Function at 0x140095720
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x56c0
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x56b0], rax
mov rsi, qword [rsp + 0x5720]
mov r10, r9
mov eax, r8d
mov rdi, rdx
mov rbp, rcx
cmp r8d, 0x4e
jne 0x1400962cc
mov ecx, dword [rsi + 0x10]
xor ebx, ebx
mov rax, rbx
lea rdx, [0x14012ffa8]
cmp dword [rax + rdx], ecx
je 0x140095788
add rax, 4
cmp rax, 0x1c
jb 0x140095770
jmp 0x1400957a0
mov rcx, qword [0x140158350]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x1400961a3
je 0x14009619c
cmp eax, 0xffffff4f
je 0x140095f73
cmp eax, 0xffffff50
je 0x140095a7e
cmp eax, 0xffffff51
je 0x140095989
cmp eax, 0xffffff65
je 0x140095830
cmp eax, 0xffffff8e
jne 0x140096205
lea rdx, str.SingleClick
lea rcx, str.FileList
xor r8d, r8d
call fcn.14009b908
cmp eax, ebx
je 0x140096205
mov rcx, rbp
call fcn.14008f31c
cmp eax, ebx
je 0x140096205
call fcn.1400ee424
sub eax, dword [0x140183fc0]
cmp eax, 0x3e8
jle 0x140096205
jmp 0x1400961f8
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
mov r12w, ax
shr r12d, 0xf
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13w, ax
shr r13d, 0xf
and r13d, 1
cmp word [rsi + 0x18], 0x79
jne 0x14009588a
cmp edi, ebx
jne 0x140095882
cmp r12d, ebx
je 0x14009589b
mov rcx, rbp
call fcn.140092264
cmp edi, ebx
jne 0x140096205
cmp r12d, ebx
jne 0x140096205
cmp r13d, ebx
jne 0x140096205
movzx ecx, word [rsi + 0x18]
sub ecx, 9
je 0x14009595a
sub ecx, 4
je 0x140095932
sub ecx, 0x13
je 0x140095925
sub ecx, 0xd
je 0x140095925
sub ecx, 0x43
je 0x140095907
sub ecx, 1
je 0x1400958fa
sub ecx, 2
je 0x1400958e9
cmp ecx, 1
jne 0x140096205
lea rcx, [0x140162be0]
call fcn.1400950ec
jmp 0x140096205
lea rcx, [0x140162bd0]
call fcn.140075c5c
jmp 0x140096205
mov rcx, rbp
call fcn.14008f614
jmp 0x140096205
mov rcx, qword [0x140158350]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140096205
mov rcx, rbp
call fcn.1400921a4
jmp 0x140096205
call fcn.1400ee424
xor r8d, r8d
mov dl, 1
mov rcx, rbp
mov dword [0x140183fc0], eax
call fcn.140095218
call fcn.1400ee424
mov dword [0x140183fc0], eax
jmp 0x140096205
cmp qword [0x1401571f8], rbx
je 0x140096205
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbp + 0x50]
jne 0x140096205
mov rcx, qword [0x1401571f8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140096205
lea rcx, [0x140164e70]
call fcn.14007885c
cmp dword [0x140157274], ebx
jne 0x140095a6f
cmp byte [rbp + 0x107a], bl
jne 0x140095a6f
cmp byte [0x1401561c5], bl
je 0x1400959c2
test al, 0x40
jne 0x1400959c2
cmp byte [rbp + 0x78], bl
je 0x140095a6f
cmp byte [rbp + 0x78], bl
je 0x1400959d0
mov word [rbp + 0x7a], bx
jmp 0x140096205
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x140095a6f
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x1430]
lea rcx, [0x140182eb0]
call fcn.14008e734
lea rcx, [rsp + 0x1430]
lea rsi, [rbp + 0x7a]
call fcn.140050ce8
mov r8d, 0x800
mov rcx, rsi
mov rdx, rax
call fcn.140065d00
mov rcx, qword [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdi, [0x14010b030]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
jne 0x140096205
movabs rax, 1
jmp 0x1400962dd
mov word [0x140182fc0], bx
mov rdx, qword [rsi + 0x30]
mov word [rsp + 0x46b0], bx
cmp rdx, rbx
jne 0x140095ae0
cmp byte [rbp + 0x78], bl
je 0x140096205
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
lea r12, [0x140182fc0]
lea r9, [rsp + 0x30]
mov edi, 0x800
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140095b43
lea r12, [0x140182fc0]
mov edi, 0x800
mov rcx, r12
mov r8, rdi
call fcn.140065d00
mov eax, dword [rsi + 0x40]
cmp rax, qword [0x140182f88]
jae 0x140095b43
mov r8, qword [rsi + 0x40]
lea rdx, [rsp + 0x1430]
lea rcx, [0x140182eb0]
call fcn.14008e734
lea rdx, [rsp + 0x1430]
lea rcx, [rsp + 0x46b0]
mov r8, rdi
call fcn.140065d00
lea rcx, [rsp + 0x46b0]
call fcn.140050ce8
mov word [rax], bx
cmp word [0x140182fc0], bx
je 0x140096205
cmp byte [rbp + 0x78], bl
je 0x140095ccc
mov byte [rbp + 0x78], bl
cmp byte [0x1401561c5], bl
je 0x140095c8a
lea rdx, [rsp + 0x36b0]
lea rcx, str.Rar_MD
xor r9d, r9d
mov r8, rdi
call fcn.1400b5d70
cmp al, bl
je 0x140095f53
lea r8, [rsp + 0x26b0]
lea rcx, [rsp + 0x36b0]
mov r9, rdi
mov rdx, r12
call fcn.140050528
lea rcx, [rsp + 0x26b0]
xor r8d, r8d
xor edx, edx
call fcn.140042a08
cmp eax, ebx
jne 0x140095c6b
xor ecx, ecx
call fcn.1400b1614
lea r13, [0x140164e70]
lea rdx, [0x140173f4a]
mov rcx, r13
mov r8, rdi
call fcn.14007858c
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140174f50]
call fcn.140066178
lea rdx, [0x14016cb40]
mov r8, rdi
mov rcx, r13
mov dword [0x14016ec78], 2
mov dword [0x14016ec74], 2
mov byte [0x14016ece0], bl
call fcn.14007856c
lea rcx, [0x14016cb40]
mov r9, rdi
mov r8, r12
mov rdx, r12
call fcn.140050528
mov edx, dword [0x140164e74]
mov rcx, r13
mov dword [0x140170ee8], edx
xor edx, edx
call fcn.14007a3e4
lea rcx, [rsp + 0x26b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x36b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140095f53
mov ecx, 0x1f7
call fcn.14005fad8
lea rdx, [rsp + 0x26b0]
mov rcx, rax
call fcn.1400c5814
jmp 0x140095f47
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14008eba0
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.140042a08
cmp eax, ebx
je 0x140095f27
cmp word [0x140182fc0], bx
je 0x140095f53
mov ecx, 0x1f7
call fcn.14005fad8
mov rdx, r12
jmp 0x140095c7d
mov rcx, rbp
cmp byte [0x1401561c5], bl
je 0x140095ef6
lea rdx, [rsp + 0x1430]
mov qword [rsp + 0x24c0], rbx
call fcn.14008ffd0
cmp al, bl
je 0x140095d08
lea rcx, [rbp + 0x7a]
lea rdx, [rsp + 0x1430]
mov r8, rdi
call fcn.140065d00
xor ecx, ecx
call fcn.1400b1614
lea r13, [0x140164e70]
lea rdx, [0x140173f4a]
mov rcx, r13
mov r8, rdi
call fcn.14007858c
mov edx, dword [0x140164e74]
lea rcx, str.FileList
mov dword [0x140170ee8], edx
lea rdx, str.FlatView
xor r8d, r8d
call fcn.14009b908
cmp eax, ebx
je 0x140095d6c
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x46b0]
add rcx, 2
mov word [rsp + rcx + 0x36ae], ax
cmp ax, bx
jne 0x140095d51
jmp 0x140095d8f
lea rdx, [rsp + 0x36b0]
mov r8, rdi
mov rcx, r13
call fcn.14007856c
lea rcx, [rsp + 0x36b0]
mov rdx, rdi
call fcn.1400504dc
lea rsi, [rbp + 0x7a]
lea rcx, [0x140174f50]
mov rdx, rsi
call fcn.140066178
lea rdx, [rsp + 0x36b0]
lea rcx, [rsp + 0x26b0]
mov r8, rdi
call fcn.140065d00
lea rcx, [rsp + 0x26b0]
mov r8, rdi
mov rdx, r12
call fcn.140065d80
lea rcx, [0x140175230]
call fcn.140066150
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140175230]
call fcn.140066178
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140182eb0]
xor r9d, r9d
xor r8d, r8d
call fcn.14008e530
cmp al, bl
je 0x140095e68
lea rdx, [rsp + 0x26b0]
mov rcx, rsi
call fcn.140068d30
cmp eax, ebx
jne 0x140095e41
lea rdx, [rsp + 0x26b0]
sub rdx, rsi
movzx eax, word [rsi]
movzx ecx, word [rsi + rdx]
sub eax, ecx
jne 0x140095e3d
add rsi, 2
test ecx, ecx
jne 0x140095e2a
cmp eax, ebx
jne 0x140095e68
lea rdx, [rsp + 0x26b0]
mov rcx, rbp
call fcn.140092de0
mov ecx, 0x50d
call fcn.14005fad8
mov rcx, rax
call fcn.1400c5814
jmp 0x140095f53
mov ecx, 0x20
mov rbp, r12
cmp word [0x140182fc0], cx
jne 0x140095e83
add rbp, 2
cmp word [rbp], cx
je 0x140095e79
cmp word [rbp], bx
je 0x140095edb
mov rdi, rbp
movzx edx, word [rdi]
lea rcx, str._____:
call fcn.1400ed378
cmp rax, rbx
jne 0x140095edb
add rdi, 2
cmp word [rdi], bx
jne 0x140095e8c
lea rdi, [0x140109750]
mov rsi, rbp
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140095edb
lea rdi, [0x14010b030]
mov rsi, rbp
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140095edb
xor edx, edx
mov rcx, r13
call fcn.140078884
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x26b0]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, bx
jne 0x140095ede
jmp 0x140095f53
lea r8, [rbp + 0x7a]
lea rdx, [rbp + 0x7a]
mov r9, rdi
call fcn.14008eba0
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14008eba0
lea rcx, [rbp + 0x7a]
mov rdx, r12
call fcn.1400420e0
cmp al, bl
je 0x140095f2e
mov ebx, 1
jmp 0x140095f53
mov ecx, 0x208
call fcn.14005fad8
lea rdx, [rbp + 0x7a]
mov r8, r12
mov rcx, rax
call fcn.1400c5814
lea rcx, [0x140149f20]
call fcn.14003c59c
mov rcx, qword [0x140158350]
mov r9, r12
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rax, ebx
jmp 0x1400962dd
test byte [rsi + 0x18], 3
je 0x140096205
mov rdx, qword [rsi + 0x40]
cmp rdx, qword [0x140182f88]
jae 0x140096205
lea rcx, [0x140182eb0]
call fcn.14008e5e0
mov cl, byte [0x1401561c5]
mov r14, rax
mov eax, 0x4411
cmp cl, bl
mov r12, qword [r14]
lea r13d, [rax - 0x10]
cmovne r13d, eax
cmp cl, bl
jne 0x140095ff4
mov edi, 0x800
lea rdx, [rsp + 0x36b0]
mov rcx, rbp
mov r8, rdi
call fcn.14008eb6c
mov rdx, qword [r14]
lea r8, [rsp + 0x46b0]
lea rcx, [rsp + 0x36b0]
mov r9, rdi
call fcn.140050528
lea r12, [rsp + 0x46b0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
ja 0x140096016
cmp word [r12], bx
jne 0x14009604c
mov rcx, r12
or r13d, 0x10
call fcn.140050f04
mov r12, rax
cmp rax, rbx
je 0x140096045
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
jbe 0x14009604c
lea r12, str.dummy
cmp byte [0x1401561c5], bl
je 0x140096068
jmp 0x14009605a
add r12, 2
movzx ecx, word [r12]
call fcn.140050460
cmp al, bl
jne 0x140096056
mov edx, dword [r14 + 0x20]
mov edi, 0x2b8
lea r8, [rsp + 0x1170]
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
jne 0x1400960cd
test r13b, 0x10
jne 0x140096195
mov edx, dword [r14 + 0x20]
lea r8, [rsp + 0x1170]
or r13d, 0x10
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
je 0x140096195
mov edi, 0xc8
lea rdx, [rsp + 0x1388]
lea rcx, [rsp + 0x2520]
mov r8, rdi
call fcn.140065d00
mov edx, dword [r14 + 0x58]
cmp edx, ebx
jle 0x140096138
cmp edx, 2
jle 0x14009611b
cmp edx, 3
je 0x140096114
cmp edx, 4
je 0x14009610d
cmp edx, 5
jne 0x140096138
mov ecx, 0x61b
jmp 0x140096120
mov ecx, 0x61a
jmp 0x140096120
mov ecx, 0x618
jmp 0x140096120
mov ecx, 0x619
call fcn.14005fad8
lea rcx, [rsp + 0x2520]
mov r8, rdi
mov rdx, rax
call fcn.140065d00
cmp word [rsp + 0x2520], bx
jne 0x140096158
mov rdx, qword [r14]
lea r8, [rsp + 0x2520]
mov r9, rdi
mov rcx, rbp
call fcn.14008f66c
movzx eax, byte [0x1401561c5]
movsxd r8, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
add eax, 2
lea r9, [rsp + 0x30]
mov edx, 0x1074
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x2520]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x1178]
mov dword [rsi + 0x3c], edx
bts dword [rsi + 0x18], 0xc
jmp 0x140096205
call fcn.1400821fc
jmp 0x140096205
cmp eax, 0xffffff94
je 0x1400962bc
cmp eax, 0xfffffff4
je 0x14009620c
cmp eax, 0xfffffffd
je 0x1400961ec
cmp eax, 0xffffffff
jne 0x140096205
mov ecx, 0x65
call fcn.14005fad8
mov ecx, 0x1f4
mov rdi, rax
call fcn.14005fad8
mov rcx, qword [0x140158350]
mov r9d, 0x30
mov r8, rdi
mov rdx, rax
call fcn.1400b6df8
jmp 0x140096205
mov rcx, rbp
call fcn.14008f31c
cmp eax, ebx
je 0x140096205
xor r8d, r8d
mov dl, 1
mov rcx, rbp
call fcn.140095218
xor eax, eax
jmp 0x1400962dd
mov eax, dword [rsi + 0x18]
sub eax, 1
je 0x1400962ab
cmp eax, 0x10000
jne 0x140096205
cmp dword [0x14012ffa0], 0xffffffff
jne 0x140096266
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xff0000
call fcn.14009b908
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xd9213
mov dword [0x14012ffa0], eax
call fcn.14009b908
mov dword [0x140182fb8], eax
mov r8, qword [rsi + 0x48]
lea rdx, [rsp + 0x80]
lea rcx, [0x140182eb0]
call fcn.14008e734
mov ecx, dword [rax + 0x1098]
bt ecx, 0xb
jae 0x140096293
mov eax, dword [0x14012ffa0]
mov dword [rsi + 0x50], eax
bt ecx, 0xe
jae 0x140096205
mov eax, dword [0x140182fb8]
mov dword [rsi + 0x50], eax
jmp 0x140096205
mov al, byte [0x140164e64]
neg al
sbb rax, rax
and rax, 0x20
jmp 0x1400962dd
mov edx, dword [rsi + 0x1c]
mov rcx, rbp
call fcn.140092b84
jmp 0x140096205
mov r9, rsi
mov r8, r10
mov edx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x56b0]
xor rcx, rsp
call fcn.1400e9d80
add rsp, 0x56c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret