Function at 0x450f80
Capabilities:
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
mov eax, 0x5578
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x5574], eax
mov eax, dword [esp + 0x557c]
push ebx
mov ebx, dword [esp + 0x558c]
push edi
mov edi, ecx
mov ecx, dword [esp + 0x5588]
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebx
cmp ecx, 0x4e
jne 0x451aa3
mov ecx, dword [ebx + 8]
push ebp
xor ebp, ebp
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x4e927c], ecx
je 0x450fe2
add eax, 4
cmp eax, 0x1c
jb 0x450fd0
jmp 0x450ff5
mov eax, dword [0x534544]
push ebp
push ebp
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push esi
cmp eax, 0xb0
ja case.0x451010.174
movzx ecx, byte [eax + 0x451ae8]
jmp dword [ecx*4 + 0x451abc]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebp
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [ebx + 0xc], 0x79
jne 0x45105c
test esi, esi
jne 0x451053
test edi, edi
je 0x45106c
mov ecx, dword [esp + 0x10]
call fcn.0044d4e0
test esi, esi
jne case.0x451010.174
test edi, edi
jne case.0x451010.174
test ebp, ebp
jne case.0x451010.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x451010.174
movzx edx, byte [eax + 0x451bbc]
jmp dword [edx*4 + 0x451b9c]
call fcn.004c1545
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x55fa48], eax
call fcn.00450b10
call fcn.004c1545
mov dword [0x55fa48], eax
jmp case.0x451010.174
mov ecx, dword [esp + 0x10]
call fcn.0044d450
jmp case.0x451010.174
mov eax, dword [0x534544]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x451010.174
mov ecx, dword [esp + 0x10]
call fcn.0044bdb0
jmp case.0x451010.174
mov ecx, 0x53ed78
call fcn.00407210
jmp case.0x451010.174
mov ecx, 0x53ed88
call fcn.00450a10
jmp case.0x451010.174
cmp dword [0x533484], 0
je case.0x451010.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x451010.174
mov edx, dword [0x533484]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x451010.174
push ebp
push str.SingleClick
push str.FileList
call fcn.0046bce0
test eax, eax
je case.0x451010.174
mov ecx, edi
call fcn.0044bc30
test eax, eax
je case.0x451010.174
call fcn.004c1545
sub eax, dword [0x55fa48]
cmp eax, 0x3e8
jle case.0x451010.174
push ebp
push 1
mov ecx, edi
call fcn.00450b10
xor eax, eax
pop esi
pop ebp
mov ecx, dword [esp + 0x557c]
pop edi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x5578
ret 0x10
mov ecx, edi
call fcn.0044bc30
test eax, eax
je case.0x451010.174
jmp 0x45115d
call fcn.0042e250
jmp case.0x451010.174
mov eax, dword [ebx + 0x10]
push eax
mov ecx, edi
call fcn.00450840
jmp case.0x451010.174
mov ecx, 0x540eb0
call fcn.00413df0
mov dword [esp + 0x18], edx
cmp dword [0x53349c], ebp
jne 0x4512a8
cmp byte [edi + 0x101a], 0
jne 0x4512a8
cmp byte [0x5323f1], 0
je 0x4511e7
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x4511e7
cmp byte [edi + 0x18], cl
je 0x4512a8
cmp byte [edi + 0x18], 0
je 0x4511f8
xor ecx, ecx
mov word [edi + 0x1a], cx
jmp case.0x451010.174
mov edx, dword [ebx + 0x10]
mov ecx, dword [edi]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebp
call ebx
test eax, eax
je 0x4512a8
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x1358]
push eax
mov ecx, 0x55e9b8
call fcn.0044acf0
push 0x800
lea ecx, [esp + 0x1358]
push ecx
lea esi, [edi + 0x1a]
call fcn.0045f900
push eax
push esi
call fcn.0047e340
mov edx, dword [edi]
push ebp
push ebp
push 0x1018
push edx
call ebx
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4d6bcc
mov cx, word [esi]
cmp cx, word [eax]
jne 0x45129b
cmp cx, bp
je 0x451297
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x45129b
add esi, 4
add eax, 4
cmp cx, bp
jne 0x451275
xor eax, eax
jmp 0x4512a0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne case.0x451010.174
mov eax, 1
jmp 0x451169
xor eax, eax
mov word [0x55ea48], ax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov word [esp + 0x4584], cx
lea esi, [ecx + 1]
cmp eax, ebp
jne 0x451310
cmp byte [edi + 0x18], cl
je case.0x451010.174
mov ecx, dword [edi]
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x104b
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], 0x55ea48
mov dword [esp + 0x44], 0x800
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x45136a
push 0x800
push eax
push 0x55ea48
call fcn.0047e340
mov ebx, dword [ebx + 0x2c]
cmp ebx, dword [0x55ea24]
jae 0x45136a
push ebx
lea edx, [esp + 0x1358]
push edx
mov ecx, 0x55e9b8
call fcn.0044acf0
push 0x800
lea eax, [esp + 0x1358]
push eax
lea ecx, [esp + 0x458c]
push ecx
call fcn.0047e340
lea edx, [esp + 0x4584]
push edx
call fcn.0045f900
xor ecx, ecx
mov word [eax], cx
cmp word [0x55ea48], bp
je case.0x451010.174
cmp byte [edi + 0x18], 0
je 0x4514f0
mov byte [edi + 0x18], 0
cmp byte [0x5323f1], 0
je 0x4514ad
push ebp
push 0x800
lea edx, [esp + 0x135c]
push edx
push str.Rar_MD
call fcn.0049dcc0
test al, al
je 0x45173a
push 0x800
lea eax, [esp + 0x3588]
push eax
push 0x55ea48
lea ecx, [esp + 0x1360]
push ecx
call fcn.0045f4f0
push ebp
push ebp
lea edx, [esp + 0x358c]
push edx
call fcn.0043c440
test eax, eax
jne 0x45148d
push ebp
call fcn.0049b330
push 0x800
push 0x54fd12
mov ecx, 0x540eb0
call fcn.00414de0
lea eax, [esp + 0x3584]
push eax
mov ecx, 0x550d14
call fcn.0047e700
mov eax, 2
push 0x800
push 0x548918
mov ecx, 0x540eb0
mov dword [0x54aa50], eax
mov dword [0x54aa4c], eax
mov byte [0x54aaa8], 0
call fcn.00414dc0
push 0x800
push 0x55ea48
push 0x55ea48
push 0x548918
call fcn.0045f4f0
mov ecx, dword [0x5410bc]
mov dword [0x54ccb0], ecx
push ebp
mov ecx, 0x540eb0
call fcn.00419370
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x3584]
push edx
call esi
lea eax, [esp + 0x1354]
push eax
call esi
jmp 0x45173a
lea ecx, [esp + 0x3584]
push ecx
push 0x1f7
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 8
jmp 0x451730
push 0x800
push 0x55ea48
push 0x55ea48
mov ecx, edi
call fcn.0044b4e0
push ebp
push ebp
push 0x55ea48
call fcn.0043c440
test eax, eax
jne 0x4514dc
mov dword [esp + 0x10], esi
jmp 0x45173a
cmp word [0x55ea48], bp
je 0x45173a
push 0x55ea48
jmp 0x451495
cmp byte [0x5323f1], 0
mov ecx, edi
je 0x4516d9
lea edx, [esp + 0x23a4]
push edx
call fcn.0044c750
test al, al
je 0x451526
push 0x800
lea eax, [esp + 0x23a8]
push eax
lea ecx, [edi + 0x1a]
push ecx
call fcn.0047e340
push ebp
call fcn.0049b330
push 0x800
push 0x54fd12
mov ecx, 0x540eb0
call fcn.00414de0
mov edx, dword [0x5410bc]
push ebp
push str.FlatView
push str.FileList
mov dword [0x54ccb0], edx
call fcn.0046bce0
test eax, eax
je 0x45158a
xor eax, eax
jmp 0x451570
movzx ecx, word [esp + eax + 0x4584]
mov word [esp + eax + 0x1354], cx
add eax, 2
cmp cx, bp
jne 0x451570
jmp 0x4515b3
push 0x800
lea eax, [esp + 0x1358]
push eax
mov ecx, 0x540eb0
call fcn.00414dc0
push 0x800
lea ecx, [esp + 0x1358]
push ecx
call fcn.0045f4a0
lea esi, [edi + 0x1a]
push esi
mov ecx, 0x550d14
call fcn.0047e700
push 0x800
lea edx, [esp + 0x1358]
push edx
lea eax, [esp + 0x358c]
push eax
call fcn.0047e340
push 0x800
push 0x55ea48
lea ecx, [esp + 0x358c]
push ecx
call fcn.0047e380
mov ecx, 0x550e84
call fcn.0047e6d0
lea edx, [esp + 0x3584]
push edx
mov ecx, 0x550e84
call fcn.0047e700
push ebp
push ebp
lea eax, [esp + 0x358c]
push eax
mov ecx, 0x55e9b8
call fcn.0044ae40
test al, al
je 0x451697
lea ecx, [esp + 0x3584]
push ecx
push esi
call fcn.00485df0
test eax, eax
jne 0x451670
lea ecx, [esp + 0x3584]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x451667
cmp dx, bp
je 0x451663
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x451667
add eax, 4
add ecx, 4
cmp dx, bp
jne 0x451641
xor eax, eax
jmp 0x45166c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x451697
lea edx, [esp + 0x3584]
push edx
mov ecx, edi
call fcn.0044e7b0
push 0x50d
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 4
jmp 0x45173a
mov eax, 0x55ea48
call fcn.0044be80
test al, al
je 0x4516b0
push ebp
mov ecx, 0x540eb0
call fcn.00413e30
xor eax, eax
jmp 0x4516c0
movzx ecx, word [esp + eax + 0x3584]
mov word [eax + 0x55ea48], cx
add eax, 2
cmp cx, bp
jne 0x4516c0
jmp 0x45173a
push 0x800
lea esi, [edi + 0x1a]
push esi
push esi
call fcn.0044b4e0
push 0x800
push 0x55ea48
push 0x55ea48
mov ecx, edi
call fcn.0044b4e0
push 0x55ea48
push esi
call fcn.0043bff0
test al, al
je 0x451717
mov dword [esp + 0x10], 1
jmp 0x45173a
push 0x55ea48
push esi
push 0x208
call fcn.004744a0
push eax
call fcn.004ab990
add esp, 0xc
mov ecx, 0x51e7a8
call fcn.004333c0
mov eax, dword [0x534544]
push 0x55ea48
push ebp
push 0x8002
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x451169
push 0x30
push 0x65
call fcn.004744a0
push eax
push 0x1f4
call fcn.004744a0
mov ecx, dword [0x534544]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x451010.174
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x451815
sub eax, 0x10000
jne case.0x451010.174
cmp dword [0x4e9278], 0xffffffff
jne 0x4517d3
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.0046bce0
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4e9278], eax
call fcn.0046bce0
mov dword [0x55ea44], eax
mov edx, dword [ebx + 0x2c]
push edx
lea eax, [esp + 0x54]
push eax
mov ecx, 0x55e9b8
call fcn.0044acf0
mov eax, dword [eax + 0x1010]
test eax, 0x800
je 0x4517fc
mov ecx, dword [0x4e9278]
mov dword [ebx + 0x30], ecx
test eax, 0x4000
je case.0x451010.174
mov edx, dword [0x55ea44]
mov dword [ebx + 0x30], edx
jmp case.0x451010.174
movzx eax, byte [0x540ea8]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x451169
test byte [ebx + 0xc], 2
je case.0x451010.174
mov ebx, dword [ebx + 0x2c]
cmp ebx, dword [0x55ea24]
jae case.0x451010.174
push ebx
mov ecx, 0x55e9b8
call fcn.0044aeb0
mov ebp, eax
mov ebx, 0x4401
call fcn.0044a940
cmp eax, 0x501
jb 0x451868
cmp byte [0x5323f1], 0
je 0x45186d
mov ebx, 0x4411
cmp byte [0x5323f1], 0
mov esi, dword [ebp]
jne 0x4518b2
push 0x800
lea eax, [esp + 0x1358]
push eax
mov ecx, edi
call fcn.0044b4b0
mov edx, dword [ebp]
push 0x800
lea ecx, [esp + 0x4588]
push ecx
push edx
lea eax, [esp + 0x1360]
push eax
call fcn.0045f4f0
lea esi, [esp + 0x4584]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4518b7
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x4518fb
push esi
or ebx, 0x10
call fcn.0045fb00
mov esi, eax
test esi, esi
je 0x4518f6
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4518e0
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x4518fb
mov esi, str.dummy
cmp byte [0x5323f1], 0
je 0x451922
movzx ecx, word [esi]
push ecx
call fcn.0045f470
test al, al
je 0x451922
movzx edx, word [esi + 2]
add esi, 2
push edx
call fcn.0045f470
test al, al
jne 0x451911
mov ecx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 0x2b4
lea eax, [esp + 0x10a8]
push eax
push ecx
push esi
call edi
test eax, eax
setne al
test al, al
jne 0x451974
test bl, 0x10
jne 0x451a93
mov eax, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea edx, [esp + 0x10a8]
push edx
push eax
push esi
call edi
test eax, eax
setne al
test al, al
je 0x451a93
push 0xc8
lea ecx, [esp + 0x12b8]
push ecx
lea edx, [esp + 0x33fc]
push edx
call fcn.0047e340
test byte [ebp + 0x24], 0x40
je 0x4519b1
push 0xc8
push 0x618
call fcn.004744a0
push eax
lea eax, [esp + 0x33fc]
push eax
call fcn.0047e340
test byte [ebp + 0x24], 0x80
je 0x4519d4
push 0xc8
push 0x619
call fcn.004744a0
push eax
lea ecx, [esp + 0x33fc]
push ecx
call fcn.0047e340
test dword [ebp + 0x24], 0x100
je 0x4519fa
push 0xc8
push 0x61a
call fcn.004744a0
push eax
lea edx, [esp + 0x33fc]
push edx
call fcn.0047e340
test dword [ebp + 0x24], 0x200
je 0x451a20
push 0xc8
push 0x61b
call fcn.004744a0
push eax
lea eax, [esp + 0x33fc]
push eax
call fcn.0047e340
cmp word [esp + 0x33f4], 0
jne 0x451a45
mov edx, dword [ebp]
push 0xc8
lea ecx, [esp + 0x33f8]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.0044bdf0
movzx eax, byte [0x5323f1]
mov esi, dword [esp + 0x14]
add eax, 2
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x33f8]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
push 0x1074
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x10a4]
or dword [esi + 0xc], 0x1000
mov dword [esi + 0x28], eax
jmp case.0x451010.174
mov esi, dword [esp + 0x14]
or dword [esi + 0xc], 0x1000
jmp case.0x451010.174
mov edx, dword [esp + 0x558c]
push ebx
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x45116b