Function at 0x493af0
Capabilities:
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
mov eax, 0x5658
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x5654], eax
mov eax, dword [esp + 0x565c]
push ebx
mov ebx, dword [esp + 0x566c]
push edi
mov edi, ecx
mov ecx, dword [esp + 0x5668]
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebx
cmp ecx, 0x4e
jne 0x4945ee
mov ecx, dword [ebx + 8]
push ebp
xor ebp, ebp
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x513c14], ecx
je 0x493b52
add eax, 4
cmp eax, 0x1c
jb 0x493b40
jmp 0x493b65
mov eax, dword [0x53a464]
push ebp
push ebp
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push esi
cmp eax, 0xb0
ja case.0x493b80.174
movzx ecx, byte [eax + 0x494630]
jmp dword [ecx*4 + 0x494604]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebp
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [ebx + 0xc], 0x79
jne 0x493bcc
test esi, esi
jne 0x493bc3
test edi, edi
je 0x493bdc
mov ecx, dword [esp + 0x10]
call fcn.00490c20
test esi, esi
jne case.0x493b80.174
test edi, edi
jne case.0x493b80.174
test ebp, ebp
jne case.0x493b80.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x493b80.174
movzx edx, byte [eax + 0x494704]
jmp dword [edx*4 + 0x4946e4]
call fcn.004e6fda
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x565958], eax
call fcn.00493680
call fcn.004e6fda
mov dword [0x565958], eax
jmp case.0x493b80.174
mov ecx, dword [esp + 0x10]
call fcn.00490b90
jmp case.0x493b80.174
mov eax, dword [0x53a464]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x493b80.174
mov ecx, dword [esp + 0x10]
call fcn.0048e390
jmp case.0x493b80.174
mov ecx, 0x544c88
call fcn.00476970
jmp case.0x493b80.174
mov ecx, 0x544c98
call fcn.00493570
jmp case.0x493b80.174
cmp dword [0x5393a4], 0
je case.0x493b80.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x493b80.174
mov edx, dword [0x5393a4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x493b80.174
push ebp
push str.SingleClick
push str.FileList
call fcn.00499a90
test eax, eax
je case.0x493b80.174
mov ecx, edi
call fcn.0048e0f0
test eax, eax
je case.0x493b80.174
call fcn.004e6fda
sub eax, dword [0x565958]
cmp eax, 0x3e8
jle case.0x493b80.174
push ebp
push 1
mov ecx, edi
call fcn.00493680
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x565c]
pop edi
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x5658
ret 0x10
mov ecx, edi
call fcn.0048e0f0
test eax, eax
je case.0x493b80.174
jmp 0x493ccd
call fcn.00482570
jmp case.0x493b80.174
mov eax, dword [ebx + 0x10]
push eax
mov ecx, edi
call fcn.004913f0
jmp case.0x493b80.174
mov ecx, 0x546dc0
call fcn.00479420
mov dword [esp + 0x18], edx
cmp dword [0x5393bc], ebp
jne 0x493e18
cmp byte [edi + 0x101a], 0
jne 0x493e18
cmp byte [0x538309], 0
je 0x493d57
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x493d57
cmp byte [edi + 0x18], cl
je 0x493e18
cmp byte [edi + 0x18], 0
je 0x493d68
xor ecx, ecx
mov word [edi + 0x1a], cx
jmp case.0x493b80.174
mov edx, dword [ebx + 0x10]
mov ecx, dword [edi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebp
call ebx
test eax, eax
je 0x493e18
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x13f0]
push eax
mov ecx, 0x5648c8
call fcn.0048d4f0
push 0x800
lea ecx, [esp + 0x13f0]
push ecx
lea esi, [edi + 0x1a]
call fcn.00451a10
push eax
push esi
call fcn.00467570
mov edx, dword [edi]
push ebp
push ebp
push 0x1018
push edx
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4fe470
mov cx, word [esi]
cmp cx, word [eax]
jne 0x493e0b
cmp cx, bp
je 0x493e07
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x493e0b
add esi, 4
add eax, 4
cmp cx, bp
jne 0x493de5
xor eax, eax
jmp 0x493e10
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne case.0x493b80.174
mov eax, 1
jmp 0x493cd9
xor eax, eax
mov word [0x564958], ax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov word [esp + 0x4664], cx
lea esi, [ecx + 1]
cmp eax, ebp
jne 0x493e80
cmp byte [edi + 0x18], cl
je case.0x493b80.174
mov ecx, dword [edi]
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], 0x564958
mov dword [esp + 0x44], 0x800
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x493eda
push 0x800
push eax
push 0x564958
call fcn.00467570
mov ebx, dword [ebx + 0x2c]
cmp ebx, dword [0x564934]
jae 0x493eda
push ebx
lea edx, [esp + 0x13f0]
push edx
mov ecx, 0x5648c8
call fcn.0048d4f0
push 0x800
lea eax, [esp + 0x13f0]
push eax
lea ecx, [esp + 0x466c]
push ecx
call fcn.00467570
lea edx, [esp + 0x4664]
push edx
call fcn.00451a10
xor ecx, ecx
mov word [eax], cx
cmp word [0x564958], bp
je case.0x493b80.174
cmp byte [edi + 0x18], 0
je 0x494060
mov byte [edi + 0x18], 0
cmp byte [0x538309], 0
je 0x49401d
push ebp
push 0x800
lea edx, [esp + 0x366c]
push edx
push str.Rar_MD
call fcn.004b1590
test al, al
je 0x4942aa
push 0x800
lea eax, [esp + 0x2668]
push eax
push 0x564958
lea ecx, [esp + 0x3670]
push ecx
call fcn.00451550
push ebp
push ebp
lea edx, [esp + 0x266c]
push edx
call fcn.00443ff0
test eax, eax
jne 0x493ffd
push ebp
call fcn.004ad5d0
push 0x800
push 0x555ba2
mov ecx, 0x546dc0
call fcn.004790c0
lea eax, [esp + 0x2664]
push eax
mov ecx, 0x556ba4
call fcn.00467940
mov eax, 2
push 0x800
push 0x54e7bc
mov ecx, 0x546dc0
mov dword [0x5508f4], eax
mov dword [0x5508f0], eax
mov byte [0x550948], 0
call fcn.004790a0
push 0x800
push 0x564958
push 0x564958
push 0x54e7bc
call fcn.00451550
mov ecx, dword [0x546dc4]
mov dword [0x552b50], ecx
push ebp
mov ecx, 0x546dc0
call fcn.0047afe0
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x2664]
push edx
call esi
lea eax, [esp + 0x3664]
push eax
call esi
jmp 0x4942aa
lea ecx, [esp + 0x2664]
push ecx
push 0x1f7
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 8
jmp 0x4942a0
push 0x800
push 0x564958
push 0x564958
mov ecx, edi
call fcn.0048d930
push ebp
push ebp
push 0x564958
call fcn.00443ff0
test eax, eax
jne 0x49404c
mov dword [esp + 0x10], esi
jmp 0x4942aa
cmp word [0x564958], bp
je 0x4942aa
push 0x564958
jmp 0x494005
cmp byte [0x538309], 0
mov ecx, edi
je 0x494249
lea edx, [esp + 0x13ec]
push edx
mov dword [esp + 0x2480], ebp
mov dword [esp + 0x2484], ebp
call fcn.0048ed30
test al, al
je 0x4940a4
push 0x800
lea eax, [esp + 0x13f0]
push eax
lea ecx, [edi + 0x1a]
push ecx
call fcn.00467570
push ebp
call fcn.004ad5d0
push 0x800
push 0x555ba2
mov ecx, 0x546dc0
call fcn.004790c0
mov edx, dword [0x546dc4]
push ebp
push str.FlatView
push str.FileList
mov dword [0x552b50], edx
call fcn.00499a90
test eax, eax
je 0x4940fa
xor eax, eax
movzx ecx, word [esp + eax + 0x4664]
mov word [esp + eax + 0x3664], cx
add eax, 2
cmp cx, bp
jne 0x4940e0
jmp 0x494123
push 0x800
lea eax, [esp + 0x3668]
push eax
mov ecx, 0x546dc0
call fcn.004790a0
push 0x800
lea ecx, [esp + 0x3668]
push ecx
call fcn.00451500
lea esi, [edi + 0x1a]
push esi
mov ecx, 0x556ba4
call fcn.00467940
push 0x800
lea edx, [esp + 0x3668]
push edx
lea eax, [esp + 0x266c]
push eax
call fcn.00467570
push 0x800
push 0x564958
lea ecx, [esp + 0x266c]
push ecx
call fcn.004675f0
mov ecx, 0x556d14
call fcn.00467910
lea edx, [esp + 0x2664]
push edx
mov ecx, 0x556d14
call fcn.00467940
push ebp
push ebp
lea eax, [esp + 0x266c]
push eax
mov ecx, 0x5648c8
call fcn.0048d350
test al, al
je 0x494207
lea ecx, [esp + 0x2664]
push ecx
push esi
call fcn.0046a940
test eax, eax
jne 0x4941e0
lea ecx, [esp + 0x2664]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4941d7
cmp dx, bp
je 0x4941d3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4941d7
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x4941b1
xor eax, eax
jmp 0x4941dc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x494207
lea edx, [esp + 0x2664]
push edx
mov ecx, edi
call fcn.00491620
push 0x50d
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 4
jmp 0x4942aa
mov eax, 0x564958
call fcn.0048e460
test al, al
je 0x494220
push ebp
mov ecx, 0x546dc0
call fcn.00479440
xor eax, eax
jmp 0x494230
movzx ecx, word [esp + eax + 0x2664]
mov word [eax + 0x564958], cx
add eax, 2
cmp cx, bp
jne 0x494230
jmp 0x4942aa
push 0x800
lea esi, [edi + 0x1a]
push esi
push esi
call fcn.0048d930
push 0x800
push 0x564958
push 0x564958
mov ecx, edi
call fcn.0048d930
push 0x564958
push esi
call fcn.00443870
test al, al
je 0x494287
mov dword [esp + 0x10], 1
jmp 0x4942aa
push 0x564958
push esi
push 0x208
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 0xc
mov ecx, 0x52c138
call fcn.0043dd70
mov eax, dword [0x53a464]
push 0x564958
push ebp
push 0x8002
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x493cd9
push 0x30
push 0x65
call fcn.00461b20
push eax
push 0x1f4
call fcn.00461b20
mov ecx, dword [0x53a464]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x493b80.174
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x494385
sub eax, 0x10000
jne case.0x493b80.174
cmp dword [0x513c10], 0xffffffff
jne 0x494343
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.00499a90
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x513c10], eax
call fcn.00499a90
mov dword [0x564954], eax
mov edx, dword [ebx + 0x2c]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x5648c8
call fcn.0048d4f0
mov eax, dword [eax + 0x1098]
test eax, 0x800
je 0x49436c
mov ecx, dword [0x513c10]
mov dword [ebx + 0x30], ecx
test eax, 0x4000
je case.0x493b80.174
mov edx, dword [0x564954]
mov dword [ebx + 0x30], edx
jmp case.0x493b80.174
movzx eax, byte [0x546db8]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x493cd9
test byte [ebx + 0xc], 2
je case.0x493b80.174
mov ebx, dword [ebx + 0x2c]
cmp ebx, dword [0x564934]
jae case.0x493b80.174
push ebx
mov ecx, 0x5648c8
call fcn.0048d3c0
mov ebp, eax
mov ebx, 0x4401
call fcn.00446760
cmp eax, 0x501
jb 0x4943d8
cmp byte [0x538309], 0
je 0x4943dd
mov ebx, 0x4411
cmp byte [0x538309], 0
mov esi, dword [ebp]
jne 0x494422
push 0x800
lea eax, [esp + 0x3668]
push eax
mov ecx, edi
call fcn.0048d900
mov edx, dword [ebp]
push 0x800
lea ecx, [esp + 0x4668]
push ecx
push edx
lea eax, [esp + 0x3670]
push eax
call fcn.00451550
lea esi, [esp + 0x4664]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494427
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x49446b
push esi
or ebx, 0x10
call fcn.00451c10
mov esi, eax
test esi, esi
je 0x494466
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494450
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x49446b
mov esi, str.dummy
cmp byte [0x538309], 0
je 0x494492
movzx ecx, word [esi]
push ecx
call fcn.004514d0
test al, al
je 0x494492
movzx edx, word [esi + 2]
add esi, 2
push edx
call fcn.004514d0
test al, al
jne 0x494481
mov ecx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 0x2b4
lea eax, [esp + 0x1140]
push eax
push ecx
push esi
call edi
test eax, eax
setne al
test al, al
jne 0x4944e4
test bl, 0x10
jne 0x4945de
mov eax, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea edx, [esp + 0x1140]
push edx
push eax
push esi
call edi
test eax, eax
setne al
test al, al
je 0x4945de
push 0xc8
lea ecx, [esp + 0x1350]
push ecx
lea edx, [esp + 0x24dc]
push edx
call fcn.00467570
mov eax, dword [ebp + 0x50]
dec eax
cmp eax, 4
ja case.default.0x494507
jmp dword [eax*4 + 0x494770]
push 0xc8
push 0x618
jmp 0x494558
push 0xc8
push 0x619
call fcn.00461b20
push eax
lea ecx, [esp + 0x24dc]
push ecx
jmp 0x494566
push 0xc8
push 0x61a
call fcn.00461b20
push eax
lea edx, [esp + 0x24dc]
push edx
jmp 0x494566
push 0xc8
push 0x61b
call fcn.00461b20
push eax
lea eax, [esp + 0x24dc]
push eax
call fcn.00467570
cmp word [esp + 0x24d4], 0
jne 0x494590
mov edx, dword [ebp]
push 0xc8
lea ecx, [esp + 0x24d8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.0048e3d0
movzx eax, byte [0x538309]
mov esi, dword [esp + 0x14]
add eax, 2
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x24d8]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
push 0x1074
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x113c]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
jmp case.0x493b80.174
mov esi, dword [esp + 0x14]
or dword [esi + 0xc], 0x1000
jmp case.0x493b80.174
mov edx, dword [esp + 0x566c]
push ebx
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x493cdb