Function at 0x43b990
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
sub esp, 0x360
mov dl, byte [0x4fbe40]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x75]
mov byte [esp + 0x74], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, pe_nt_image_headers32
mov dword [esp + 0x25], eax
lea edi, [esp + 0x10d]
mov dword [esp + 0x29], eax
mov byte [esp + 0x10c], dl
mov dword [esp + 0x2d], eax
mov byte [esp + 0x94], dl
mov dword [esp + 0x31], eax
mov byte [esp + 0x54], dl
mov word [esp + 0x35], ax
mov byte [esp + 0x24], dl
mov byte [esp + 0x37], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x95]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x55]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x44]
stosb byte es:[edi], al
mov eax, dword [esi + 0x60]
cmp eax, ecx
jge 0x43bb1e
test eax, eax
jl 0x43bb1e
mov ecx, dword [esi + 0x40]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x43ba4f
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454750
mov eax, dword [edi + 0x28]
mov dword [esp + 0x18], 1
test eax, eax
je 0x43ba57
mov dword [esp + 0x18], 0
mov ebp, dword [sym.imp.user32.dll_GetKeyState]
push 0x10
call ebp
mov bx, ax
push 0x11
shr ebx, 0xf
and ebx, 1
call ebp
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.user32.dll_wsprintfA]
test eax, eax
je 0x43bb57
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x43ba9a
lea edx, [esp + 0x54]
push 0x4ee81c
push edx
call dword [sym.imp.kernel32.dll_lstrcpy]
push 0x5a
call dword [sym.imp.user32.dll_GetKeyState]
test ah, 0x80
je 0x43bb25
test ebx, ebx
je 0x43bb25
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454890
push 0xffffffffffffffff
mov ecx, edi
mov ebx, eax
call fcn.00454750
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + ecx*4]
mov ecx, dword [esi + 8]
cdq
idiv ebx
mov edx, dword [ecx + 0x58]
mov dword [esp + 0x1c], edx
mov ebx, eax
mov eax, dword [ecx + 0x5c]
mov dword [esp + 0x20], eax
call fcn.0045e6b0
fld qword [esp + 0x1c]
fmul qword [0x4d8820]
push eax
push ebx
fadd qword [0x4d8970]
call fcn.004c836c
push eax
lea ecx, [esp + 0x60]
push 0x4efeb8
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + eax + 0x64]
push edx
call ebp
add esp, 0x14
jmp 0x43bb57
xor edi, edi
jmp 0x43ba4f
mov eax, dword [esi + 8]
fld qword [eax + 0x58]
fmul qword [0x4d8820]
fadd qword [0x4d8970]
call fcn.004c836c
push eax
lea ecx, [esp + 0x58]
push 0x4efeb0
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + eax + 0x5c]
push edx
call ebp
add esp, 0xc
mov eax, dword [esi + 0x44]
test eax, eax
je 0x43bb75
push eax
mov eax, dword [esi + 0x60]
inc eax
lea ecx, [esp + 0x78]
push eax
push 0x4efea8
push ecx
call ebp
add esp, 0x10
jmp 0x43bb8b
mov eax, dword [esi + 4]
lea edx, [esp + 0x74]
push 0x1e
push edx
push 0xa3
push eax
call dword [sym.imp.user32.dll_LoadStringA]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43bbff
mov ecx, edi
call fcn.00456650
cmp eax, 1
jle 0x43bbff
mov ecx, edi
call fcn.00454480
cmp eax, 1
jne 0x43bbc7
mov ecx, edi
call fcn.00456650
push eax
lea ecx, [esp + 0xe8]
push 0x4efe98
push ecx
call ebp
add esp, 0xc
jmp 0x43bbec
mov edx, dword [esi + 8]
mov ecx, edi
mov ebx, dword [edx + 0x6d0]
call fcn.00456650
inc ebx
push eax
push ebx
lea eax, [esp + 0xec]
push 0x4efe88
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x74]
push ecx
push edx
call dword [sym.imp.kernel32.dll_lstrcat]
test edi, edi
je 0x43bc3e
mov eax, dword [0x4fbccc]
test eax, eax
je 0x43bc3e
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push 0
call fcn.00454cb0
push eax
call fcn.00442b60
add esp, 0xc
test eax, eax
je 0x43bc3e
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.00443540
add esp, 0xc
mov eax, dword [esi + 0x28]
test eax, eax
je 0x43bc53
push eax
call dword [sym.imp.user32.dll_DestroyCursor]
mov dword [esi + 0x28], 0
test edi, edi
je 0x43bd14
mov eax, dword [0x4fbc44]
test eax, eax
jne 0x43bc71
push 0x50
call dword [sym.imp.user32.dll_GetKeyState]
test ah, 0x80
je 0x43bc89
mov ecx, edi
call fcn.00454cb0
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrcpy]
jmp 0x43bca4
lea edx, [esp + 0x10c]
push 0x104
push edx
mov ecx, edi
call fcn.00454cb0
push eax
call dword [sym.imp.comdlg32.dll_GetFileTitleA]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x43bcd6
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.kernel32.dll_lstrlen]
mov ecx, 0x50
lea edx, [esp + eax + 0x94]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov ecx, edi
call fcn.00454f00
jmp 0x43bd14
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454950
push eax
push 0xffffffffffffffff
mov ecx, edi
call fcn.004548f0
push eax
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454890
push eax
mov ecx, edi
call fcn.00454480
push eax
lea ecx, [esp + 0xb0]
push 0
push ecx
call fcn.00456950
add esp, 0x24
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.user32.dll_GetDC]
mov ebp, dword [sym.imp.user32.dll_SendMessageA]
mov ebx, eax
mov eax, dword [esi + 0x18]
push 0
push 0
push 0x31
push eax
call ebp
push eax
push ebx
call dword [sym.imp.gdi32.dll_SelectObject]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x74]
push ecx
push edx
call dword [sym.imp.kernel32.dll_lstrlen]
push eax
lea eax, [esp + 0x7c]
push eax
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
lea eax, [esp + 0x10c]
add ecx, 0xa
push edx
push eax
mov dword [esp + 0x40], ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea ecx, [esp + 0x110]
push eax
push ecx
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
test edi, edi
lea ecx, [eax + edx + 0xa]
mov dword [esp + 0x3c], ecx
je 0x43bdcb
push 0x101
lea edx, [esp + 0x214]
push 0x160
push edx
push 0
mov ecx, edi
call fcn.00454cb0
push eax
call dword [sym.imp.shell32.dll_SHGetFileInfo]
test eax, eax
je 0x43bdcb
mov eax, dword [esp + 0x210]
mov dword [esi + 0x28], eax
jmp 0x43bdd2
mov dword [esi + 0x28], 0
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x18]
push ecx
push 1
push 0x40f
push edx
call ebp
test eax, eax
je 0x43be01
mov eax, dword [esi + 0x28]
test eax, eax
je 0x43be01
push 0x31
call fcn.00442af0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + eax + 5]
mov dword [esp + 0x3c], edx
mov eax, dword [0x4fbccc]
mov edi, 2
test eax, eax
je 0x43be41
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + 0x28]
push eax
push edx
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov edi, 3
lea edx, [ecx + eax + 0xa]
mov dword [esp + 0x40], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + 0x98]
push eax
push edx
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + edi*4 + 0x34]
mov ecx, dword [esp + 0x10]
inc edi
lea edx, [eax + ecx + 0xa]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
mov dword [esp + edi*4 + 0x38], edx
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + 0x58]
push eax
push edx
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + edi*4 + 0x34]
mov ecx, dword [esp + 0x10]
inc edi
lea edx, [eax + ecx + 0xa]
lea eax, [esp + 0x10]
push eax
push 0x10
push 0x4efe74
mov dword [esp + edi*4 + 0x40], edx
push ebx
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + edi*4 + 0x34]
mov edx, dword [esp + 0x10]
inc edi
push ebx
lea eax, [ecx + edx + 0xa]
mov ecx, dword [esi + 0x18]
mov dword [esp + edi*4 + 0x38], eax
push ecx
mov dword [esp + edi*4 + 0x40], 0xffffffff
call dword [sym.imp.user32.dll_ReleaseDC]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x38]
inc edi
push edx
push edi
push 0x404
push eax
call ebp
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x74]
push ecx
push 0
push 0x401
push edx
call ebp
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x10c]
push eax
push 1
push 0x401
push ecx
mov edi, 2
call ebp
mov eax, dword [0x4fbccc]
test eax, eax
je 0x43bf38
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x24]
push edx
push 2
push 0x401
push eax
mov edi, 3
call ebp
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x94]
mov eax, edi
push ecx
push eax
push 0x401
push edx
inc edi
call ebp
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x54]
mov eax, edi
push ecx
push eax
push 0x401
push edx
inc edi
call ebp
mov eax, edi
push 0
or ah, 0x10
inc edi
push eax
mov eax, dword [esi + 0x18]
push 0x401
push eax
call ebp
mov eax, dword [esi + 0x90]
test eax, eax
jne 0x43bf86
mov eax, 0x4fbe40
mov ecx, dword [esi + 0x18]
push eax
push edi
push 0x410
push ecx
call ebp
mov eax, dword [esi + 0x90]
test eax, eax
jne 0x43bfa2
mov eax, 0x4fbe40
mov edx, dword [esi + 0x18]
push eax
push edi
push 0x401
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x360
ret