Function at 0x444cbd
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2d08
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x2d04], eax
mov eax, dword [esp + 0x2d0c]
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x2d14]
push esi
mov esi, dword [esp + 0x2d20]
mov dword [esp + 8], ebx
cmp ecx, 0x4e
jne 0x4456b5
mov ecx, dword [esi + 8]
push edi
xor edi, edi
xor eax, eax
cmp dword [eax + 0x4c90fc], ecx
je 0x444c88
add eax, 4
cmp eax, 0x1c
jb 0x444c76
jmp 0x444c9b
mov eax, dword [0x4e8cd4]
push edi
push edi
push 0x400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 8]
add eax, 0xb1
push ebp
cmp eax, 0xb0
ja case.0x444cb6.174
movzx ecx, byte [eax + 0x4456f8]
jmp dword [ecx*4 + 0x4456cc]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx edi, ax
shr edi, 0xf
push 0x12
and edi, 1
call ebp
movzx ebx, ax
shr ebx, 0xf
push 0x11
and ebx, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [esi + 0xc], 0x79
jne 0x444d02
test edi, edi
jne 0x444cf9
test ebx, ebx
je 0x444d12
mov ecx, dword [esp + 0x10]
call fcn.00441180
test edi, edi
jne case.0x444cb6.174
test ebx, ebx
jne case.0x444cb6.174
test ebp, ebp
jne case.0x444cb6.174
movzx eax, word [esi + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x444cb6.174
movzx edx, byte [eax + 0x4457cc]
jmp dword [edx*4 + 0x4457ac]
call fcn.004a4d25
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x4ff318], eax
call fcn.004447c0
call fcn.004a4d25
mov dword [0x4ff318], eax
jmp case.0x444cb6.174
mov ecx, dword [esp + 0x10]
call fcn.004410f0
jmp case.0x444cb6.174
mov eax, dword [0x4e8cd4]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x444cb6.174
mov ecx, dword [esp + 0x10]
call fcn.0043f920
jmp case.0x444cb6.174
mov ecx, 0x4ee468
call fcn.00406ce0
jmp case.0x444cb6.174
cmp byte [0x4e7b89], 0
mov ecx, 0x4ee478
je 0x444db8
call fcn.00443d80
jmp case.0x444cb6.174
call fcn.00443360
jmp case.0x444cb6.174
cmp dword [0x4e841c], 0
je case.0x444cb6.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x444cb6.174
mov edx, dword [0x4e841c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x444cb6.174
push edi
push str.SingleClick
push 0x4b8cc0
call fcn.0045afb0
test eax, eax
je case.0x444cb6.174
mov ecx, ebx
call fcn.0043f790
test eax, eax
je case.0x444cb6.174
call fcn.004a4d25
sub eax, dword [0x4ff318]
cmp eax, 0x3e8
jle case.0x444cb6.174
push edi
push 1
mov ecx, ebx
call fcn.004447c0
xor eax, eax
pop ebp
pop edi
mov ecx, dword [esp + 0x2d0c]
pop esi
pop ebx
xor ecx, esp
call fcn.004a39f3
add esp, 0x2d08
ret 0x10
mov ecx, ebx
call fcn.0043f790
test eax, eax
je case.0x444cb6.174
jmp 0x444e16
call fcn.00423a20
jmp case.0x444cb6.174
mov eax, dword [esi + 0x10]
push eax
mov ecx, ebx
call fcn.00444390
jmp case.0x444cb6.174
mov ecx, 0x4eeda0
call fcn.00411430
mov dword [esp + 0x14], edx
cmp dword [0x4e8434], edi
jne 0x444f63
cmp byte [ebx + 0x81a], 0
jne 0x444f63
cmp byte [0x4e7b89], 0
je 0x444ea0
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x444ea0
cmp byte [ebx + 0x18], cl
je 0x444f63
cmp byte [ebx + 0x18], 0
je 0x444eb1
xor ecx, ecx
mov word [ebx + 0x1a], cx
jmp case.0x444cb6.174
mov ecx, dword [ebx]
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x18]
push eax
push edi
push 0x104b
mov dword [esp + 0x2c], edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ecx
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], edx
call edi
test eax, eax
je 0x444f63
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x874]
push eax
mov ecx, 0x4fea40
call fcn.0043eb40
push 0x400
lea ecx, [esp + 0x874]
push ecx
lea esi, [ebx + 0x1a]
call fcn.004513d0
push eax
push esi
call fcn.00469f80
mov edx, dword [ebx]
push 0
push 0
push 0x1018
push edx
call edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4b8bac
mov cx, word [esi]
cmp cx, word [eax]
jne 0x444f56
test cx, cx
je 0x444f52
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x444f56
add esi, 4
add eax, 4
test cx, cx
jne 0x444f30
xor eax, eax
jmp 0x444f5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x444cb6.174
mov eax, 1
jmp 0x444e22
xor eax, eax
mov word [0x4feb18], ax
mov eax, dword [esi + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], edi
mov word [esp + 0x2514], cx
lea ebp, [ecx + 1]
cmp eax, edi
jne 0x444fcb
cmp byte [ebx + 0x18], cl
je case.0x444cb6.174
mov ecx, dword [ebx]
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x18]
push eax
push edi
push 0x104b
push ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], 0x4feb18
mov dword [esp + 0x40], 0x400
mov dword [esp + 0x28], ebp
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x445025
push 0x400
push eax
push 0x4feb18
call fcn.00469f80
mov esi, dword [esi + 0x2c]
cmp esi, dword [0x4feaf4]
jae 0x445025
push esi
lea edx, [esp + 0x874]
push edx
mov ecx, 0x4fea40
call fcn.0043eb40
push 0x400
lea eax, [esp + 0x874]
push eax
lea ecx, [esp + 0x251c]
push ecx
call fcn.00469f80
lea edx, [esp + 0x2514]
push edx
call fcn.004513d0
xor ecx, ecx
mov word [eax], cx
cmp word [0x4feb18], di
je case.0x444cb6.174
cmp byte [ebx + 0x18], 0
je 0x4451c8
mov byte [ebx + 0x18], 0
cmp byte [0x4e7b89], 0
je 0x4451a0
lea edx, [esp + 0x870]
push edx
push str.Rar_MDXXXXXX
call fcn.004847c0
test al, al
je 0x445408
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x870]
mov word [esp + eax + 0x1d14], cx
add eax, 2
cmp cx, di
jne 0x445070
lea eax, [esp + 0x1d14]
push eax
call fcn.00450e70
mov eax, 0x4feb18
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4450a0
lea edi, [esp + 0x1d14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4450c0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4450c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x1d18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x445180
call fcn.00480c60
push 0x400
push 0x4f7014
mov ecx, 0x4eeda0
call fcn.00413010
mov ecx, dword [0x4f7814]
lea edx, [esp + 0x1d14]
push edx
call fcn.0046a5d0
push 0x400
push 0x4f38b0
mov ecx, 0x4eeda0
mov dword [0x4f45e4], 2
mov dword [0x4f45e0], ebp
mov byte [0x4f461e], 0
call fcn.00412ff0
mov eax, dword [0x4eefa8]
push 0
mov ecx, 0x4eeda0
mov dword [0x4f4fb4], eax
call fcn.00415550
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x1d14]
push ecx
call esi
lea edx, [esp + 0x870]
push edx
call esi
jmp 0x445408
lea eax, [esp + 0x1d14]
push eax
push 0x1f7
call fcn.00460760
push eax
call fcn.00492420
add esp, 8
jmp 0x4453fe
push edi
push 0x4feb18
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4453df
cmp word [0x4feb18], di
je 0x445408
push 0x4feb18
jmp 0x445188
cmp byte [0x4e7b89], 0
je 0x4453cb
lea ecx, [esp + 0x1354]
push ecx
mov ecx, ebx
call fcn.00440110
test al, al
je 0x4451fe
push 0x400
lea edx, [esp + 0x1358]
push edx
lea eax, [ebx + 0x1a]
push eax
call fcn.00469f80
push edi
call fcn.00480bc0
call fcn.0047fdb0
push 0x400
push 0x4f7014
mov ecx, 0x4eeda0
call fcn.00413010
mov ecx, dword [0x4eefa8]
push edi
push 0x4b99b4
push 0x4b8cc0
mov dword [0x4f4fb4], ecx
call fcn.0045afb0
test eax, eax
je 0x44525a
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x2514]
mov word [esp + eax + 0x870], cx
add eax, 2
cmp cx, di
jne 0x445240
jmp 0x44527e
push 0x400
lea edx, [esp + 0x874]
push edx
mov ecx, 0x4eeda0
call fcn.00412ff0
lea eax, [esp + 0x870]
push eax
call fcn.00450e70
mov ecx, dword [0x4f7814]
lea ebp, [ebx + 0x1a]
push ebp
call fcn.0046a5d0
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x870]
mov word [esp + eax + 0x1d14], cx
add eax, 2
test cx, cx
jne 0x445290
mov eax, 0x4feb18
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4452b0
lea edi, [esp + 0x1d14]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4452d0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4452d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4f7824]
call fcn.0046a1d0
lea ecx, [esp + 0x1d14]
push ecx
mov ecx, dword [0x4f7824]
call fcn.0046a5d0
push 0
push 0
lea edx, [esp + 0x1d1c]
push edx
push 0
mov ecx, 0x4fea40
call fcn.0043ec40
test al, al
je 0x445391
lea eax, [esp + 0x1d14]
push eax
push ebp
call fcn.00472870
test eax, eax
jne 0x445370
lea ecx, [esp + 0x1d14]
mov eax, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x445367
test dx, dx
je 0x445363
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x445367
add eax, 4
add ecx, 4
test dx, dx
jne 0x445341
xor eax, eax
jmp 0x44536c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x445391
push 0x4feb18
mov ecx, ebx
call fcn.004424d0
push 0x50d
call fcn.00460760
push eax
call fcn.00492420
add esp, 4
jmp 0x445408
cmp word [0x4feb18], 0
mov esi, 0x4feb18
je 0x4453bf
movzx eax, word [esi]
mov ecx, dword [str._____:]
push eax
push ecx
call fcn.004a4990
add esp, 8
test eax, eax
jne 0x445408
add esi, 2
cmp word [esi], ax
jne 0x4453a0
mov ecx, 0x4eeda0
call fcn.00413c90
jmp 0x445408
push 0x4feb18
push edi
lea esi, [ebx + 0x1a]
push esi
push edi
call fcn.004315f0
test al, al
je 0x4453e5
mov dword [esp + 0x10], ebp
jmp 0x445408
push 0x4feb18
push esi
push 0x207
call fcn.00460760
push eax
call fcn.00492420
add esp, 0xc
mov ecx, 0x4d56b4
call fcn.00428c40
mov edx, dword [0x4e8cd4]
push 0x4feb18
push 0
push 0x402
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x444e22
push 0x30
push 0x65
call fcn.00460760
push eax
push 0x1f4
call fcn.00460760
push eax
mov eax, dword [0x4e8cd4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x444cb6.174
mov eax, dword [esi + 0xc]
sub eax, 1
je 0x4454e4
sub eax, 0x10000
jne case.0x444cb6.174
cmp dword [0x4c90f4], 0xffffffff
jne 0x4454a2
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.0045afb0
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4c90f4], eax
call fcn.0045afb0
mov dword [0x4feb14], eax
mov ecx, dword [esi + 0x2c]
push ecx
lea edx, [esp + 0x44]
push edx
mov ecx, 0x4fea40
call fcn.0043eb40
mov eax, dword [eax + 0x810]
test eax, 0x800
je 0x4454cb
mov ecx, dword [0x4c90f4]
mov dword [esi + 0x30], ecx
test eax, 0x4000
je case.0x444cb6.174
mov edx, dword [0x4feb14]
mov dword [esi + 0x30], edx
jmp case.0x444cb6.174
movzx eax, byte [0x4eed98]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x444e22
test byte [esi + 0xc], 2
je case.0x444cb6.174
mov eax, dword [esi + 0x2c]
cmp eax, dword [0x4feaf4]
jae case.0x444cb6.174
push eax
mov ecx, 0x4fea40
call fcn.0043ed10
mov ebp, eax
mov ebx, 0x4401
call fcn.0043e7a0
cmp eax, 0x501
jb 0x445537
cmp byte [0x4e7b89], 0
je 0x44553c
mov ebx, 0x4411
push 0x400
lea eax, [esp + 0x874]
push eax
call fcn.00484e80
cmp byte [0x4e7b89], 0
mov edi, dword [ebp]
je 0x445578
movzx ecx, word [edi]
push ecx
call fcn.00450e40
test al, al
je 0x445578
movzx edx, word [edi + 2]
add edi, 2
push edx
call fcn.00450e40
test al, al
jne 0x445567
mov ecx, dword [ebp + 0x18]
push ebx
push 0x2b4
lea eax, [esp + 0x10a8]
push eax
push ecx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne al
test al, al
jne 0x4455cc
test bl, 0x10
jne 0x445649
mov eax, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea edx, [esp + 0x10a8]
push edx
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne al
test al, al
je 0x445649
push 0xc8
lea ecx, [esp + 0x12b8]
push ecx
lea edx, [esp + 0x1b8c]
push edx
call fcn.00469f80
cmp word [esp + 0x1b84], 0
jne 0x44560b
mov ecx, dword [ebp]
push 0xc8
lea eax, [esp + 0x1b88]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0043f960
movzx edx, byte [0x4e7b89]
add edx, 2
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x1b88]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push 0x1074
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x10a4]
mov dword [esi + 0x28], edx
or dword [esi + 0xc], 0x1000
push 0x400
lea eax, [esp + 0x2518]
push eax
call fcn.00484e80
lea ecx, [esp + 0x2514]
lea eax, [esp + 0x870]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x445696
test dx, dx
je 0x445692
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x445696
add eax, 4
add ecx, 4
test dx, dx
jne 0x445670
xor eax, eax
jmp 0x44569b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.0x444cb6.174
lea ecx, [esp + 0x870]
push ecx
call fcn.00484e60
jmp case.0x444cb6.174
mov edx, dword [esp + 0x2d1c]
push esi
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x444e24