Function at 0x45eea0
Capabilities:
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
mov eax, 0x3144
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x3140], eax
mov eax, dword [esp + 0x314c]
push ebx
mov ebx, dword [esp + 0x3158]
push esi
mov esi, dword [esp + 0x3150]
push edi
mov edi, ecx
cmp eax, 0x4e
jne 0x45fb7a
mov ecx, dword [ebx + 8]
xor eax, eax
cmp dword [eax + 0x585218], ecx
je 0x45eef2
add eax, 4
cmp eax, 0x1c
jb 0x45eee0
jmp 0x45ef07
push 0
push 0
push 0x8000
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push ebp
cmp eax, 0xb0
ja case.0x45ef22.174
movzx eax, byte [eax + 0x45fbbc]
jmp dword [eax*4 + 0x45fb90]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
movsx ebp, ax
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
movsx esi, ax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp word [ebx + 0xc], 0x79
cwde
mov dword [esp + 0x10], eax
jne 0x45ef6e
test ebp, 0x8000
jne 0x45ef63
test esi, 0x8000
je 0x45ef86
mov ecx, edi
call fcn.00462570
mov eax, dword [esp + 0x10]
test ebp, 0x8000
jne case.0x45ef22.174
test esi, 0x8000
jne case.0x45ef22.174
test eax, 0x8000
jne case.0x45ef22.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x45ef22.174
movzx eax, byte [eax + 0x45fc90]
jmp dword [eax*4 + 0x45fc70]
call fcn.00538625
push 2
mov ecx, edi
mov dword [0x5cd0a0], eax
call fcn.0045e9d0
call fcn.00538625
mov dword [0x5cd0a0], eax
xor eax, eax
jmp 0x45f356
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
push 8
mov esi, eax
mov dword [esp + 0x30], 0xa
push esi
push 0x102c
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, 8
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push esi
push 0x102b
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], 3
push eax
inc esi
mov dword [esp + 0x2c], 1
push esi
push 0x102b
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.00462bd0
push 0
push esi
push 0x1013
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x45f356
push 0
push pe_nt_image_headers32
push 0x111
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x45f356
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [edi + 0x28]
mov esi, eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push esi
push 0x1076
push dword [edi + 0x28]
mov byte [edi + 0x39], 0
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x45f356
mov ecx, 0x5c63d4
call fcn.00404090
xor eax, eax
jmp 0x45f356
mov ecx, 0x5c6810
call fcn.00461830
xor eax, eax
jmp 0x45f356
cmp dword [0x5943e0], 0
je case.0x45ef22.174
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [edi + 0x28]
jne case.0x45ef22.174
push dword [0x5943e0]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
jmp 0x45f356
push 0
push str.SingleClick
push str.FileList
call fcn.004cffa0
test eax, eax
je case.0x45ef22.174
mov ecx, edi
call fcn.0045de60
test eax, eax
je case.0x45ef22.174
call fcn.00538625
sub eax, dword [0x5cd0a0]
cmp eax, 0x3e8
jle case.0x45ef22.174
push 2
mov ecx, edi
call fcn.0045e9d0
xor eax, eax
jmp 0x45f356
mov ecx, edi
call fcn.0045de60
test eax, eax
je case.0x45ef22.174
push 2
mov ecx, edi
call fcn.0045e9d0
xor eax, eax
jmp 0x45f356
push 0
push 0
call fcn.00414560
xor eax, eax
jmp 0x45f356
mov edx, dword [ebx + 0x10]
mov esi, 0x64
xor eax, eax
mov ecx, 0x58510c
cmp dword [ecx], edx
je 0x45f1a3
inc eax
add ecx, 0x20
cmp eax, 9
jb 0x45f194
jmp 0x45f1ac
shl eax, 5
mov esi, dword [eax + 0x585110]
cmp byte [0x5943f4], 0
mov ebx, str.ArcSort
jne 0x45f1bf
mov ebx, str.FileSort
push 0
push ebx
push str.FileList
call fcn.004cffa0
cmp esi, eax
jne 0x45f1d3
or esi, 0x20
push 0
push 0x5599d0
push str.FileList
call fcn.004cffa0
and esi, 0x3f
push esi
push ebx
push str.FileList
call fcn.004d0e60
mov ecx, edi
call fcn.00463120
push 1
push 0xffffffffffffffff
push 0x100c
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x1013
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x45f356
mov ecx, 0x5c3bd0
call fcn.00409ad0
cmp dword [0x5933d8], 0
jne 0x45f351
cmp byte [edi + 0x103a], 0
jne 0x45f351
cmp byte [0x5943f4], 0
je 0x45f262
and eax, 0x40
or eax, 0
jne 0x45f262
cmp byte [edi + 0x39], al
je 0x45f351
cmp byte [edi + 0x39], 0
jne case.0x45ef22.174
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x104b
push dword [edi + 0x28]
mov dword [esp + 0x2c], 4
mov dword [esp + 0x34], 0
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x45f351
push dword [esp + 0x3c]
lea eax, [esp + 0x5c]
mov ecx, 0x5cc050
push eax
call fcn.00459e70
lea eax, [esp + 0x58]
push eax
call fcn.004a3770
push 0
push 0
push 0x1018
push dword [edi + 0x28]
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x5589f0
mov ecx, esi
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x45f308
test ax, ax
je 0x45f304
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x45f308
add ecx, 4
add edx, 4
test ax, ax
jne 0x45f2e2
xor eax, eax
jmp 0x45f30d
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f351
cmp byte [esp + 0x1134], 0
jne case.0x45ef22.174
push 0x2e
push esi
call fcn.0053252b
add esp, 8
test eax, eax
je case.0x45ef22.174
cmp eax, esi
je case.0x45ef22.174
sub eax, esi
sar eax, 1
push eax
push 0
push 0xb1
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x45f356
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x314c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x3144
ret 0x10
xor eax, eax
lea ebp, [edi + 0x3a]
mov word [ebp], ax
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x45f3c4
cmp byte [edi + 0x39], al
je case.0x45ef22.174
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x104b
push dword [edi + 0x28]
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x800
mov dword [esp + 0x2c], 1
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45f3d0
push 0x800
push eax
push ebp
call fcn.004bdae0
cmp word [ebp], 0
je case.0x45ef22.174
xor ebx, ebx
cmp byte [edi + 0x39], bl
je 0x45f53c
mov byte [edi + 0x39], bl
cmp byte [0x5943f4], bl
je 0x45f4f2
push ebx
push 0x800
lea eax, [esp + 0x1158]
push eax
push str.Rar_MD
call fcn.004fd650
test al, al
je 0x45f7f3
push 0x800
lea eax, [esp + 0x2154]
push eax
push ebp
lea eax, [esp + 0x115c]
push eax
call fcn.004a2fb0
push ebx
push ebx
lea eax, [esp + 0x2158]
push eax
call fcn.00491b40
test eax, eax
jne 0x45f4e8
push eax
call fcn.004f84c0
push 0x800
push 0x5b332a
mov ecx, 0x5c3bd0
call fcn.004099c0
lea eax, [esp + 0x2150]
mov ecx, 0x5b432c
push eax
call fcn.004bdbd0
push 0x800
push 0x5a8f00
mov ecx, 0x5c3bd0
mov dword [0x5abf40], 2
mov dword [0x5abf3c], 2
mov byte [0x5abf89], bl
call fcn.0040a1e0
push 0x800
push ebp
push ebp
push 0x5a8f00
call fcn.004a2fb0
mov eax, dword [0x5c3bd4]
mov ecx, 0x5c3bd0
push ebx
mov dword [0x5ae2c8], eax
call fcn.00408370
lea eax, [esp + 0x2150]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x1150]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x45f7f3
lea eax, [esp + 0x2150]
push eax
jmp 0x45f521
push 0x800
push ebp
push ebp
mov ecx, edi
call fcn.0045dd10
push 0
push 0
push ebp
call fcn.00491b40
test eax, eax
jne 0x45f516
lea ebx, [eax + 1]
jmp 0x45f7f3
cmp word [ebp], bx
je 0x45f7f3
push ebp
push 0x1f7
call fcn.004b7300
push eax
push esi
push 1
call fcn.00503800
add esp, 0x10
jmp 0x45f7f3
lea eax, [esp + 0x58]
mov dword [esp + 0x10e8], ebx
push eax
mov ecx, edi
mov dword [esp + 0x10f0], ebx
mov dword [esp + 0x10f4], ebx
mov dword [esp + 0x10f8], ebx
mov dword [esp + 0x10fc], ebx
mov dword [esp + 0x1100], ebx
call fcn.0045d040
test al, al
je case.0x45ef22.174
cmp byte [0x5943f4], bl
je 0x45f794
push 0
call fcn.004f84c0
push 0x800
push 0x5b332a
mov ecx, 0x5c3bd0
call fcn.004099c0
mov eax, dword [0x5c3bd4]
mov dword [0x5ae2c8], eax
lea eax, [esp + 0x58]
push 0x800
push eax
lea eax, [esp + 0x1158]
push eax
call fcn.004bdae0
lea eax, [esp + 0x1150]
push eax
call fcn.004a3770
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x58]
push eax
mov ecx, 0x5b432c
call fcn.004bdbd0
push 0x800
lea eax, [esp + 0x2154]
push eax
push ebp
lea eax, [esp + 0x115c]
push eax
call fcn.004a2fb0
mov ecx, 0x5b449c
call fcn.004bddc0
lea eax, [esp + 0x2150]
mov ecx, 0x5b449c
push eax
call fcn.004bdbd0
push 0
push 0
lea eax, [esp + 0x2158]
mov ecx, 0x5cc050
push eax
call fcn.0045a3b0
test al, al
je 0x45f6ab
lea eax, [esp + 0x2150]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.004c1ba0
test eax, eax
jne 0x45f684
lea ecx, [esp + 0x2150]
lea eax, [esp + 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45f67b
test dx, dx
je 0x45f677
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45f67b
add eax, 4
add ecx, 4
test dx, dx
jne 0x45f655
xor eax, eax
jmp 0x45f680
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45f6ab
lea eax, [esp + 0x2150]
mov ecx, edi
push eax
call fcn.0045d840
push 0x50d
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 4
jmp 0x45f7f3
mov esi, ebp
movzx eax, word [esi]
mov ecx, eax
cmp eax, 0x20
jne 0x45f6ce
jmp 0x45f6c0
movzx eax, word [esi + 2]
add esi, 2
cmp eax, 0x20
je 0x45f6c0
mov ecx, eax
test cx, cx
je 0x45f77f
mov edi, esi
movzx ecx, cx
lea esp, [esp]
push ecx
push str._____:
call fcn.005317e5
add esp, 8
test eax, eax
jne 0x45f77f
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x45f6e0
mov ecx, 0x558b90
mov eax, esi
jmp 0x45f710
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45f736
test dx, dx
je 0x45f732
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45f736
add eax, 4
add ecx, 4
test dx, dx
jne 0x45f710
xor eax, eax
jmp 0x45f73b
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f77f
mov eax, 0x5589f0
mov cx, word [esi]
cmp cx, word [eax]
jne 0x45f76a
test cx, cx
je 0x45f766
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x45f76a
add esi, 4
add eax, 4
test cx, cx
jne 0x45f744
xor eax, eax
jmp 0x45f76f
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f77f
push 0
mov ecx, 0x5c3bd0
call fcn.0040bdc0
push 0x800
lea eax, [esp + 0x2154]
push eax
push ebp
call fcn.004bdae0
jmp 0x45f7f3
push 0x800
lea eax, [esp + 0x2154]
mov ecx, edi
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0045dd10
push 0x800
push ebp
push ebp
mov ecx, edi
call fcn.0045dd10
push ebp
lea eax, [esp + 0x2154]
push eax
call fcn.00491fa0
test al, al
je 0x45f7d4
mov ebx, 1
jmp 0x45f7f3
push ebp
lea eax, [esp + 0x2154]
push eax
push 0x20a
call fcn.004b7300
push eax
push esi
push 1
call fcn.00503800
add esp, 0x14
cmp byte [0x5b12f2], 0
jne 0x45f810
push ebp
push 1
push 0x8002
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
jmp 0x45f356
push 0x65
call fcn.004b7300
push 0x1f4
mov esi, eax
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
xor eax, eax
jmp 0x45f356
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x45f8d5
sub eax, 0x10000
jne case.0x45ef22.174
cmp dword [0x585234], 0xffffffff
jne 0x45f892
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.004cffa0
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x585234], eax
call fcn.004cffa0
mov dword [0x5cd0a4], eax
push dword [ebx + 0x2c]
lea eax, [esp + 0x5c]
mov ecx, 0x5cc050
push eax
call fcn.00459e70
mov ecx, dword [eax + 0x10a8]
test ecx, 0x800
je 0x45f8ba
mov eax, dword [0x585234]
mov dword [ebx + 0x30], eax
test ecx, 0x4000
je case.0x45ef22.174
mov eax, dword [0x5cd0a4]
mov dword [ebx + 0x30], eax
xor eax, eax
jmp 0x45f356
cmp byte [0x5c8950], 0
je case.0x45ef22.174
mov eax, 0x20
jmp 0x45f356
test byte [ebx + 0xc], 3
je case.0x45ef22.174
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x5cc054]
jae case.0x45ef22.174
push eax
mov ecx, 0x5cc050
call fcn.0045a000
cmp byte [0x5943f4], 0
mov ebp, eax
mov esi, dword [ebp]
jne 0x45f96d
cmp dword [0x5943f8], 1
push 0x800
jne 0x45f93b
lea eax, [esp + 0x1154]
push eax
call fcn.004fe630
jmp 0x45f94f
lea eax, [edi + 0x103c]
push eax
lea eax, [esp + 0x1158]
push eax
call fcn.004bdae0
push 0x800
lea eax, [esp + 0x5c]
push eax
push dword [ebp]
lea eax, [esp + 0x115c]
push eax
call fcn.004a2fb0
lea esi, [esp + 0x58]
cmp byte [0x5943f4], 0
mov edx, 0x4401
mov dword [esp + 0x10], edx
je 0x45f99a
cmp word [esi], 0x2e
mov edx, 0x4411
mov dword [esp + 0x10], edx
jne 0x45f99a
cmp word [esi + 2], 0
jne 0x45f99a
mov esi, 0x55cfe8
mov ecx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x14], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f9a3
sub ecx, dword [esp + 0x14]
sar ecx, 1
cmp ecx, 0x100
ja 0x45f9c1
cmp word [esi], ax
jne 0x45f9fc
or edx, 0x10
push esi
mov dword [esp + 0x14], edx
call fcn.004a2790
mov esi, eax
test esi, esi
je 0x45f9f7
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f9e0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x101
jbe 0x45f9fc
mov esi, str.dummy
cmp byte [0x5943f4], 0
je 0x45fa23
movzx eax, word [esi]
push eax
call fcn.004a2f40
test al, al
je 0x45fa23
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.004a2f40
test al, al
jne 0x45fa12
push dword [esp + 0x10]
mov eax, dword [ebp + 0x18]
lea ecx, [esp + 0x2154]
push 0x2b4
and eax, 0x10
push ecx
push eax
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne cl
test eax, eax
jne 0x45fa78
mov eax, dword [esp + 0x10]
test al, 0x10
jne 0x45fa78
or eax, 0x10
push eax
push 0x2b4
lea eax, [esp + 0x2158]
push eax
push dword [esp + 0x20]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne cl
test cl, cl
je 0x45fb6c
push 0xc8
lea eax, [esp + 0x2368]
push eax
lea eax, [esp + 0x1158]
push eax
call fcn.004bdae0
mov eax, dword [ebp + 0x60]
dec eax
cmp eax, 4
ja case.default.0x45faa3
jmp dword [eax*4 + 0x45fcfc]
push 0xc8
push 0x618
jmp 0x45fad8
push 0xc8
push 0x619
jmp 0x45fad8
push 0xc8
push 0x61a
jmp 0x45fad8
push 0xc8
push 0x61b
call fcn.004b7300
push eax
lea eax, [esp + 0x1158]
push eax
call fcn.004bdae0
cmp word [esp + 0x1150], 0
jne 0x45fb33
push dword [ebp + 0x18]
call fcn.00491560
push 0xc8
test al, al
je 0x45fb21
push 0x573
call fcn.004b7300
push eax
lea eax, [esp + 0x1158]
push eax
call fcn.004bdae0
jmp 0x45fb33
lea eax, [esp + 0x1154]
mov ecx, edi
push eax
push dword [ebp]
call fcn.0045d7b0
test byte [ebx + 0xc], 1
je 0x45fb5c
mov eax, dword [ebx + 0x14]
cmp eax, dword [0x5cc084]
jne 0x45fb5c
mov eax, dword [ebx + 0x24]
test eax, eax
jle 0x45fb5c
push eax
lea eax, [esp + 0x1154]
push eax
push dword [ebx + 0x20]
call fcn.004bdae0
test byte [ebx + 0xc], 2
je 0x45fb6c
mov eax, dword [esp + 0x2154]
mov dword [ebx + 0x28], eax
or dword [ebx + 0xc], 0x1000
xor eax, eax
jmp 0x45f356
push ebx
push dword [esp + 0x3160]
push eax
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x45f357