Function at 0x44b2f7
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2ce8
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x2ce4], eax
mov eax, dword [esp + 0x2cec]
push ebx
mov ebx, dword [esp + 0x2cfc]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2cf8]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
cmp ecx, 0x4e
jne 0x44be07
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x4d926c], ecx
je 0x44b2c2
add eax, 4
cmp eax, 0x1c
jb 0x44b2b0
jmp 0x44b2d5
mov eax, dword [0x51c8dc]
push esi
push esi
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push edi
cmp eax, 0xb0
ja case.0x44b2f0.174
movzx ecx, byte [eax + 0x44be4c]
jmp dword [ecx*4 + 0x44be20]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebp
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [ebx + 0xc], 0x79
jne 0x44b33c
test esi, esi
jne 0x44b333
test edi, edi
je 0x44b34c
mov ecx, dword [esp + 0x10]
call fcn.00447960
test esi, esi
jne case.0x44b2f0.174
test edi, edi
jne case.0x44b2f0.174
test ebp, ebp
jne case.0x44b2f0.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x44b2f0.174
movzx edx, byte [eax + 0x44bf20]
jmp dword [edx*4 + 0x44bf00]
call fcn.004b2085
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x532ff0], eax
call fcn.0044adf0
call fcn.004b2085
mov dword [0x532ff0], eax
jmp case.0x44b2f0.174
mov ecx, dword [esp + 0x10]
call fcn.004478d0
jmp case.0x44b2f0.174
mov eax, dword [0x51c8dc]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x44b2f0.174
mov ecx, dword [esp + 0x10]
call fcn.00446030
jmp case.0x44b2f0.174
mov ecx, 0x5220a8
call fcn.00407100
jmp case.0x44b2f0.174
mov ecx, 0x5220b8
call fcn.0044acf0
jmp case.0x44b2f0.174
cmp dword [0x51c01c], 0
je case.0x44b2f0.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x44b2f0.174
mov edx, dword [0x51c01c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x44b2f0.174
push esi
push str.SingleClick
push str.FileList
call fcn.00460ee0
test eax, eax
je case.0x44b2f0.174
mov ecx, ebp
call fcn.00445ec0
test eax, eax
je case.0x44b2f0.174
call fcn.004b2085
sub eax, dword [0x532ff0]
cmp eax, 0x3e8
jle case.0x44b2f0.174
push esi
push 1
mov ecx, ebp
call fcn.0044adf0
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x2cec]
pop ebp
pop ebx
xor ecx, esp
call fcn.004b102c
add esp, 0x2ce8
ret 0x10
mov ecx, ebp
call fcn.00445ec0
test eax, eax
je case.0x44b2f0.174
jmp 0x44b43d
call fcn.00427970
jmp case.0x44b2f0.174
mov eax, dword [ebx + 0x10]
push eax
mov ecx, ebp
call fcn.0044ac30
jmp case.0x44b2f0.174
mov ecx, 0x5229e0
call fcn.00411c10
mov dword [esp + 0x18], edx
cmp dword [0x51c034], esi
jne 0x44b593
cmp byte [ebp + 0x81a], 0
jne 0x44b593
cmp byte [0x51b789], 0
je 0x44b4c7
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x44b4c7
cmp byte [ebp + 0x18], cl
je 0x44b593
cmp byte [ebp + 0x18], 0
je 0x44b4d8
xor ecx, ecx
mov word [ebp + 0x1a], cx
jmp case.0x44b2f0.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
call edi
test eax, eax
je 0x44b593
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0xb38]
push eax
mov ecx, 0x532718
call fcn.00445250
push 0x400
lea ecx, [esp + 0xb38]
push ecx
lea esi, [ebp + 0x1a]
call fcn.00456820
push eax
push esi
call fcn.004709a0
mov edx, dword [ebp]
push 0
push 0
push 0x1018
push edx
call edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4c7b2c
lea esp, [esp]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44b586
test cx, cx
je 0x44b582
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44b586
add esi, 4
add eax, 4
test cx, cx
jne 0x44b560
xor eax, eax
jmp 0x44b58b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x44b2f0.174
mov eax, 1
jmp 0x44b449
xor eax, eax
mov word [0x5327f0], ax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], esi
mov word [esp + 0x1cf4], cx
lea edi, [ecx + 1]
cmp eax, esi
jne 0x44b5fc
cmp byte [ebp + 0x18], cl
je case.0x44b2f0.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], 0x5327f0
mov dword [esp + 0x44], 0x400
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44b656
push 0x400
push eax
push 0x5327f0
call fcn.004709a0
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x5327cc]
jae 0x44b656
push eax
lea edx, [esp + 0xb38]
push edx
mov ecx, 0x532718
call fcn.00445250
push 0x400
lea eax, [esp + 0xb38]
push eax
lea ecx, [esp + 0x1cfc]
push ecx
call fcn.004709a0
lea edx, [esp + 0x1cf4]
push edx
call fcn.00456820
xor ecx, ecx
mov word [eax], cx
cmp word [0x5327f0], si
je case.0x44b2f0.174
cmp byte [ebp + 0x18], 0
je 0x44b874
mov byte [ebp + 0x18], 0
cmp byte [0x51b789], 0
push esi
je 0x44b84d
lea edx, [esp + 0xb38]
push edx
push str.Rar_MD
call fcn.0048c720
test al, al
je 0x44bab8
xor eax, eax
mov ebx, 2
movzx ecx, word [esp + eax + 0xb34]
mov word [esp + eax + 0x14f4], cx
add eax, ebx
test cx, cx
jne 0x44b6a0
lea eax, [esp + 0x14f4]
push eax
call fcn.004561a0
mov eax, 0x5327f0
mov edx, eax
jmp 0x44b6d0
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x44b6d0
lea edi, [esp + 0x14f4]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x44b6e6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x14f8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44b82d
push 0
call fcn.00488920
push 0x400
push 0x52aca2
mov ecx, 0x5229e0
call fcn.00413320
mov ecx, dword [0x52b4a4]
lea edx, [esp + 0x14f4]
push edx
call fcn.00471180
push 0x400
push 0x5274fc
mov ecx, 0x5229e0
mov dword [0x528230], ebx
mov dword [0x52822c], ebx
mov byte [0x52826e], 0
call fcn.00413300
xor eax, eax
movzx ecx, word [eax + 0x5274fc]
mov word [esp + eax + 0x24f4], cx
add eax, ebx
test cx, cx
jne 0x44b770
lea eax, [esp + 0x24f4]
push eax
call fcn.004561a0
mov eax, 0x5327f0
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x44b7a0
lea edi, [esp + 0x24f4]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x44b7b6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x44b7e0
movzx ecx, word [esp + eax + 0x24f4]
mov word [eax + 0x5327f0], cx
add eax, ebx
test cx, cx
jne 0x44b7e0
mov ecx, dword [0x522bec]
mov dword [0x528c34], ecx
push 0
mov ecx, 0x5229e0
call fcn.004179c0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x14f4]
push edx
call esi
lea eax, [esp + 0xb34]
push eax
call esi
jmp 0x44bab8
lea ecx, [esp + 0x14f4]
push ecx
push 0x1f7
call fcn.004671c0
push eax
call fcn.0049a620
add esp, 8
jmp 0x44baae
push 0x5327f0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44ba8f
cmp word [0x5327f0], si
je 0x44bab8
push 0x5327f0
jmp 0x44b835
cmp byte [0x51b789], 0
je 0x44ba79
lea edx, [esp + 0xb34]
push edx
mov ecx, ebp
call fcn.004468e0
test al, al
je 0x44b8aa
push 0x400
lea eax, [esp + 0xb38]
push eax
lea ecx, [ebp + 0x1a]
push ecx
call fcn.004709a0
push esi
call fcn.00488920
push 0x400
push 0x52aca2
mov ecx, 0x5229e0
call fcn.00413320
mov edx, dword [0x522bec]
push esi
push 0x4c8a78
push str.FileList
mov dword [0x528c34], edx
call fcn.00460ee0
test eax, eax
je 0x44b90a
xor eax, eax
jmp 0x44b8f0
movzx ecx, word [esp + eax + 0x1cf4]
mov word [esp + eax + 0x24f4], cx
add eax, 2
cmp cx, si
jne 0x44b8f0
jmp 0x44b92e
push 0x400
lea eax, [esp + 0x24f8]
push eax
mov ecx, 0x5229e0
call fcn.00413300
lea ecx, [esp + 0x24f4]
push ecx
call fcn.004561a0
mov ecx, dword [0x52b4a4]
lea ebx, [ebp + 0x1a]
push ebx
call fcn.00471180
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x24f4]
mov word [esp + eax + 0x14f4], cx
add eax, 2
cmp cx, si
jne 0x44b940
mov eax, 0x5327f0
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x44b960
lea edi, [esp + 0x14f4]
sub eax, edx
add edi, 0xfffffffe
jmp 0x44b980
mov cx, word [edi + 2]
add edi, 2
cmp cx, si
jne 0x44b980
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x52b4b4]
call fcn.00470d80
mov ecx, dword [0x52b4b4]
lea edx, [esp + 0x14f4]
push edx
call fcn.00471180
push 0
push 0
lea eax, [esp + 0x14fc]
push eax
push 0
mov ecx, 0x532718
call fcn.00445350
test al, al
je 0x44ba44
lea ecx, [esp + 0x14f4]
push ecx
push ebx
call fcn.00478290
test eax, eax
jne 0x44ba20
lea ecx, [esp + 0x14f4]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44ba17
test dx, dx
je 0x44ba13
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44ba17
add eax, 4
add ecx, 4
test dx, dx
jne 0x44b9f1
xor eax, eax
jmp 0x44ba1c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44ba44
lea edx, [esp + 0x14f4]
push edx
mov ecx, ebp
call fcn.00448c50
push 0x50d
call fcn.004671c0
push eax
call fcn.0049a620
add esp, 4
jmp 0x44bab8
mov eax, 0x5327f0
call fcn.00446100
test al, al
je 0x44ba5e
push 0
mov ecx, 0x5229e0
call fcn.00413ed0
xor eax, eax
movzx ecx, word [esp + eax + 0x14f4]
mov word [eax + 0x5327f0], cx
add eax, 2
test cx, cx
jne 0x44ba60
jmp 0x44bab8
push 0x5327f0
push 0
lea esi, [ebp + 0x1a]
push esi
push 0
call fcn.00435ce0
test al, al
je 0x44ba95
mov dword [esp + 0x10], edi
jmp 0x44bab8
push 0x5327f0
push esi
push 0x207
call fcn.004671c0
push eax
call fcn.0049a620
add esp, 0xc
mov ecx, 0x508304
call fcn.0042cce0
mov eax, dword [0x51c8dc]
push 0x5327f0
push 0
push 0x8002
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x44b449
push 0x30
push 0x65
call fcn.004671c0
push eax
push 0x1f4
call fcn.004671c0
mov ecx, dword [0x51c8dc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x44b2f0.174
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x44bb94
sub eax, 0x10000
jne case.0x44b2f0.174
cmp dword [0x4d9268], 0xffffffff
jne 0x44bb52
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.00460ee0
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4d9268], eax
call fcn.00460ee0
mov dword [0x5327e8], eax
mov edx, dword [ebx + 0x2c]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x532718
call fcn.00445250
mov eax, dword [eax + 0x810]
test eax, 0x800
je 0x44bb7b
mov ecx, dword [0x4d9268]
mov dword [ebx + 0x30], ecx
test eax, 0x4000
je case.0x44b2f0.174
mov edx, dword [0x5327e8]
mov dword [ebx + 0x30], edx
jmp case.0x44b2f0.174
movzx eax, byte [0x5229d8]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x44b449
test byte [ebx + 0xc], 2
je case.0x44b2f0.174
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x5327cc]
jae case.0x44b2f0.174
push eax
mov ecx, 0x532718
call fcn.00445420
mov ebp, eax
mov ebx, 0x4401
call fcn.00444e60
cmp eax, 0x501
jb 0x44bbe7
cmp byte [0x51b789], 0
je 0x44bbec
mov ebx, 0x4411
push 0x400
lea eax, [esp + 0x1cf8]
push eax
call fcn.0048cf70
cmp byte [0x51b789], 0
mov esi, dword [ebp]
je 0x44bc2b
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44bc10
sub eax, edx
sar eax, 1
cmp eax, 0x101
ja 0x44bc68
jmp 0x44bca4
lea eax, [esp + 0x1cf4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44bc35
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, esi
lea edi, [eax + 2]
jmp 0x44bc50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44bc50
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, 0x101
jbe 0x44bcc2
push esi
or ebx, 0x10
call fcn.00456bb0
mov esi, eax
test esi, esi
je 0x44bc96
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44bc80
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x44bc9b
mov esi, str.dummy
cmp byte [0x51b789], 0
je 0x44bcc2
movzx ecx, word [esi]
push ecx
call fcn.00456170
test al, al
je 0x44bcc2
movzx edx, word [esi + 2]
add esi, 2
push edx
call fcn.00456170
test al, al
jne 0x44bcb1
mov ecx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 0x2b4
lea eax, [esp + 0x888]
push eax
push ecx
push esi
call edi
test eax, eax
setne al
test al, al
jne 0x44bd14
test bl, 0x10
jne 0x44bd97
mov eax, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea edx, [esp + 0x888]
push edx
push eax
push esi
call edi
test eax, eax
setne al
test al, al
je 0x44bd97
push 0xc8
lea ecx, [esp + 0xa98]
push ecx
lea edx, [esp + 0x136c]
push edx
call fcn.004709a0
cmp word [esp + 0x1364], 0
jne 0x44bd53
mov ecx, dword [ebp]
push 0xc8
lea eax, [esp + 0x1368]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00446070
movzx edx, byte [0x51b789]
mov esi, dword [esp + 0x14]
add edx, 2
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x1368]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push 0x1074
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x884]
mov dword [esi + 0x28], edx
jmp 0x44bd9b
mov esi, dword [esp + 0x14]
or dword [esi + 0xc], 0x1000
push 0x400
lea eax, [esp + 0xb38]
push eax
call fcn.0048cf70
lea ecx, [esp + 0xb34]
lea eax, [esp + 0x1cf4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44bde8
test dx, dx
je 0x44bde4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44bde8
add eax, 4
add ecx, 4
test dx, dx
jne 0x44bdc2
xor eax, eax
jmp 0x44bded
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.0x44b2f0.174
lea ecx, [esp + 0x1cf4]
push ecx
call fcn.0048cf50
jmp case.0x44b2f0.174
mov edx, dword [esp + 0x2cfc]
push ebx
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x44b44b