Function at 0x1400417c4
Capabilities:
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x44e8]
mov eax, 0x45e8
call fcn.1400ec1b0
sub rsp, rax
mov rax, qword [0x14013b1d0]
xor rax, rsp
mov qword [rbp + 0x44d0], rax
mov rsi, qword [rbp + 0x4550]
mov r11, r9
mov eax, r8d
mov r10, rdx
mov rdi, rcx
cmp r8d, 0x4e
jne 0x140042426
mov ecx, dword [rsi + 0x10]
xor r13d, r13d
mov eax, r13d
lea rdx, [0x140138200]
cmp dword [rax + rdx], ecx
je 0x140041835
add rax, 4
cmp rax, 0x1c
jb 0x14004181d
jmp 0x14004184d
mov rcx, qword [0x140142ba0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x1400422ef
je 0x1400422e4
cmp eax, 0xffffff4f
je 0x14004208f
cmp eax, 0xffffff50
je 0x140041b57
cmp eax, 0xffffff51
je 0x140041a35
cmp eax, 0xffffff65
je 0x1400418dd
cmp eax, 0xffffff8e
jne 0x140042356
xor r8d, r8d
lea rdx, str.SingleClick
lea rcx, str.FileList
call fcn.14009dbd0
test eax, eax
je 0x140042356
mov rcx, rdi
call fcn.140040488
test eax, eax
je 0x140042356
call fcn.1400f2fbc
sub eax, dword [0x14016ec50]
cmp eax, 0x3e8
jle 0x140042356
jmp 0x140042344
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 1
movzx r14d, ax
shr r14d, 0xf
and r14d, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r15d, ax
lea ecx, [rbx + 0x10]
shr r15d, 0xf
and r15d, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
cmp word [rsi + 0x18], 0x79
movsx r12d, ax
jne 0x140041932
test r14d, r14d
jne 0x14004192a
test r15d, r15d
je 0x140041944
mov rcx, rdi
call fcn.140044750
test r14d, r14d
jne 0x140042356
test r15d, r15d
jne 0x140042356
bt r12d, 0xf
jb 0x140042356
movzx ecx, word [rsi + 0x18]
sub ecx, 9
je 0x140041a06
sub ecx, 4
je 0x1400419db
sub ecx, 0x13
je 0x1400419ce
sub ecx, 0xd
je 0x1400419ce
sub ecx, 0x43
je 0x1400419b0
sub ecx, ebx
je 0x1400419a3
sub ecx, 2
je 0x140041992
cmp ecx, ebx
jne 0x140042356
lea rcx, [0x140168030]
call fcn.140043a04
jmp 0x140042356
lea rcx, [0x140167be0]
call fcn.140001cd4
jmp 0x140042356
mov rcx, rdi
call fcn.1400439a8
jmp 0x140042356
mov rcx, qword [0x140142ba0]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140042356
mov rcx, rdi
call fcn.140040894
jmp 0x140042356
call fcn.1400f2fbc
xor r9d, r9d
mov dword [0x14016ec50], eax
xor r8d, r8d
mov dl, bl
mov rcx, rdi
call fcn.1400412b8
call fcn.1400f2fbc
mov dword [0x14016ec50], eax
jmp 0x140042356
cmp qword [0x140142ba8], r13
je 0x140042356
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rdi + 0x60]
jne 0x140042356
mov rcx, qword [0x140142ba8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140042356
lea rcx, [0x140165250]
call fcn.140004f60
cmp dword [0x140143d5c], r13d
jne 0x140041b4d
cmp byte [rdi + 0x1082], r13b
jne 0x140041b4d
cmp byte [0x140142c44], r13b
je 0x140041a75
test al, 0x40
jne 0x140041a75
cmp byte [rdi + 0x80], r13b
je 0x140041b4d
cmp byte [rdi + 0x80], r13b
je 0x140041a8b
mov word [rdi + 0x82], r13w
jmp 0x140042356
mov eax, dword [rsi + 0x1c]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 0x60]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], r13d
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140041b4d
mov r8, qword [rsp + 0x58]
lea rdx, [rbp + 0x240]
lea rcx, [0x14016dbf0]
call fcn.14003d5f4
lea rcx, [rbp + 0x240]
lea rbx, [rdi + 0x82]
call fcn.140078d7c
mov rdx, rax
mov r8d, 0x800
mov rcx, rbx
call fcn.14008c7ec
mov rcx, qword [rdi + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
movzx eax, word [rbx]
cmp ax, word [0x14010a598]
jne 0x140042356
movzx eax, word [rbx + 2]
cmp ax, word [0x14010a59a]
jne 0x140042356
movzx eax, word [rbx + 4]
cmp ax, word [0x14010a59c]
jne 0x140042356
mov eax, 1
jmp 0x140042437
mov word [0x14016ec60], r13w
mov ebx, 1
mov rdx, qword [rsi + 0x30]
mov word [rbp + 0x34d0], r13w
test rdx, rdx
jne 0x140041bc2
cmp byte [rdi + 0x80], r13b
je 0x140042356
mov eax, dword [rsi + 0x1c]
lea r15, [0x14016ec60]
mov rcx, qword [rdi + 0x60]
lea r9, [rsp + 0x30]
mov r14d, 0x800
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov dword [rsp + 0x50], r14d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140041c23
mov r14d, 0x800
lea r15, [0x14016ec60]
mov r8d, r14d
mov rcx, r15
call fcn.14008c7ec
mov eax, dword [rsi + 0x40]
cmp rax, qword [0x14016dbf8]
jae 0x140041c23
mov r8, qword [rsi + 0x40]
lea rdx, [rbp + 0x240]
lea rcx, [0x14016dbf0]
call fcn.14003d5f4
mov r8d, r14d
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x34d0]
call fcn.14008c7ec
lea rcx, [rbp + 0x34d0]
call fcn.140078d7c
mov word [rax], r13w
cmp word [0x14016ec60], r13w
je 0x140042356
cmp byte [rdi + 0x80], r13b
je 0x140041dca
mov byte [rdi + 0x80], r13b
cmp byte [0x140142c44], r13b
je 0x140041d6d
xor r9d, r9d
lea rdx, [rbp + 0x24d0]
mov r8, r14
lea rcx, str.Rar_MD
call fcn.1400c2dc8
test al, al
je 0x14004206c
mov r9, r14
lea r8, [rbp + 0x14d0]
mov rdx, r15
lea rcx, [rbp + 0x24d0]
call fcn.140078870
xor r8d, r8d
lea rcx, [rbp + 0x14d0]
xor edx, edx
call fcn.140068e88
test eax, eax
jne 0x140041d4f
xor ecx, ecx
call fcn.1400be034
lea r12, [0x140165250]
mov r8, r14
mov rcx, r12
lea rdx, [0x140159a62]
call fcn.140004e60
lea rdx, [rbp + 0x14d0]
lea rcx, [0x14015aa68]
call fcn.14008c86c
mov r8, r14
mov dword [0x140154788], 2
lea rdx, [0x140152650]
mov dword [0x140154784], 2
mov rcx, r12
mov byte [0x1401547f8], r13b
call fcn.140005234
mov r9, r14
lea rcx, [0x140152650]
mov r8, r15
mov rdx, r15
call fcn.140078870
mov eax, dword [0x140165254]
xor edx, edx
mov rcx, r12
mov dword [0x140156a00], eax
call fcn.14000403c
lea rcx, [rbp + 0x14d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x24d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14004206c
mov ecx, 0x1f7
call fcn.1400868b8
mov rcx, rax
lea rdx, [rbp + 0x14d0]
call fcn.1400cf438
jmp 0x140042060
mov r9, r14
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.140040320
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140068e88
test eax, eax
je 0x14004206f
cmp word [0x14016ec60], r13w
mov rbx, r13
je 0x14004206f
mov ecx, 0x1f7
call fcn.1400868b8
mov rcx, rax
mov rdx, r15
call fcn.1400cf438
lea rcx, [0x140179130]
call fcn.140062d54
jmp 0x14004206f
cmp byte [0x140142c44], r13b
mov rcx, rdi
je 0x140042013
lea rdx, [rbp + 0x240]
mov qword [rbp + 0x12d0], r13
mov qword [rbp + 0x12d8], r13
mov qword [rbp + 0x12e0], r13
call fcn.14003fad4
test al, al
je 0x140041e15
lea rcx, [rdi + 0x82]
mov r8, r14
lea rdx, [rbp + 0x240]
call fcn.14008c7ec
xor ecx, ecx
call fcn.1400be034
lea r12, [0x140165250]
mov r8, r14
mov rcx, r12
lea rdx, [0x140159a62]
call fcn.140004e60
mov eax, dword [0x140165254]
lea rdx, str.FlatView
xor r8d, r8d
mov dword [0x140156a00], eax
lea rcx, str.FileList
call fcn.14009dbd0
test eax, eax
je 0x140041e79
mov rcx, r13
movzx eax, word [rbp + rcx + 0x34d0]
mov word [rbp + rcx + 0x24d0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140041e5e
jmp 0x140041e9a
mov r8, r14
lea rdx, [rbp + 0x24d0]
mov rcx, r12
call fcn.140005234
mov rdx, r14
lea rcx, [rbp + 0x24d0]
call fcn.1400773b8
lea rbx, [rdi + 0x82]
mov rdx, rbx
lea rcx, [0x14015aa68]
call fcn.14008c86c
mov r8, r14
lea rdx, [rbp + 0x24d0]
lea rcx, [rbp + 0x14d0]
call fcn.14008c7ec
mov r8, r14
lea rcx, [rbp + 0x14d0]
mov rdx, r15
call fcn.14008c7b4
lea rcx, [0x14015ad68]
call fcn.14008ca28
lea rdx, [rbp + 0x14d0]
lea rcx, [0x14015ad68]
call fcn.14008c86c
xor r9d, r9d
lea rdx, [rbp + 0x14d0]
xor r8d, r8d
lea rcx, [0x14016dbf0]
call fcn.14003dba4
test al, al
je 0x140041f6e
lea rdx, [rbp + 0x14d0]
mov rcx, rbx
call fcn.14008f8d8
test eax, eax
jne 0x140041f48
lea rdx, [rbp + 0x14d0]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x140041f44
add rbx, 2
test ecx, ecx
jne 0x140041f31
test eax, eax
jne 0x140041f6e
lea rdx, [rbp + 0x14d0]
mov rcx, rdi
call fcn.1400401d0
mov ecx, 0x50d
call fcn.1400868b8
mov rcx, rax
call fcn.1400cf438
jmp 0x14004206c
mov ecx, 0x20
mov rbx, r15
cmp word [0x14016ec60], cx
jne 0x140041f88
add rbx, 2
cmp word [rbx], cx
je 0x140041f7f
cmp word [rbx], r13w
je 0x140041ff8
mov rdi, rbx
movzx edx, word [rdi]
lea rcx, str._____:
call fcn.1400ed380
test rax, rax
jne 0x140041ff8
add rdi, 2
cmp word [rdi], r13w
jne 0x140041f91
movzx eax, word [rbx]
cmp ax, word [0x14010a890]
jne 0x140041fc8
movzx eax, word [rbx + 2]
cmp ax, word [0x14010a892]
je 0x140041ff8
movzx eax, word [rbx]
cmp ax, word [0x14010a598]
jne 0x140041fee
movzx eax, word [rbx + 2]
cmp ax, word [0x14010a59a]
jne 0x140041fee
movzx eax, word [rbx + 4]
cmp ax, word [0x14010a59c]
je 0x140041ff8
xor edx, edx
mov rcx, r12
call fcn.1400069b0
mov rcx, r13
movzx eax, word [rbp + rcx + 0x14d0]
mov word [rcx + r15], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140041ffb
jmp 0x14004206c
lea rsi, [rdi + 0x82]
mov r9, r14
mov r8, rsi
mov rdx, rsi
call fcn.140040320
mov r9, r14
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.140040320
mov rdx, r15
mov rcx, rsi
call fcn.1400691bc
test al, al
jne 0x14004206f
mov ecx, 0x209
call fcn.1400868b8
mov rcx, rax
mov r8, r15
mov rdx, rsi
call fcn.1400cf438
lea rcx, [0x140179130]
call fcn.140062d54
mov rbx, r13
mov rcx, qword [0x140142ba0]
mov r9, r15
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, rbx
jmp 0x140042437
test byte [rsi + 0x18], 3
je 0x140042356
mov rdx, qword [rsi + 0x40]
cmp rdx, qword [0x14016dbf8]
jae 0x140042356
lea rcx, [0x14016dbf0]
call fcn.14003d800
mov cl, byte [0x140142c44]
mov r12, rax
mov eax, 0x4411
test cl, cl
mov rbx, qword [r12]
lea r15d, [rax - 0x10]
cmovne r15d, eax
jne 0x140042128
mov ebx, 1
lea rcx, [rbp + 0x24d0]
cmp dword [0x140142c48], ebx
mov r14d, 0x800
jne 0x1400420f8
mov edx, r14d
call fcn.1400c3acc
jmp 0x140042107
lea rdx, [rdi + 0x1084]
mov r8, r14
call fcn.14008c7ec
mov rdx, qword [r12]
lea r8, [rbp + 0x34d0]
mov r9, r14
lea rcx, [rbp + 0x24d0]
call fcn.140078870
lea rbx, [rbp + 0x34d0]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rbx + rax*2], r13w
jne 0x14004212f
cmp rax, 0x101
ja 0x140042147
cmp word [rbx], r13w
jne 0x140042175
mov rcx, rbx
or r15d, 0x10
call fcn.14007812c
mov rbx, rax
test rax, rax
je 0x14004216e
inc r14
cmp word [rax + r14*2], r13w
jne 0x14004215b
cmp r14, 0x101
jbe 0x140042175
lea rbx, str.dummy
cmp byte [0x140142c44], r13b
je 0x140042190
jmp 0x140042184
add rbx, 2
movzx ecx, word [rbx]
call fcn.140078834
test al, al
jne 0x140042180
mov edx, dword [r12 + 0x20]
lea r8, [rbp - 0x80]
mov r14d, 0x2b8
mov dword [rsp + 0x20], r15d
mov r9d, r14d
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
setne al
test al, al
jne 0x1400421f0
test r15b, 0x10
jne 0x1400422dd
mov edx, dword [r12 + 0x20]
lea r8, [rbp - 0x80]
or r15d, 0x10
mov r9d, r14d
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
setne al
test al, al
je 0x1400422dd
mov ebx, 0xc8
lea rdx, [rbp + 0x198]
mov r8d, ebx
lea rcx, [rbp + 0x1340]
call fcn.14008c7ec
mov eax, dword [r12 + 0x58]
test eax, eax
jle 0x140042259
cmp eax, 2
jle 0x14004223d
cmp eax, 3
je 0x140042236
cmp eax, 4
je 0x14004222f
cmp eax, 5
jne 0x140042259
mov ecx, 0x61b
jmp 0x140042242
mov ecx, 0x61a
jmp 0x140042242
mov ecx, 0x618
jmp 0x140042242
mov ecx, 0x619
call fcn.1400868b8
mov r8, rbx
lea rcx, [rbp + 0x1340]
mov rdx, rax
call fcn.14008c7ec
cmp word [rbp + 0x1340], r13w
jne 0x1400422a5
mov ecx, dword [r12 + 0x20]
call fcn.140068c14
test al, al
je 0x14004228f
mov ecx, 0x573
call fcn.1400868b8
mov rdx, rax
lea rcx, [rbp + 0x1340]
mov r8, rbx
call fcn.14008c7ec
jmp 0x1400422a5
mov rdx, qword [r12]
lea r8, [rbp + 0x1340]
mov r9, rbx
mov rcx, rdi
call fcn.140040128
movzx eax, byte [0x140142c44]
lea r9, [rsp + 0x30]
movsxd r8, dword [rsi + 0x1c]
add eax, 2
mov rcx, qword [rdi + 0x60]
mov edx, 0x1074
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x1340]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rbp - 0x78]
mov dword [rsi + 0x3c], eax
bts dword [rsi + 0x18], 0xc
jmp 0x140042356
xor edx, edx
xor ecx, ecx
call fcn.14000e710
jmp 0x140042356
cmp eax, 0xffffff94
je 0x140042416
cmp eax, 0xfffffff4
je 0x14004235d
cmp eax, 0xfffffffd
je 0x140042338
cmp eax, 0xffffffff
jne 0x140042356
mov ecx, 0x65
call fcn.1400868b8
mov ecx, 0x1f4
mov rbx, rax
call fcn.1400868b8
mov rcx, qword [0x140142ba0]
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
call fcn.1400c3b2c
jmp 0x140042356
mov rcx, rdi
call fcn.140040488
test eax, eax
je 0x140042356
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.1400412b8
xor eax, eax
jmp 0x140042437
mov ecx, dword [rsi + 0x18]
sub ecx, 1
je 0x140042405
cmp ecx, 0x10000
jne 0x140042356
or r14, 0xffffffffffffffff
cmp dword [0x14013821c], r14d
jne 0x1400423bc
mov r8d, 0xff0000
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.14009dbd0
mov r8d, 0xd9213
mov dword [0x14013821c], eax
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.14009dbd0
mov dword [0x14016fc60], eax
mov r8, qword [rsi + 0x48]
lea rdx, [rbp + 0x240]
lea rcx, [0x14016dbf0]
call fcn.14003d5f4
mov r14d, 0x800
mov ecx, dword [rax + 0x10a8]
test r14d, ecx
je 0x1400423ed
mov eax, dword [0x14013821c]
mov dword [rsi + 0x50], eax
bt ecx, 0xe
jae 0x140042356
mov eax, dword [0x14016fc60]
mov dword [rsi + 0x50], eax
jmp 0x140042356
mov al, byte [0x14016a2bc]
neg al
sbb rax, rax
and rax, 0x20
jmp 0x140042437
mov edx, dword [rsi + 0x1c]
mov rcx, rdi
call fcn.1400411c8
jmp 0x140042356
mov r9, rsi
mov r8, r11
mov edx, eax
mov rcx, r10
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp + 0x44d0]
xor rcx, rsp
call fcn.1400ec220
add rsp, 0x45e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret