4b21d0], 0xffffffff
je 0x45de76
or dword [ebx], 0x1000
mov eax, dword [0x4b21d0]
mov dword [ebx + 0x1c], eax
jmp 0x45de76
cmp dword [0x4b21d4], 0xffffffff
jne 0x45de5f
push 0x4b2394
lea edx, [ebp - 0x6738]
push edx
call fcn.004a1e14
add esp, 8
test eax, eax
je 0x45de52
push eax
call fcn.004a191c
pop ecx
push 0x4001
lea ecx, [ebp - 0x69f8]
push 0x160
push ecx
lea eax, [ebp - 0x6738]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45de52
mov edx, dword [ebp - 0x69f4]
mov dword [0x4b21d4], edx
lea ecx, [ebp - 0x6738]
push ecx
call fcn.004a2aa0
pop ecx
cmp dword [0x4b21d4], 0xffffffff
je 0x45de76
or dword [ebx], 0x1000
mov eax, dword [0x4b21d4]
mov dword [ebx + 0x1c], eax
xor eax, eax
jmp 0x45de85
push esi
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8