Function at 0x444db0
Capabilities:
Create directory
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
mov eax, 0x2d08
call fcn.004a4490
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x2d04], eax
mov eax, dword [esp + 0x2d0c]
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x2d14]
push esi
mov esi, dword [esp + 0x2d20]
mov dword [esp + 8], ebx
cmp ecx, 0x4e
jne 0x445845
mov ecx, dword [esi + 8]
push ebp
xor ebp, ebp
xor eax, eax
cmp dword [eax + 0x4c90fc], ecx
je 0x444e08
add eax, 4
cmp eax, 0x1c
jb 0x444df6
jmp 0x444e1b
mov eax, dword [0x4e8cd4]
push ebp
push ebp
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 8]
add eax, 0xb1
push edi
cmp eax, 0xb0
ja case.0x444e36.174
movzx ecx, byte [eax + 0x445888]
jmp dword [ecx*4 + 0x44585c]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx edi, ax
shr edi, 0xf
push 0x12
and edi, 1
call ebp
movzx ebx, ax
shr ebx, 0xf
push 0x11
and ebx, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [esi + 0xc], 0x79
jne 0x444e82
test edi, edi
jne 0x444e79
test ebx, ebx
je 0x444e92
mov ecx, dword [esp + 0x10]
call fcn.00441310
test edi, edi
jne case.0x444e36.174
test ebx, ebx
jne case.0x444e36.174
test ebp, ebp
jne case.0x444e36.174
movzx eax, word [esi + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x444e36.174
movzx edx, byte [eax + 0x44595c]
jmp dword [edx*4 + 0x44593c]
call fcn.004a4f95
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x4ff320], eax
call fcn.00444940
call fcn.004a4f95
mov dword [0x4ff320], eax
jmp case.0x444e36.174
mov ecx, dword [esp + 0x10]
call fcn.00441280
jmp case.0x444e36.174
mov eax, dword [0x4e8cd4]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x444e36.174
mov ecx, dword [esp + 0x10]
call fcn.0043faa0
jmp case.0x444e36.174
mov ecx, 0x4ee468
call fcn.00406dc0
jmp case.0x444e36.174
cmp byte [0x4e7b89], 0
mov ecx, 0x4ee478
je 0x444f38
call fcn.00443ef0
jmp case.0x444e36.174
call fcn.004434d0
jmp case.0x444e36.174
cmp dword [0x4e841c], 0
je case.0x444e36.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x444e36.174
mov edx, dword [0x4e841c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x444e36.174
push ebp
push str.SingleClick
push str.FileList
call fcn.0045b230
test eax, eax
je case.0x444e36.174
mov ecx, ebx
call fcn.0043f910
test eax, eax
je case.0x444e36.174
call fcn.004a4f95
sub eax, dword [0x4ff320]
cmp eax, 0x3e8
jle case.0x444e36.174
push ebp
push 1
mov ecx, ebx
call fcn.00444940
xor eax, eax
pop edi
pop ebp
mov ecx, dword [esp + 0x2d0c]
pop esi
pop ebx
xor ecx, esp
call fcn.004a3c63
add esp, 0x2d08
ret 0x10
mov ecx, ebx
call fcn.0043f910
test eax, eax
je case.0x444e36.174
jmp 0x444f96
call fcn.00423a90
jmp case.0x444e36.174
mov eax, dword [esi + 0x10]
push eax
mov ecx, ebx
call fcn.004444f0
jmp case.0x444e36.174
mov ecx, 0x4eeda0
call fcn.00411520
mov dword [esp + 0x14], edx
cmp dword [0x4e8434], ebp
jne 0x4450e3
cmp byte [ebx + 0x81a], 0
jne 0x4450e3
cmp byte [0x4e7b89], 0
je 0x445020
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x445020
cmp byte [ebx + 0x18], cl
je 0x4450e3
cmp byte [ebx + 0x18], 0
je 0x445031
xor ecx, ecx
mov word [ebx + 0x1a], cx
jmp case.0x444e36.174
mov ecx, dword [ebx]
mov edx, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x18]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], ebp
call edi
test eax, eax
je 0x4450e3
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x874]
push eax
mov ecx, 0x4fea48
call fcn.0043ecc0
push 0x400
lea ecx, [esp + 0x874]
push ecx
lea esi, [ebx + 0x1a]
call fcn.004515b0
push eax
push esi
call fcn.0046a270
mov edx, dword [ebx]
push ebp
push ebp
push 0x1018
push edx
call edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4b8bbc
mov edi, edi
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4450d6
cmp cx, bp
je 0x4450d2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4450d6
add esi, 4
add eax, 4
cmp cx, bp
jne 0x4450b0
xor eax, eax
jmp 0x4450db
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne case.0x444e36.174
mov eax, 1
jmp 0x444fa2
xor eax, eax
mov word [0x4feb20], ax
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov word [esp + 0x2514], cx
lea edi, [ecx + 1]
cmp eax, ebp
jne 0x44514b
cmp byte [ebx + 0x18], cl
je case.0x444e36.174
mov ecx, dword [ebx]
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x18]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x3c], 0x4feb20
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x28], edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4451a5
push 0x400
push eax
push 0x4feb20
call fcn.0046a270
mov esi, dword [esi + 0x2c]
cmp esi, dword [0x4feafc]
jae 0x4451a5
push esi
lea edx, [esp + 0x874]
push edx
mov ecx, 0x4fea48
call fcn.0043ecc0
push 0x400
lea eax, [esp + 0x874]
push eax
lea ecx, [esp + 0x251c]
push ecx
call fcn.0046a270
lea edx, [esp + 0x2514]
push edx
call fcn.004515b0
xor ecx, ecx
mov word [eax], cx
cmp word [0x4feb20], bp
je case.0x444e36.174
cmp byte [ebx + 0x18], 0
je 0x445346
mov byte [ebx + 0x18], 0
cmp byte [0x4e7b89], 0
je 0x44531e
lea edx, [esp + 0x870]
push edx
push str.Rar_MDXXXXXX
call fcn.00484a20
test al, al
je 0x44558b
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x870]
mov word [esp + eax + 0x1d14], cx
add eax, 2
cmp cx, bp
jne 0x4451f0
lea eax, [esp + 0x1d14]
push eax
call fcn.00451050
mov eax, 0x4feb20
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x445220
lea edi, [esp + 0x1d14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x445240
mov cx, word [edi + 2]
add edi, 2
cmp cx, bp
jne 0x445240
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
lea ecx, [esp + 0x1d18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4452fe
push ebp
call fcn.00480e80
push 0x400
push 0x4f701c
mov ecx, 0x4eeda0
call fcn.00412f80
mov ecx, dword [0x4f781c]
lea edx, [esp + 0x1d14]
push edx
call fcn.0046a8c0
mov eax, 2
push 0x400
push 0x4f38b8
mov ecx, 0x4eeda0
mov dword [0x4f45ec], eax
mov dword [0x4f45e8], eax
mov byte [0x4f4626], 0
call fcn.00412f60
mov eax, dword [0x4eefac]
push ebp
mov ecx, 0x4eeda0
mov dword [0x4f4fbc], eax
call fcn.00417040
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x1d14]
push ecx
call esi
lea edx, [esp + 0x870]
push edx
call esi
jmp 0x44558b
lea eax, [esp + 0x1d14]
push eax
push 0x1f7
call fcn.00460a30
push eax
call fcn.004926f0
add esp, 8
jmp 0x445581
push ebp
push 0x4feb20
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x445562
cmp word [0x4feb20], bp
je 0x44558b
push 0x4feb20
jmp 0x445306
cmp byte [0x4e7b89], 0
je 0x44554e
lea ecx, [esp + 0x1354]
push ecx
mov ecx, ebx
call fcn.00440290
test al, al
je 0x44537c
push 0x400
lea edx, [esp + 0x1358]
push edx
lea eax, [ebx + 0x1a]
push eax
call fcn.0046a270
push ebp
call fcn.00480e80
push 0x400
push 0x4f701c
mov ecx, 0x4eeda0
call fcn.00412f80
mov ecx, dword [0x4eefac]
push ebp
push 0x4b99c4
push str.FileList
mov dword [0x4f4fbc], ecx
call fcn.0045b230
test eax, eax
je 0x4453da
xor eax, eax
jmp 0x4453c0
movzx ecx, word [esp + eax + 0x2514]
mov word [esp + eax + 0x870], cx
add eax, 2
cmp cx, bp
jne 0x4453c0
jmp 0x4453fe
push 0x400
lea edx, [esp + 0x874]
push edx
mov ecx, 0x4eeda0
call fcn.00412f60
lea eax, [esp + 0x870]
push eax
call fcn.00451050
mov ecx, dword [0x4f781c]
lea ebp, [ebx + 0x1a]
push ebp
call fcn.0046a8c0
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x870]
mov word [esp + eax + 0x1d14], cx
add eax, 2
test cx, cx
jne 0x445410
mov eax, 0x4feb20
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445430
lea edi, [esp + 0x1d14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x445450
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x445450
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4f782c]
call fcn.0046a4c0
lea ecx, [esp + 0x1d14]
push ecx
mov ecx, dword [0x4f782c]
call fcn.0046a8c0
push 0
push 0
lea edx, [esp + 0x1d1c]
push edx
push 0
mov ecx, 0x4fea48
call fcn.0043edc0
test al, al
je 0x445514
lea eax, [esp + 0x1d14]
push eax
push ebp
call fcn.00472b40
test eax, eax
jne 0x4454f0
lea ecx, [esp + 0x1d14]
mov eax, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4454e7
test dx, dx
je 0x4454e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4454e7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4454c1
xor eax, eax
jmp 0x4454ec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x445514
lea ecx, [esp + 0x1d14]
push ecx
mov ecx, ebx
call fcn.00442660
push 0x50d
call fcn.00460a30
push eax
call fcn.004926f0
add esp, 4
jmp 0x44558b
cmp word [0x4feb20], 0
mov esi, 0x4feb20
je 0x445542
movzx eax, word [esi]
mov edx, dword [str._____:]
push eax
push edx
call fcn.004a4c00
add esp, 8
test eax, eax
jne 0x44558b
add esi, 2
cmp word [esi], ax
jne 0x445523
mov ecx, 0x4eeda0
call fcn.00413be0
jmp 0x44558b
push 0x4feb20
push ebp
lea esi, [ebx + 0x1a]
push esi
push ebp
call fcn.00431700
test al, al
je 0x445568
mov dword [esp + 0x10], edi
jmp 0x44558b
push 0x4feb20
push esi
push 0x207
call fcn.00460a30
push eax
call fcn.004926f0
add esp, 0xc
mov ecx, 0x4d56b4
call fcn.00428cd0
mov eax, dword [0x4e8cd4]
push 0x4feb20
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x444fa2
push 0x30
push 0x65
call fcn.00460a30
push eax
push 0x1f4
call fcn.00460a30
mov ecx, dword [0x4e8cd4]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x444e36.174
mov eax, dword [esi + 0xc]
sub eax, 1
je 0x445667
sub eax, 0x10000
jne case.0x444e36.174
cmp dword [0x4c90f4], 0xffffffff
jne 0x445625
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.0045b230
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4c90f4], eax
call fcn.0045b230
mov dword [0x4feb1c], eax
mov edx, dword [esi + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
mov ecx, 0x4fea48
call fcn.0043ecc0
mov eax, dword [eax + 0x810]
test eax, 0x800
je 0x44564e
mov ecx, dword [0x4c90f4]
mov dword [esi + 0x30], ecx
test eax, 0x4000
je case.0x444e36.174
mov edx, dword [0x4feb1c]
mov dword [esi + 0x30], edx
jmp case.0x444e36.174
movzx eax, byte [0x4eed98]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x444fa2
test byte [esi + 0xc], 2
je case.0x444e36.174
mov eax, dword [esi + 0x2c]
cmp eax, dword [0x4feafc]
jae case.0x444e36.174
push eax
mov ecx, 0x4fea48
call fcn.0043ee90
mov ebp, eax
mov ebx, 0x4401
call fcn.0043e920
cmp eax, 0x501
jb 0x4456ba
cmp byte [0x4e7b89], 0
je 0x4456bf
mov ebx, 0x4411
push 0x400
lea eax, [esp + 0x874]
push eax
call fcn.004850e0
cmp byte [0x4e7b89], 0
mov edi, dword [ebp]
je 0x445701
movzx ecx, word [edi]
push ecx
call fcn.00451020
test al, al
je 0x445701
lea ebx, [ebx]
movzx edx, word [edi + 2]
add edi, 2
push edx
call fcn.00451020
test al, al
jne 0x4456f0
mov ecx, dword [ebp + 0x18]
push ebx
push 0x2b4
lea eax, [esp + 0x10a8]
push eax
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne al
test al, al
jne 0x445755
test bl, 0x10
jne 0x4457d2
mov eax, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea edx, [esp + 0x10a8]
push edx
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne al
test al, al
je 0x4457d2
push 0xc8
lea ecx, [esp + 0x12b8]
push ecx
lea edx, [esp + 0x1b8c]
push edx
call fcn.0046a270
cmp word [esp + 0x1b84], 0
jne 0x445794
mov ecx, dword [ebp]
push 0xc8
lea eax, [esp + 0x1b88]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0043fae0
movzx edx, byte [0x4e7b89]
add edx, 2
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x1b88]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push 0x1074
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x10a4]
mov dword [esi + 0x28], edx
or dword [esi + 0xc], 0x1000
push 0x400
lea eax, [esp + 0x2518]
push eax
call fcn.004850e0
lea ecx, [esp + 0x2514]
lea eax, [esp + 0x870]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x445826
test dx, dx
je 0x445822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x445826
add eax, 4
add ecx, 4
test dx, dx
jne 0x445800
xor eax, eax
jmp 0x44582b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.0x444e36.174
lea ecx, [esp + 0x870]
push ecx
call fcn.004850c0
jmp case.0x444e36.174
mov edx, dword [esp + 0x2d1c]
push esi
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x444fa4