Function at 0x140059c90
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30a8]
mov eax, 0x31a8
call fcn.140119910
sub rsp, rax
mov rax, qword [0x140182c48]
xor rax, rsp
mov qword [rbp + 0x3090], rax
mov rdi, qword [rbp + 0x3110]
mov r10, r9
mov eax, r8d
mov r12, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x14005a838
mov ecx, dword [rdi + 0x10]
xor r13d, r13d
mov eax, r13d
lea rdx, [0x1401794d8]
cmp dword [rax + rdx], ecx
je 0x140059d01
add rax, 4
cmp rax, 0x1c
jb 0x140059ce9
jmp 0x140059d19
mov rcx, qword [0x14018a7d0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rdi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x14005a717
je 0x14005a709
cmp eax, 0xffffff4f
je 0x14005a489
cmp eax, 0xffffff50
je 0x14005a023
cmp eax, 0xffffff51
je 0x140059efb
cmp eax, 0xffffff65
je 0x140059db6
cmp eax, 0xffffff8e
jne 0x14005a834
xor r8d, r8d
lea rdx, str.SingleClick
lea rcx, str.FileList
call fcn.1400bcdb0
test eax, eax
je 0x14005a834
mov rcx, rbx
call fcn.1400589c4
test eax, eax
je 0x14005a834
call fcn.1401253b4
sub eax, dword [0x1401c3f38]
cmp eax, 0x3e8
jle 0x14005a834
mov edx, 2
mov rcx, rbx
call fcn.140059744
jmp 0x14005a834
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
movsx esi, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
movsx r14d, ax
call qword [sym.imp.USER32.dll_GetKeyState]
cmp word [rdi + 0x18], 0x79
mov r12d, 0x8000
movsx r15d, ax
jne 0x140059e01
test r12d, esi
jne 0x140059df9
test r12d, r14d
je 0x140059e13
mov rcx, rbx
call fcn.14005cf8c
test r12d, esi
jne 0x14005a834
test r12d, r14d
jne 0x14005a834
test r12d, r15d
jne 0x14005a834
movzx ecx, word [rdi + 0x18]
sub ecx, 9
je 0x140059ecc
sub ecx, 4
je 0x140059ea4
sub ecx, 0x13
je 0x140059e97
sub ecx, 0xd
je 0x140059e97
sub ecx, 0x43
je 0x140059e7f
sub ecx, 1
je 0x140059e72
sub ecx, 2
je 0x140059e61
cmp ecx, 1
jne 0x14005a834
lea rcx, [0x1401bd3f0]
call fcn.14005c25c
jmp 0x14005a834
lea rcx, [0x1401bcf98]
call fcn.1400042cc
jmp 0x14005a834
mov rcx, rbx
call fcn.14005c204
jmp 0x14005a834
mov rcx, qword [0x14018a7d0]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx + 7]
jmp 0x14005a00e
mov rcx, rbx
call fcn.140058da8
jmp 0x14005a834
call fcn.1401253b4
mov edx, 2
mov dword [0x1401c3f38], eax
mov rcx, rbx
call fcn.140059744
call fcn.1401253b4
mov dword [0x1401c3f38], eax
jmp 0x14005a834
cmp qword [0x14018a7d8], r13
je 0x14005a834
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx + 0x50]
jne 0x14005a834
mov rcx, qword [0x14018a7d8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x14005a834
lea rcx, [0x1401ba630]
call fcn.140009948
cmp dword [0x14018a800], r13d
jne 0x14005a019
cmp byte [rbx + 0x106e], r13b
jne 0x14005a019
cmp byte [0x14018a804], r13b
je 0x140059f38
test al, 0x40
jne 0x140059f38
cmp byte [rbx + 0x6d], r13b
je 0x14005a019
cmp byte [rbx + 0x6d], r13b
jne 0x14005a834
mov eax, dword [rdi + 0x1c]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x50]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14005a019
mov r8, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
lea rcx, [0x1401c2ec0]
call fcn.1400550e8
lea rcx, [rbp - 0x70]
call fcn.14009694c
mov rcx, qword [rbx + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, 0x2e
cmp word [rdi], cx
jne 0x140059fd1
cmp word [rdi + 2], cx
jne 0x140059fd1
cmp word [rdi + 4], r13w
je 0x14005a019
cmp byte [rbp + 0x106c], r13b
jne 0x14005a834
mov edx, ecx
mov rcx, rdi
call fcn.14011c320
test rax, rax
je 0x14005a834
cmp rax, rdi
je 0x14005a834
sub rax, rdi
mov edx, 0xb1
sar rax, 1
mov rcx, rbx
mov r9, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14005a834
mov eax, 1
jmp 0x14005a849
lea r14, [rbx + 0x6e]
mov r15d, 1
mov word [r14], r13w
mov rdx, qword [rdi + 0x30]
test rdx, rdx
jne 0x14005a07c
cmp byte [rbx + 0x6d], r13b
je 0x14005a834
mov eax, dword [rdi + 0x1c]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x50]
mov esi, 0x800
xor r8d, r8d
mov dword [rsp + 0x50], esi
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x30], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14005a08c
mov esi, 0x800
mov rcx, r14
mov r8d, esi
call fcn.1400ac228
cmp word [r14], r13w
je 0x14005a834
cmp byte [rbx + 0x6d], r13b
je 0x14005a22a
mov byte [rbx + 0x6d], r13b
cmp byte [0x14018a804], r13b
je 0x14005a1d7
xor r9d, r9d
lea rdx, [rbp + 0x1090]
mov r8, rsi
lea rcx, str.Rar_MD
call fcn.1400e8184
test al, al
je 0x14005a45d
mov r9, rsi
lea r8, [rbp + 0x2090]
mov rdx, r14
lea rcx, [rbp + 0x1090]
call fcn.14009620c
xor r8d, r8d
lea rcx, [rbp + 0x2090]
xor edx, edx
call fcn.140085964
test eax, eax
jne 0x14005a1b3
xor ecx, ecx
call fcn.1400e305c
mov r8, rsi
lea rdx, [0x1401a9992]
lea rcx, [0x1401ba630]
call fcn.140009848
lea rdx, [rbp + 0x2090]
lea rcx, [0x1401aa998]
call fcn.1400ac28c
mov r8, rsi
mov dword [0x1401a25a0], 2
lea rdx, [0x14019f560]
mov dword [0x1401a259c], 2
lea rcx, [0x1401ba630]
mov byte [0x1401a25e9], r13b
call fcn.140009ef0
mov r9, rsi
lea rcx, [0x14019f560]
mov r8, r14
mov rdx, r14
call fcn.14009620c
mov eax, dword [0x1401ba634]
lea rcx, [0x1401ba630]
xor edx, edx
mov dword [0x1401a4928], eax
call fcn.1400082d4
lea rcx, [rbp + 0x2090]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x1090]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14005a45d
mov ecx, 0x1f7
call fcn.1400a617c
mov r8, rax
lea r9, [rbp + 0x2090]
mov rdx, r12
mov ecx, r15d
call fcn.1400ee17c
jmp 0x14005a45d
mov r9, rsi
mov r8, r14
mov rdx, r14
mov rcx, rbx
call fcn.140058868
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140085964
test eax, eax
je 0x14005a434
mov rbx, r13
cmp word [r14], r13w
je 0x14005a460
mov ecx, 0x1f7
call fcn.1400a617c
mov r8, rax
mov r9, r14
mov rdx, r12
mov ecx, r15d
call fcn.1400ee17c
jmp 0x14005a460
lea rdx, [rbp - 0x70]
mov qword [rbp + 0x1020], r13
mov rcx, rbx
mov qword [rbp + 0x1028], r13
mov qword [rbp + 0x1030], r13
call fcn.140057f9c
test al, al
je 0x14005a834
cmp byte [0x14018a804], r13b
je 0x14005a3fa
xor ecx, ecx
call fcn.1400e305c
mov r8, rsi
lea rdx, [0x1401a9992]
lea rcx, [0x1401ba630]
call fcn.140009848
mov eax, dword [0x1401ba634]
lea rdx, [rbp - 0x70]
mov r8, rsi
mov dword [0x1401a4928], eax
lea rcx, [rbp + 0x1090]
call fcn.1400ac228
lea rcx, [rbp + 0x1090]
call fcn.14009694c
lea rdx, [rbp - 0x70]
lea rcx, [0x1401aa998]
mov word [rax], r13w
call fcn.1400ac28c
mov r9, rsi
lea r8, [rbp + 0x2090]
mov rdx, r14
lea rcx, [rbp + 0x1090]
call fcn.14009620c
lea rcx, [0x1401aac78]
call fcn.1400ac448
lea rdx, [rbp + 0x2090]
lea rcx, [0x1401aac78]
call fcn.1400ac28c
xor r9d, r9d
lea rdx, [rbp + 0x2090]
xor r8d, r8d
lea rcx, [0x1401c2ec0]
call fcn.140055574
test al, al
je 0x14005a373
lea rdx, [rbp + 0x2090]
lea rcx, [rbp - 0x70]
call fcn.1400af350
test eax, eax
jne 0x14005a34d
lea rax, [rbp - 0x70]
lea rdx, [rbp + 0x2090]
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x14005a349
add rax, 2
test r8d, r8d
jne 0x14005a333
test ecx, ecx
jne 0x14005a373
lea rdx, [rbp + 0x2090]
mov rcx, rbx
call fcn.140058634
mov ecx, 0x50d
call fcn.1400a617c
mov rcx, rax
call fcn.1400ee128
jmp 0x14005a45d
movzx eax, word [r14]
mov rbx, r14
mov ecx, 0x20
jmp 0x14005a388
add rbx, 2
movzx eax, word [rbx]
cmp ax, cx
je 0x14005a381
test ax, ax
je 0x14005a3e6
mov rdi, rbx
movzx edx, ax
lea rcx, str._____:
call fcn.14011abf8
test rax, rax
jne 0x14005a3e6
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x14005a395
mov ecx, 0x2e
cmp word [rbx], cx
jne 0x14005a3d8
cmp word [rbx + 2], r13w
je 0x14005a3e6
cmp word [rbx], cx
jne 0x14005a3d8
cmp word [rbx + 2], cx
jne 0x14005a3d8
cmp word [rbx + 4], r13w
je 0x14005a3e6
xor edx, edx
lea rcx, [0x1401ba630]
call fcn.14000b968
mov r8, rsi
lea rdx, [rbp + 0x2090]
mov rcx, r14
call fcn.1400ac228
jmp 0x14005a45d
mov r9, rsi
lea r8, [rbp + 0x2090]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140058868
mov r9, rsi
mov r8, r14
mov rdx, r14
mov rcx, rbx
call fcn.140058868
mov rdx, r14
lea rcx, [rbp + 0x2090]
call fcn.140085c6c
test al, al
je 0x14005a439
mov rbx, r15
jmp 0x14005a460
mov ecx, 0x20a
call fcn.1400a617c
mov r8, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x2090]
mov rdx, r12
mov ecx, r15d
call fcn.1400ee17c
mov rbx, r13
cmp byte [0x1401a795e], r13b
jne 0x14005a481
mov rcx, qword [0x14018a7d0]
mov r9, r14
mov r8, r15
mov edx, 0x8002
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, rbx
jmp 0x14005a849
test byte [rdi + 0x18], 3
je 0x14005a834
mov rdx, qword [rdi + 0x40]
cmp rdx, qword [0x1401c2ec8]
jae 0x14005a834
lea rcx, [0x1401c2ec0]
call fcn.140055228
xor edx, edx
mov r13, rax
cmp byte [0x14018a804], dl
mov rsi, qword [rax]
lea r15d, [rdx + 1]
jne 0x14005a50e
cmp dword [0x14018a808], r15d
lea rcx, [rbp + 0x1090]
mov esi, 0x800
jne 0x14005a4e2
mov edx, esi
call fcn.1400e9070
jmp 0x14005a4f1
lea rdx, [rbx + 0x1070]
mov r8, rsi
call fcn.1400ac228
mov rdx, qword [r13]
lea r8, [rbp - 0x70]
mov r9, rsi
lea rcx, [rbp + 0x1090]
call fcn.14009620c
xor edx, edx
lea rsi, [rbp - 0x70]
cmp byte [0x14018a804], dl
mov r12d, 0x4401
je 0x14005a53e
mov ecx, 0x2e
mov r12d, 0x4411
cmp word [rsi], cx
jne 0x14005a53e
cmp word [rsi + 2], dx
lea rax, [0x140145568]
cmovne rax, rsi
mov rsi, rax
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rsi + rax*2], dx
jne 0x14005a545
cmp rax, 0x100
ja 0x14005a55b
cmp word [rsi], dx
jne 0x14005a58b
mov rcx, rsi
or r12d, 0x10
call fcn.140095b20
xor edx, edx
mov rsi, rax
test rax, rax
je 0x14005a584
inc r14
cmp word [rax + r14*2], dx
jne 0x14005a571
cmp r14, 0x101
jbe 0x14005a58b
lea rsi, str.dummy
cmp byte [0x14018a804], dl
je 0x14005a5a5
jmp 0x14005a599
add rsi, 2
movzx ecx, word [rsi]
call fcn.1400961b8
test al, al
jne 0x14005a595
mov r14d, dword [r13 + 0x20]
lea r8, [rbp + 0x2090]
and r14d, 0x10
mov dword [rsp + 0x20], r12d
mov edx, r14d
mov r9d, 0x2b8
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
setne cl
test rax, rax
jne 0x14005a608
test r12b, 0x10
jne 0x14005a608
or r12d, 0x10
lea r8, [rbp + 0x2090]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r12d
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor esi, esi
test rax, rax
setne cl
jmp 0x14005a60a
xor esi, esi
test cl, cl
je 0x14005a6ff
mov r14d, 0xc8
lea rdx, [rbp + 0x22a8]
mov r8d, r14d
lea rcx, [rbp + 0x1090]
call fcn.1400ac228
mov ecx, dword [r13 + 0x68]
sub ecx, r15d
je 0x14005a660
sub ecx, r15d
je 0x14005a660
sub ecx, r15d
je 0x14005a659
sub ecx, r15d
je 0x14005a652
cmp ecx, r15d
jne 0x14005a67c
mov ecx, 0x61b
jmp 0x14005a665
mov ecx, 0x61a
jmp 0x14005a665
mov ecx, 0x618
jmp 0x14005a665
mov ecx, 0x619
call fcn.1400a617c
mov r8, r14
lea rcx, [rbp + 0x1090]
mov rdx, rax
call fcn.1400ac228
cmp word [rbp + 0x1090], si
jne 0x14005a6c6
mov ecx, dword [r13 + 0x20]
call fcn.14008572c
test al, al
je 0x14005a6b0
mov ecx, 0x573
call fcn.1400a617c
mov rdx, rax
lea rcx, [rbp + 0x1090]
mov r8, r14
call fcn.1400ac228
jmp 0x14005a6c6
mov rdx, qword [r13]
lea r8, [rbp + 0x1090]
mov r9, r14
mov rcx, rbx
call fcn.14005858c
test byte [rdi + 0x18], r15b
je 0x14005a6f0
mov eax, dword [0x1401c2f14]
cmp dword [rdi + 0x20], eax
jne 0x14005a6f0
cmp dword [rdi + 0x38], esi
jle 0x14005a6f0
movsxd r8, dword [rdi + 0x38]
lea rdx, [rbp + 0x1090]
mov rcx, qword [rdi + 0x30]
call fcn.1400ac228
test byte [rdi + 0x18], 2
je 0x14005a6ff
mov eax, dword [rbp + 0x2098]
mov dword [rdi + 0x3c], eax
bts dword [rdi + 0x18], 0xc
jmp 0x14005a834
xor edx, edx
xor ecx, ecx
call fcn.140014638
jmp 0x14005a834
cmp eax, 0xffffff94
je 0x14005a829
cmp eax, 0xfffffff4
je 0x14005a77c
cmp eax, 0xfffffffd
je 0x14005a767
cmp eax, 0xffffffff
jne 0x14005a834
mov ecx, 0x65
call fcn.1400a617c
mov ecx, 0x1f4
mov rbx, rax
call fcn.1400a617c
mov rcx, qword [0x14018a7d0]
mov r9d, 0x30
mov r8, rbx
mov rdx, rax
call fcn.1400e9514
jmp 0x14005a834
mov rcx, rbx
call fcn.1400589c4
test eax, eax
je 0x14005a834
jmp 0x140059da4
mov ecx, dword [rdi + 0x18]
sub ecx, 1
je 0x14005a819
cmp ecx, 0x10000
jne 0x14005a834
or r14, 0xffffffffffffffff
cmp dword [0x1401794f4], r14d
jne 0x14005a7df
mov r8d, 0xff0000
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.1400bcdb0
mov r8d, 0xd9213
mov dword [0x1401794f4], eax
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.1400bcdb0
mov dword [0x1401c3f3c], eax
mov r8, qword [rdi + 0x48]
lea rdx, [rbp - 0x70]
lea rcx, [0x1401c2ec0]
call fcn.1400550e8
mov ecx, dword [rax + 0x10a8]
bt ecx, 0xb
jae 0x14005a808
mov eax, dword [0x1401794f4]
mov dword [rdi + 0x50], eax
bt ecx, 0xe
jae 0x14005a834
mov eax, dword [0x1401c3f3c]
mov dword [rdi + 0x50], eax
jmp 0x14005a834
cmp byte [0x1401bf664], r13b
je 0x14005a834
mov eax, 0x20
jmp 0x14005a849
mov edx, dword [rdi + 0x1c]
mov rcx, rbx
call fcn.14005965c
xor eax, eax
jmp 0x14005a849
mov r9, rdi
mov r8, r10
mov edx, eax
mov rcx, r12
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp + 0x3090]
xor rcx, rsp
call fcn.140119970
add rsp, 0x31a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret