Function at 0x1400956ac
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x56c0
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x56b0], rax
mov rsi, qword [rsp + 0x5720]
mov r10, r9
mov eax, r8d
mov rdi, rdx
mov rbp, rcx
cmp r8d, 0x4e
jne 0x140096268
mov ecx, dword [rsi + 0x10]
xor ebx, ebx
mov rax, rbx
lea rdx, [0x14012ffa8]
cmp dword [rax + rdx], ecx
je 0x140095714
add rax, 4
cmp rax, 0x1c
jb 0x1400956fc
jmp 0x14009572c
mov rcx, qword [0x140158330]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x14009613e
je 0x140096137
cmp eax, 0xffffff4f
je 0x140095eff
cmp eax, 0xffffff50
je 0x140095a0a
cmp eax, 0xffffff51
je 0x140095915
cmp eax, 0xffffff65
je 0x1400957bc
cmp eax, 0xffffff8e
jne 0x1400961a1
lea rdx, str.SingleClick
lea rcx, str.FileList
xor r8d, r8d
call fcn.14009b870
cmp eax, ebx
je 0x1400961a1
mov rcx, rbp
call fcn.14008f2a0
cmp eax, ebx
je 0x1400961a1
call fcn.1400ee424
sub eax, dword [0x140183fa0]
cmp eax, 0x3e8
jle 0x1400961a1
jmp 0x140096194
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
mov r12w, ax
shr r12d, 0xf
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13w, ax
shr r13d, 0xf
and r13d, 1
cmp word [rsi + 0x18], 0x79
jne 0x140095816
cmp edi, ebx
jne 0x14009580e
cmp r12d, ebx
je 0x140095827
mov rcx, rbp
call fcn.1400921ec
cmp edi, ebx
jne 0x1400961a1
cmp r12d, ebx
jne 0x1400961a1
cmp r13d, ebx
jne 0x1400961a1
movzx ecx, word [rsi + 0x18]
sub ecx, 9
je 0x1400958e6
sub ecx, 4
je 0x1400958be
sub ecx, 0x13
je 0x1400958b1
sub ecx, 0xd
je 0x1400958b1
sub ecx, 0x43
je 0x140095893
sub ecx, 1
je 0x140095886
sub ecx, 2
je 0x140095875
cmp ecx, 1
jne 0x1400961a1
lea rcx, [0x140162bc0]
call fcn.140095078
jmp 0x1400961a1
lea rcx, [0x140158338]
call fcn.140075bf0
jmp 0x1400961a1
mov rcx, rbp
call fcn.14008f598
jmp 0x1400961a1
mov rcx, qword [0x140158330]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400961a1
mov rcx, rbp
call fcn.14009212c
jmp 0x1400961a1
call fcn.1400ee424
xor r8d, r8d
mov dl, 1
mov rcx, rbp
mov dword [0x140183fa0], eax
call fcn.1400951a4
call fcn.1400ee424
mov dword [0x140183fa0], eax
jmp 0x1400961a1
cmp qword [0x1401571d8], rbx
je 0x1400961a1
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbp + 0x50]
jne 0x1400961a1
mov rcx, qword [0x1401571d8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1400961a1
lea rcx, [0x140164e50]
call fcn.140078804
cmp dword [0x140157254], ebx
jne 0x1400959fb
cmp byte [rbp + 0x107a], bl
jne 0x1400959fb
cmp byte [0x1401561a5], bl
je 0x14009594e
test al, 0x40
jne 0x14009594e
cmp byte [rbp + 0x78], bl
je 0x1400959fb
cmp byte [rbp + 0x78], bl
je 0x14009595c
mov word [rbp + 0x7a], bx
jmp 0x1400961a1
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x1400959fb
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x1430]
lea rcx, [0x140182e90]
call fcn.14008e6b8
lea rcx, [rsp + 0x1430]
lea rsi, [rbp + 0x7a]
call fcn.140050ce0
mov r8d, 0x800
mov rcx, rsi
mov rdx, rax
call fcn.140065d2c
mov rcx, qword [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdi, [0x14010b030]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
jne 0x1400961a1
movabs rax, 1
jmp 0x140096279
mov word [0x140182fa0], bx
mov rdx, qword [rsi + 0x30]
mov word [rsp + 0x46b0], bx
cmp rdx, rbx
jne 0x140095a6c
cmp byte [rbp + 0x78], bl
je 0x1400961a1
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
lea r12, [0x140182fa0]
lea r9, [rsp + 0x30]
mov edi, 0x800
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140095acf
lea r12, [0x140182fa0]
mov edi, 0x800
mov rcx, r12
mov r8, rdi
call fcn.140065d2c
mov eax, dword [rsi + 0x40]
cmp rax, qword [0x140182f68]
jae 0x140095acf
mov r8, qword [rsi + 0x40]
lea rdx, [rsp + 0x1430]
lea rcx, [0x140182e90]
call fcn.14008e6b8
lea rdx, [rsp + 0x1430]
lea rcx, [rsp + 0x46b0]
mov r8, rdi
call fcn.140065d2c
lea rcx, [rsp + 0x46b0]
call fcn.140050ce0
mov word [rax], bx
cmp word [0x140182fa0], bx
je 0x1400961a1
cmp byte [rbp + 0x78], bl
je 0x140095c58
mov byte [rbp + 0x78], bl
cmp byte [0x1401561a5], bl
je 0x140095c16
lea rdx, [rsp + 0x36b0]
lea rcx, str.Rar_MD
xor r9d, r9d
mov r8, rdi
call fcn.1400b5d58
cmp al, bl
je 0x140095edf
lea r8, [rsp + 0x26b0]
lea rcx, [rsp + 0x36b0]
mov r9, rdi
mov rdx, r12
call fcn.140050520
lea rcx, [rsp + 0x26b0]
xor r8d, r8d
xor edx, edx
call fcn.140042a00
cmp eax, ebx
jne 0x140095bf7
xor ecx, ecx
call fcn.1400b156c
lea r13, [0x140164e50]
lea rdx, [0x140173f2a]
mov rcx, r13
mov r8, rdi
call fcn.140078534
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140174f30]
call fcn.1400661a4
lea rdx, [0x14016cb20]
mov r8, rdi
mov rcx, r13
mov dword [0x14016ec58], 2
mov dword [0x14016ec54], 2
mov byte [0x14016ecc0], bl
call fcn.140078514
lea rcx, [0x14016cb20]
mov r9, rdi
mov r8, r12
mov rdx, r12
call fcn.140050520
mov edx, dword [0x140164e54]
mov rcx, r13
mov dword [0x140170ec8], edx
xor edx, edx
call fcn.14007a38c
lea rcx, [rsp + 0x26b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x36b0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140095edf
mov ecx, 0x1f7
call fcn.14005fad0
lea rdx, [rsp + 0x26b0]
mov rcx, rax
call fcn.1400c5808
jmp 0x140095ed3
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14008eb24
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.140042a00
cmp eax, ebx
je 0x140095eb3
cmp word [0x140182fa0], bx
je 0x140095edf
mov ecx, 0x1f7
call fcn.14005fad0
mov rdx, r12
jmp 0x140095c09
mov rcx, rbp
cmp byte [0x1401561a5], bl
je 0x140095e82
lea rdx, [rsp + 0x1430]
mov qword [rsp + 0x24c0], rbx
call fcn.14008ff54
cmp al, bl
je 0x140095c94
lea rcx, [rbp + 0x7a]
lea rdx, [rsp + 0x1430]
mov r8, rdi
call fcn.140065d2c
xor ecx, ecx
call fcn.1400b156c
lea r13, [0x140164e50]
lea rdx, [0x140173f2a]
mov rcx, r13
mov r8, rdi
call fcn.140078534
mov edx, dword [0x140164e54]
lea rcx, str.FileList
mov dword [0x140170ec8], edx
lea rdx, str.FlatView
xor r8d, r8d
call fcn.14009b870
cmp eax, ebx
je 0x140095cf8
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x46b0]
add rcx, 2
mov word [rsp + rcx + 0x36ae], ax
cmp ax, bx
jne 0x140095cdd
jmp 0x140095d1b
lea rdx, [rsp + 0x36b0]
mov r8, rdi
mov rcx, r13
call fcn.140078514
lea rcx, [rsp + 0x36b0]
mov rdx, rdi
call fcn.1400504d4
lea rsi, [rbp + 0x7a]
lea rcx, [0x140174f30]
mov rdx, rsi
call fcn.1400661a4
lea rdx, [rsp + 0x36b0]
lea rcx, [rsp + 0x26b0]
mov r8, rdi
call fcn.140065d2c
lea rcx, [rsp + 0x26b0]
mov r8, rdi
mov rdx, r12
call fcn.140065dac
lea rcx, [0x140175210]
call fcn.14006617c
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140175210]
call fcn.1400661a4
lea rdx, [rsp + 0x26b0]
lea rcx, [0x140182e90]
xor r9d, r9d
xor r8d, r8d
call fcn.14008e4b4
cmp al, bl
je 0x140095df4
lea rdx, [rsp + 0x26b0]
mov rcx, rsi
call fcn.140068ca4
cmp eax, ebx
jne 0x140095dcd
lea rdx, [rsp + 0x26b0]
sub rdx, rsi
movzx eax, word [rsi]
movzx ecx, word [rsi + rdx]
sub eax, ecx
jne 0x140095dc9
add rsi, 2
test ecx, ecx
jne 0x140095db6
cmp eax, ebx
jne 0x140095df4
lea rdx, [rsp + 0x26b0]
mov rcx, rbp
call fcn.140092d68
mov ecx, 0x50d
call fcn.14005fad0
mov rcx, rax
call fcn.1400c5808
jmp 0x140095edf
mov ecx, 0x20
mov rbp, r12
cmp word [0x140182fa0], cx
jne 0x140095e0f
add rbp, 2
cmp word [rbp], cx
je 0x140095e05
cmp word [rbp], bx
je 0x140095e67
mov rdi, rbp
movzx edx, word [rdi]
lea rcx, str._____:
call fcn.1400ed378
cmp rax, rbx
jne 0x140095e67
add rdi, 2
cmp word [rdi], bx
jne 0x140095e18
lea rdi, [0x1401098d8]
mov rsi, rbp
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140095e67
lea rdi, [0x14010b030]
mov rsi, rbp
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140095e67
xor edx, edx
mov rcx, r13
call fcn.14007882c
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x26b0]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, bx
jne 0x140095e6a
jmp 0x140095edf
lea r8, [rbp + 0x7a]
lea rdx, [rbp + 0x7a]
mov r9, rdi
call fcn.14008eb24
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14008eb24
lea rcx, [rbp + 0x7a]
mov rdx, r12
call fcn.1400420d8
cmp al, bl
je 0x140095eba
mov ebx, 1
jmp 0x140095edf
mov ecx, 0x208
call fcn.14005fad0
lea rdx, [rbp + 0x7a]
mov r8, r12
mov rcx, rax
call fcn.1400c5808
lea rcx, [0x140149f00]
call fcn.14003c5cc
mov rcx, qword [0x140158330]
mov r9, r12
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rax, ebx
jmp 0x140096279
test byte [rsi + 0x18], 2
je 0x1400961a1
mov rdx, qword [rsi + 0x40]
cmp rdx, qword [0x140182f68]
jae 0x1400961a1
lea rcx, [0x140182e90]
call fcn.14008e564
mov r13d, 0x4401
mov r14, rax
call fcn.140044e3c
cmp eax, 0x501
jb 0x140095f43
cmp byte [0x1401561a5], bl
je 0x140095f49
mov r13d, 0x4411
mov r12, qword [r14]
cmp byte [0x1401561a5], bl
jne 0x140095f8f
mov edi, 0x800
lea rdx, [rsp + 0x36b0]
mov rcx, rbp
mov r8, rdi
call fcn.14008eaf0
mov rdx, qword [r14]
lea r8, [rsp + 0x46b0]
lea rcx, [rsp + 0x36b0]
mov r9, rdi
call fcn.140050520
lea r12, [rsp + 0x46b0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
ja 0x140095fb1
cmp word [r12], bx
jne 0x140095fe7
mov rcx, r12
or r13d, 0x10
call fcn.140050efc
mov r12, rax
cmp rax, rbx
je 0x140095fe0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
jbe 0x140095fe7
lea r12, str.dummy
cmp byte [0x1401561a5], bl
je 0x140096003
jmp 0x140095ff5
add r12, 2
movzx ecx, word [r12]
call fcn.140050458
cmp al, bl
jne 0x140095ff1
mov edx, dword [r14 + 0x20]
mov edi, 0x2b8
lea r8, [rsp + 0x1170]
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
jne 0x140096068
test r13b, 0x10
jne 0x140096130
mov edx, dword [r14 + 0x20]
lea r8, [rsp + 0x1170]
or r13d, 0x10
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
je 0x140096130
mov edi, 0xc8
lea rdx, [rsp + 0x1388]
lea rcx, [rsp + 0x2520]
mov r8, rdi
call fcn.140065d2c
mov edx, dword [r14 + 0x58]
cmp edx, ebx
jle 0x1400960d3
cmp edx, 2
jle 0x1400960b6
cmp edx, 3
je 0x1400960af
cmp edx, 4
je 0x1400960a8
cmp edx, 5
jne 0x1400960d3
mov ecx, 0x61b
jmp 0x1400960bb
mov ecx, 0x61a
jmp 0x1400960bb
mov ecx, 0x618
jmp 0x1400960bb
mov ecx, 0x619
call fcn.14005fad0
lea rcx, [rsp + 0x2520]
mov r8, rdi
mov rdx, rax
call fcn.140065d2c
cmp word [rsp + 0x2520], bx
jne 0x1400960f3
mov rdx, qword [r14]
lea r8, [rsp + 0x2520]
mov r9, rdi
mov rcx, rbp
call fcn.14008f5f0
movzx eax, byte [0x1401561a5]
movsxd r8, dword [rsi + 0x1c]
mov rcx, qword [rbp + 0x50]
add eax, 2
lea r9, [rsp + 0x30]
mov edx, 0x1074
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x2520]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x1178]
mov dword [rsi + 0x3c], edx
bts dword [rsi + 0x18], 0xc
jmp 0x1400961a1
call fcn.1400821a8
jmp 0x1400961a1
cmp eax, 0xffffff94
je 0x140096258
cmp eax, 0xfffffff4
je 0x1400961a8
cmp eax, 0xfffffffd
je 0x140096188
cmp eax, 0xffffffff
jne 0x1400961a1
mov ecx, 0x65
call fcn.14005fad0
mov ecx, 0x1f4
mov rdi, rax
call fcn.14005fad0
mov rcx, qword [0x140158330]
mov r9d, 0x30
mov r8, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400961a1
mov rcx, rbp
call fcn.14008f2a0
cmp eax, ebx
je 0x1400961a1
xor r8d, r8d
mov dl, 1
mov rcx, rbp
call fcn.1400951a4
xor eax, eax
jmp 0x140096279
mov eax, dword [rsi + 0x18]
sub eax, 1
je 0x140096247
cmp eax, 0x10000
jne 0x1400961a1
cmp dword [0x14012ffa0], 0xffffffff
jne 0x140096202
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xff0000
call fcn.14009b870
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xd9213
mov dword [0x14012ffa0], eax
call fcn.14009b870
mov dword [0x140182f98], eax
mov r8, qword [rsi + 0x48]
lea rdx, [rsp + 0x80]
lea rcx, [0x140182e90]
call fcn.14008e6b8
mov ecx, dword [rax + 0x1098]
bt ecx, 0xb
jae 0x14009622f
mov eax, dword [0x14012ffa0]
mov dword [rsi + 0x50], eax
bt ecx, 0xe
jae 0x1400961a1
mov eax, dword [0x140182f98]
mov dword [rsi + 0x50], eax
jmp 0x1400961a1
mov al, byte [0x140164e44]
neg al
sbb rax, rax
and rax, 0x20
jmp 0x140096279
mov edx, dword [rsi + 0x1c]
mov rcx, rbp
call fcn.140092b0c
jmp 0x1400961a1
mov r9, rsi
mov r8, r10
mov edx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x56b0]
xor rcx, rsp
call fcn.1400e9d00
add rsp, 0x56c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret