Function at 0x45af84
Capabilities:
Check for time delay via gettickcount
Create directory
Delete directory
Get common file path
Get file system object information
Log keystrokes via polling
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 6
add esp, 0xfffff004
push eax
dec eax
jne 0x45af8d
mov eax, dword [ebp - 4]
add esp, 0xfffff60c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
cmp ecx, 0x4e
jne 0x45bc8b
mov ebx, esi
xor eax, eax
mov edx, dword [eax*4 + 0x4aadf8]
cmp edx, dword [ebx + 8]
jne 0x45afd8
push 0
push 0
push 0x400
push dword [0x4c6eec]
call sub.USER32.DLL_PostMessageA
jmp 0x45afde
inc eax
cmp eax, 7
jl 0x45afb6
mov ecx, dword [ebx + 8]
cmp ecx, 0xffffff96
jg 0x45b022
je 0x45b2d4
cmp ecx, 0xffffff8e
jg 0x45b00d
je 0x45b1ad
sub ecx, 0xffffff65
je 0x45b04b
sub ecx, 5
je 0x45b8ac
jmp 0x45bc87
sub ecx, 0xffffff93
je 0x45b21c
dec ecx
je 0x45b226
jmp 0x45bc87
sub ecx, 0xffffff97
je 0x45b238
sub ecx, 0x5d
je 0x45b7fc
sub ecx, 9
je 0x45b1fd
sub ecx, 2
je 0x45b7d4
jmp 0x45bc87
mov ebx, esi
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x12
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov edi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
mov dword [ebp - 8], eax
cmp word [ebx + 0xc], 0x79
jne 0x45b09b
test esi, esi
jne 0x45b093
test edi, edi
je 0x45b09b
mov eax, dword [ebp - 4]
call fcn.0045d0b0
test esi, esi
jne 0x45bc87
test edi, edi
jne 0x45bc87
cmp dword [ebp - 8], 0
jne 0x45bc87
movzx edx, word [ebx + 0xc]
cmp edx, 0x70
jg 0x45b0dd
je 0x45b121
sub edx, 9
je 0x45b180
sub edx, 4
je 0x45b0ef
sub edx, 0x13
je 0x45b114
sub edx, 0xd
je 0x45b114
jmp 0x45bc87
sub edx, 0x71
je 0x45b13d
sub edx, 2
je 0x45b14a
dec edx
je 0x45b159
jmp 0x45bc87
call fcn.004a127c
mov dword [0x4aadf4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045bca0
call fcn.004a127c
mov dword [0x4aadf4], eax
jmp 0x45bc87
mov eax, dword [ebp - 4]
call fcn.0045d028
jmp 0x45bc87
push 0
push 0xb4
push 0x111
push dword [0x4c6eec]
call sub.USER32.DLL_SendMessageA
jmp 0x45bc87
mov eax, dword [ebp - 4]
call fcn.0045d714
jmp 0x45bc87
mov eax, 0x4c7460
call fcn.004768c8
jmp 0x45bc87
cmp dword [0x4c988c], 0
je 0x45b171
mov eax, 0x4c6f00
call fcn.0045a93c
jmp 0x45bc87
mov eax, 0x4c6f00
call fcn.00459d78
jmp 0x45bc87
cmp dword [0x4c6ef0], 0
je 0x45bc87
call sub.USER32.DLL_GetFocus
mov edx, dword [ebp - 4]
cmp eax, dword [edx]
jne 0x45bc87
push dword [0x4c6ef0]
call sub.USER32.DLL_SetFocus
jmp 0x45bc87
mov edx, 0x4aaf4f
mov eax, 0x4aaeb7
xor ecx, ecx
call fcn.00461bc4
test eax, eax
je 0x45bc87
mov eax, dword [ebp - 4]
call fcn.0045d5c0
test eax, eax
je 0x45bc87
call fcn.004a127c
sub eax, dword [0x4aadf4]
cmp eax, 0x3e8
jle 0x45bc87
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045bca0
jmp 0x45bc87
mov eax, dword [ebp - 4]
call fcn.0045d5c0
test eax, eax
je 0x45b215
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0045bca0
xor eax, eax
jmp 0x45bc96
call fcn.004508e0
jmp 0x45bc87
mov eax, dword [esi + 0x10]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0045d9c0
jmp 0x45bc87
mov eax, 0x4c7c4c
call fcn.00453850
cmp dword [0x4c9894], 0
jne 0x45b261
cmp dword [0x4c988c], 0
je 0x45b26b
test al, 0x40
jne 0x45b26b
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
jne 0x45b26b
mov eax, 1
jmp 0x45bc96
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
je 0x45b27d
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x1d], 0
jmp 0x45b2cd
mov eax, esi
mov eax, dword [eax + 0x10]
xor edx, edx
mov dword [ebp - 0x2c], edx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x1c], 0x400
mov ecx, dword [ebp - 4]
add ecx, 0x1d
mov dword [ebp - 0x20], ecx
push edx
push eax
push 0x102d
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
push 0x4aaeb4
mov ecx, dword [ebp - 4]
add ecx, 0x1d
push ecx
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45b2cd
mov eax, 1
jmp 0x45bc96
xor eax, eax
jmp 0x45bc96
mov ebx, esi
xor edi, edi
xor esi, esi
mov byte [0x4cb9d8], 0
mov byte [ebp - 0x434], 0
cmp dword [ebx + 0x20], 0
jne 0x45b337
mov eax, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0x4cb9d8
mov dword [ebp - 0x444], 0x400
mov dword [ebp - 0x45c], 1
lea ecx, [ebp - 0x45c]
push ecx
push 0
push 0x1005
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
jmp 0x45b38f
push dword [ebx + 0x20]
push 0x4cb9d8
call fcn.00498e7c
add esp, 8
mov edx, dword [ebx + 0x2c]
cmp edx, dword [0x4cb9d0]
jae 0x45b38f
lea ecx, [ebp - 0x108c]
mov edx, dword [ebx + 0x2c]
mov eax, 0x4cb8cc
call fcn.0046126c
mov esi, dword [ebp - 0x470]
lea edx, [ebp - 0x108c]
lea eax, [ebp - 0x434]
mov ecx, 0x400
call fcn.0040f778
lea eax, [ebp - 0x434]
call fcn.0040be48
mov byte [eax], 0
cmp byte [0x4cb9d8], 0
jne 0x45b39f
xor eax, eax
jmp 0x45bc96
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1c], 0
je 0x45b51f
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x1c], 0
cmp dword [0x4c988c], 0
je 0x45b4d1
lea edx, [ebp - 0x188c]
mov eax, str.Rar_MDXXXXXX
call fcn.00464330
test al, al
je 0x45b7b6
lea ecx, [ebp - 0x188c]
push ecx
lea eax, [ebp - 0x148c]
push eax
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0x148c]
call fcn.0040c35c
push 0x4cb9d8
lea edx, [ebp - 0x148c]
push edx
call fcn.00498da0
add esp, 8
push 0
lea ecx, [ebp - 0x148c]
push ecx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45b4a8
call fcn.0044a240
mov edx, 0x4bf940
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d7c
lea edx, [ebp - 0x148c]
mov eax, dword [0x4c0540]
call fcn.0040ff50
mov dword [0x4bdb0c], 1
mov dword [0x4bdb08], 1
mov byte [0x4bdb46], 0
mov edx, 0x4bd258
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d50
mov eax, dword [0x4c7e54]
mov dword [0x4be4f0], eax
mov eax, 0x4c7c4c
xor edx, edx
call fcn.004533d8
lea ecx, [ebp - 0x148c]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
lea eax, [ebp - 0x188c]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
jmp 0x45b7b6
lea edx, [ebp - 0x148c]
mov eax, 0x1f7
push edx
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
mov eax, 0x4b3b9c
call fcn.0042dd14
jmp 0x45b7b6
push 0
push 0x4cb9d8
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45b4eb
mov edi, 1
jmp 0x45b7b6
cmp byte [0x4cb9d8], 0
je 0x45b7b6
push 0x4cb9d8
mov eax, 0x1f7
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
mov eax, 0x4b3b9c
call fcn.0042dd14
jmp 0x45b7b6
cmp dword [ebx + 0x20], 0
je 0x45b7b6
cmp dword [0x4c988c], 0
je 0x45b771
lea edx, [ebp - 0x24bc]
mov eax, dword [ebp - 4]
call fcn.0045e774
test al, al
je 0x45b55e
lea edx, [ebp - 0x24bc]
mov eax, dword [ebp - 4]
add eax, 0x1d
mov ecx, 0x400
call fcn.0040f778
push 0x4cb9d8
call fcn.00498eac
pop ecx
mov ebx, eax
test esi, 4
je 0x45b598
cmp ebx, 4
jle 0x45b598
push 0x4aaee4
mov eax, 0x4cb9d4
add eax, ebx
push eax
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45b598
mov byte [ebx + 0x4cb9d4], 0
test esi, 1
je 0x45b5c5
cmp ebx, 2
jle 0x45b5c5
push 0x4aaedc
mov edx, 0x4cb9d6
add edx, ebx
push edx
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45b5c5
mov byte [ebx + 0x4cb9d6], 0
xor eax, eax
call fcn.0044a1d4
call fcn.0044a7b4
mov ecx, 0x4bfd40
mov edx, 0x4bf940
mov eax, 0x4c7c4c
call fcn.00457d7c
mov edx, dword [0x4c7e54]
mov eax, 0x4aaeb7
mov dword [0x4be4f0], edx
mov edx, str.FlatView
xor ecx, ecx
call fcn.00461bc4
test eax, eax
setne al
and eax, 1
test al, al
je 0x45b626
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x28bc]
push ecx
call fcn.00498e7c
add esp, 8
jmp 0x45b643
lea edx, [ebp - 0x28bc]
mov eax, 0x4c7c4c
xor ecx, ecx
call fcn.00457d50
lea eax, [ebp - 0x28bc]
call fcn.0040c35c
mov edx, dword [ebp - 4]
mov eax, dword [0x4c0540]
add edx, 0x1d
call fcn.0040ff50
lea edx, [ebp - 0x28bc]
push edx
lea ecx, [ebp - 0x2cbc]
push ecx
call fcn.00498e7c
add esp, 8
push 0x4cb9d8
lea eax, [ebp - 0x2cbc]
push eax
call fcn.00498da0
add esp, 8
mov eax, dword [0x4c0550]
call fcn.0040ff20
lea edx, [ebp - 0x2cbc]
mov eax, dword [0x4c0550]
call fcn.0040ff50
push 0
push 0
lea edx, [ebp - 0x2cbc]
mov eax, 0x4cb8cc
xor ecx, ecx
call fcn.00461348
test al, al
je 0x45b703
lea edx, [ebp - 0x2cbc]
mov eax, dword [ebp - 4]
add eax, 0x1d
call fcn.0040f55c
test eax, eax
jne 0x45b6e0
lea edx, [ebp - 0x2cbc]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x1d
push ecx
call fcn.00498e30
add esp, 8
test eax, eax
jne 0x45b703
mov edx, 0x4cb9d8
mov eax, dword [ebp - 4]
call fcn.00459c98
mov eax, 0x50d
call fcn.004129c8
push eax
call fcn.00487828
pop ecx
jmp 0x45b7b6
mov byte [ebp - 9], 1
mov ebx, 0x4cb9d8
jmp 0x45b749
xor eax, eax
mov al, byte [ebx]
push eax
push dword [0x4aae14]
call fcn.00498f49
add esp, 8
test eax, eax
je 0x45b72b
mov byte [ebp - 9], 0
jmp 0x45b74e
mov esi, ebx
cmp byte [0x4b5ae8], 0
je 0x45b744
mov eax, 0x4b59e8
mov edx, esi
call fcn.00410f74
jmp 0x45b747
lea eax, [esi + 1]
mov ebx, eax
cmp byte [ebx], 0
jne 0x45b70e
cmp byte [ebp - 9], 0
je 0x45b7b6
lea eax, [ebp - 0x28bc]
xor edx, edx
call fcn.0040c2d0
test al, al
jne 0x45b7b6
mov eax, 0x4c7c4c
call fcn.00453878
jmp 0x45b7b6
push 0x4cb9d8
mov edx, dword [ebp - 4]
add edx, 0x1d
push edx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
je 0x45b78d
mov edi, 1
jmp 0x45b7b6
push 0x4cb9d8
mov eax, dword [ebp - 4]
add eax, 0x1d
push eax
mov eax, 0x207
call fcn.004129c8
push eax
call fcn.00487828
add esp, 0xc
mov eax, 0x4b3b9c
call fcn.0042dd14
push 0x4cb9d8
push 0
push 0x402
push dword [0x4c6eec]
call sub.USER32.DLL_PostMessageA
mov eax, edi
jmp 0x45bc96
push 0x30
mov eax, 0x65
call fcn.004129c8
push eax
mov eax, 0x1f4
call fcn.004129c8
push eax
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
jmp 0x45bc87
mov ebx, esi
mov eax, dword [ebx + 0xc]
dec eax
je 0x45b810
sub eax, 0x10000
je 0x45b82a
jmp 0x45bc87
cmp byte [0x4c7424], 0
jne 0x45b820
xor eax, eax
jmp 0x45bc96
mov eax, 0x20
jmp 0x45bc96
cmp dword [0x4aae18], 0xffffffff
jne 0x45b865
mov edx, str.AltColor
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, 0xff0000
call fcn.00461bc4
mov dword [0x4aae18], eax
mov edx, str.AltEncryptionColor
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov ecx, 0xd9213
call fcn.00461bc4
mov dword [0x4cbdd8], eax
lea ecx, [ebp - 0x38ec]
mov edx, dword [ebx + 0x2c]
mov eax, 0x4cb8cc
call fcn.0046126c
lea eax, [ebp - 0x38ec]
mov eax, dword [eax + 0xc10]
test ah, 8
je 0x45b892
mov edx, dword [0x4aae18]
mov dword [ebx + 0x30], edx
test ah, 0x40
je 0x45b8a0
mov ecx, dword [0x4cbdd8]
mov dword [ebx + 0x30], ecx
xor eax, eax
jmp 0x45bc96
mov eax, esi
lea ebx, [eax + 0xc]
test byte [ebx], 2
je 0x45bc87
lea ecx, [ebp - 0x451c]
mov edx, dword [ebx + 0x20]
mov eax, 0x4cb8cc
call fcn.0046126c
cmp dword [0x4aae1c], 0
jne 0x45b8f0
mov dword [0x4aae1c], 0x4401
call fcn.0046492c
test al, al
jne 0x45b8f0
or dword [0x4aae1c], 0x10
call fcn.004107bc
test eax, eax
je 0x45ba2b
cmp word [ebp - 0x411c], 0
je 0x45ba2b
lea eax, [ebp - 0x4fd0]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
cmp dword [0x4aae20], 0
jne 0x45b945
push 0x4aafc2
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
je 0x45b945
push str.SHGetFileInfoW
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4aae20], eax
cmp dword [0x4aae20], 0
je 0x45b9f0
push dword [0x4aae1c]
lea eax, [ebp - 0x47d0]
push 0x2b4
push eax
lea edx, [ebp - 0x411c]
push dword [ebp - 0x390c]
push edx
call dword [0x4aae20]
test eax, eax
je 0x45b9f0
lea edx, [ebp - 0x5098]
lea eax, [ebp - 0x45bc]
mov ecx, 0x1000000
call fcn.00410820
cmp byte [ebp - 0x5098], 0
jne 0x45b9ae
lea ecx, [ebp - 0x5098]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045d748
mov eax, dword [0x4c988c]
lea edx, [ebp - 0x5098]
add eax, 2
lea ecx, [ebp - 0x50c0]
mov dword [ebp - 0x50b8], eax
mov dword [ebp - 0x50ac], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x47cc]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x58c0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea edx, [ebp - 0x58c0]
lea eax, [ebp - 0x4fd0]
call fcn.00410b58
test eax, eax
je 0x45bafb
lea ecx, [ebp - 0x4fd0]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryW
jmp 0x45bafb
lea eax, [ebp - 0x5e20]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [0x4aae1c]
lea edx, [ebp - 0x5a20]
push 0x160
push edx
lea ecx, [ebp - 0x451c]
push dword [ebp - 0x390c]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45bac3
cmp byte [ebp - 0x5910], 0
jne 0x45ba81
lea ecx, [ebp - 0x5910]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045d748
mov eax, dword [0x4c988c]
lea edx, [ebp - 0x5910]
add eax, 2
lea ecx, [ebp - 0x5e48]
mov dword [ebp - 0x5e40], eax
mov dword [ebp - 0x5e34], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
or dword [ebx], 0x1000
mov edx, dword [ebp - 0x5a1c]
mov dword [ebx + 0x1c], edx
lea ecx, [ebp - 0x6248]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x6248]
push eax
lea edx, [ebp - 0x5e20]
push edx
call fcn.00498e30
add esp, 8
test eax, eax
je 0x45bafb
lea ecx, [ebp - 0x5e20]
push ecx
call fcn.0049a80c
pop ecx
test byte [ebx + 1], 0x10
jne 0x45bc87
lea ecx, [ebp - 0x6310]
lea edx, [ebp - 0x451c]
mov eax, dword [ebp - 4]
call fcn.0045d748
mov eax, dword [0x4c988c]
lea edx, [ebp - 0x6310]
add eax, 2
lea ecx, [ebp - 0x6338]
mov dword [ebp - 0x6330], eax
mov dword [ebp - 0x6324], edx
push ecx
push dword [ebx + 4]
push 0x102e
mov eax, dword [ebp - 4]
push dword [eax]
call sub.USER32.DLL_SendMessageA
lea edx, [ebp - 0x411c]
lea eax, [ebp - 0x451c]
call fcn.0040ac6c
mov esi, eax
lea eax, [ebp - 0x6738]
mov edx, 0x400
call fcn.00464700
lea eax, [ebp - 0x6738]
call fcn.0040c35c
push str._rar_icon_
lea edx, [ebp - 0x6738]
push edx
call fcn.00498da0
add esp, 8
mov eax, esi
call fcn.0040a9b0
test al, al
je 0x45bc0c
cmp dword [0x4aae24], 0xffffffff
jne 0x45bbef
push 0
lea edx, [ebp - 0x6738]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x45bbe3
push 0x4001
lea ecx, [ebp - 0x6898]
push 0x160
push ecx
lea eax, [ebp - 0x6738]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45bbe3
mov edx, dword [ebp - 0x6894]
mov dword [0x4aae24], edx
lea ecx, [ebp - 0x6738]
push ecx
call sub.KERNEL32.DLL_RemoveDirectoryA
cmp dword [0x4aae24], 0xffffffff
je 0x45bc87
or dword [ebx], 0x1000
mov eax, dword [0x4aae24]
mov dword [ebx + 0x1c], eax
jmp 0x45bc87
cmp dword [0x4aae28], 0xffffffff
jne 0x45bc70
push 0x4aafe8
lea edx, [ebp - 0x6738]
push edx
call fcn.0049adac
add esp, 8
test eax, eax
je 0x45bc63
push eax
call fcn.0049a8b4
pop ecx
push 0x4001
lea ecx, [ebp - 0x69f8]
push 0x160
push ecx
lea eax, [ebp - 0x6738]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45bc63
mov edx, dword [ebp - 0x69f4]
mov dword [0x4aae28], edx
lea ecx, [ebp - 0x6738]
push ecx
call fcn.0049ba38
pop ecx
cmp dword [0x4aae28], 0xffffffff
je 0x45bc87
or dword [ebx], 0x1000
mov eax, dword [0x4aae28]
mov dword [ebx + 0x1c], eax
xor eax, eax
jmp 0x45bc96
push esi
push dword [ebp + 0xc]
push ecx
push edx
call sub.USER32.DLL_DefWindowProcA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8