Function at 0x140051f3c
Capabilities:
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x5600
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x55f0], rax
mov rsi, qword [rsp + 0x5660]
mov r10, r9
mov eax, r8d
mov rdi, rdx
mov rbp, rcx
cmp r8d, 0x4e
jne 0x140052b30
mov ecx, dword [rsi + 0x10]
xor ebx, ebx
mov rax, rbx
lea rdx, [0x1400feb60]
cmp dword [rax + rdx], ecx
je 0x140051fa4
add rax, 4
cmp rax, 0x1c
jb 0x140051f8c
jmp 0x140051fbc
mov rcx, qword [0x14014aae0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x140052a06
je 0x1400529ff
cmp eax, 0xffffff4f
je 0x140052787
cmp eax, 0xffffff50
je 0x14005229a
cmp eax, 0xffffff51
je 0x1400521a5
cmp eax, 0xffffff65
je 0x14005204c
cmp eax, 0xffffff8e
jne 0x140052a69
lea rdx, str.SingleClick
lea rcx, str.FileList
xor r8d, r8d
call fcn.14006d3c4
cmp eax, ebx
je 0x140052a69
mov rcx, rbp
call fcn.14004c424
cmp eax, ebx
je 0x140052a69
call fcn.1400c7b74
sub eax, dword [0x1401767f0]
cmp eax, 0x3e8
jle 0x140052a69
jmp 0x140052a5c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
mov r12w, ax
shr r12d, 0xf
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13w, ax
shr r13d, 0xf
and r13d, 1
cmp word [rsi + 0x18], 0x79
jne 0x1400520a6
cmp edi, ebx
jne 0x14005209e
cmp r12d, ebx
je 0x1400520b7
mov rcx, rbp
call fcn.14004decc
cmp edi, ebx
jne 0x140052a69
cmp r12d, ebx
jne 0x140052a69
cmp r13d, ebx
jne 0x140052a69
movzx ecx, word [rsi + 0x18]
sub ecx, 9
je 0x140052176
sub ecx, 4
je 0x14005214e
sub ecx, 0x13
je 0x140052141
sub ecx, 0xd
je 0x140052141
sub ecx, 0x43
je 0x140052123
sub ecx, 1
je 0x140052116
sub ecx, 2
je 0x140052105
cmp ecx, 1
jne 0x140052a69
lea rcx, [0x140155380]
call fcn.140051918
jmp 0x140052a69
lea rcx, [0x14014aae8]
call fcn.140007400
jmp 0x140052a69
mov rcx, rbp
call fcn.14004c5dc
jmp 0x140052a69
mov rcx, qword [0x14014aae0]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140052a69
mov rcx, rbp
call fcn.14004de10
jmp 0x140052a69
call fcn.1400c7b74
xor r8d, r8d
mov dl, 1
mov rcx, rbp
mov dword [0x1401767f0], eax
call fcn.140051a3c
call fcn.1400c7b74
mov dword [0x1401767f0], eax
jmp 0x140052a69
cmp qword [0x140149a08], rbx
je 0x140052a69
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbp]
jne 0x140052a69
mov rcx, qword [0x140149a08]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140052a69
lea rcx, [0x1401575c0]
call fcn.140013ef4
cmp dword [0x140149a04], ebx
jne 0x14005228b
cmp byte [rbp + 0x102a], bl
jne 0x14005228b
cmp byte [0x140148965], bl
je 0x1400521de
test al, 0x40
jne 0x1400521de
cmp byte [rbp + 0x28], bl
je 0x14005228b
cmp byte [rbp + 0x28], bl
je 0x1400521ec
mov word [rbp + 0x2a], bx
jmp 0x140052a69
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x38], ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x14005228b
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x13a0]
lea rcx, [0x1401756e0]
call fcn.14004b388
lea rcx, [rsp + 0x13a0]
lea rsi, [rbp + 0x2a]
call fcn.1400615e8
mov r8d, 0x800
mov rcx, rsi
mov rdx, rax
call fcn.1400805a0
mov rcx, qword [rbp]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdi, [0x1400e0bd8]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
jne 0x140052a69
movabs rax, 1
jmp 0x140052b41
mov word [0x1401757f0], bx
mov rdx, qword [rsi + 0x30]
mov word [rsp + 0x45f0], bx
cmp rdx, rbx
jne 0x1400522fc
cmp byte [rbp + 0x28], bl
je 0x140052a69
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rbp]
lea r12, [0x1401757f0]
lea r9, [rsp + 0x30]
mov edi, 0x800
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x30], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14005235f
lea r12, [0x1401757f0]
mov edi, 0x800
mov rcx, r12
mov r8, rdi
call fcn.1400805a0
mov eax, dword [rsi + 0x40]
cmp rax, qword [0x1401757b8]
jae 0x14005235f
mov r8, qword [rsi + 0x40]
lea rdx, [rsp + 0x13a0]
lea rcx, [0x1401756e0]
call fcn.14004b388
lea rdx, [rsp + 0x13a0]
lea rcx, [rsp + 0x45f0]
mov r8, rdi
call fcn.1400805a0
lea rcx, [rsp + 0x45f0]
call fcn.1400615e8
mov word [rax], bx
cmp word [0x1401757f0], bx
je 0x140052a69
cmp byte [rbp + 0x28], bl
je 0x1400524e8
mov byte [rbp + 0x28], bl
cmp byte [0x140148965], bl
je 0x1400524a6
lea rdx, [rsp + 0x13a0]
lea rcx, str.Rar_MD
xor r9d, r9d
mov r8, rdi
call fcn.1400a287c
cmp al, bl
je 0x140052767
lea r8, [rsp + 0x35f0]
lea rcx, [rsp + 0x13a0]
mov r9, rdi
mov rdx, r12
call fcn.1400611e8
lea rcx, [rsp + 0x35f0]
xor r8d, r8d
xor edx, edx
call fcn.14003ca1c
cmp eax, ebx
jne 0x140052487
xor ecx, ecx
call fcn.14009e138
lea r13, [0x1401575c0]
lea rdx, [0x140166802]
mov rcx, r13
mov r8, rdi
call fcn.140014e94
lea rdx, [rsp + 0x35f0]
lea rcx, [0x140167808]
call fcn.140080bc0
lea rdx, [0x14015f3ec]
mov r8, rdi
mov rcx, r13
mov dword [0x140161524], 2
mov dword [0x140161520], 2
mov byte [0x140161588], bl
call fcn.140014e74
lea rcx, [0x14015f3ec]
mov r9, rdi
mov r8, r12
mov rdx, r12
call fcn.1400611e8
mov edx, dword [0x1401579d4]
mov rcx, r13
mov dword [0x140163790], edx
xor edx, edx
call fcn.140019454
lea rcx, [rsp + 0x35f0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0x13a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140052767
mov ecx, 0x1f7
call fcn.140076080
lea rdx, [rsp + 0x35f0]
mov rcx, rax
call fcn.1400b189c
jmp 0x14005275b
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14004bca8
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.14003ca1c
cmp eax, ebx
je 0x14005273b
cmp word [0x1401757f0], bx
je 0x140052767
mov ecx, 0x1f7
call fcn.140076080
mov rdx, r12
jmp 0x140052499
mov rcx, rbp
cmp byte [0x140148965], bl
je 0x14005270a
lea rdx, [rsp + 0x2400]
call fcn.14004cfb0
cmp al, bl
je 0x14005251c
lea rcx, [rbp + 0x2a]
lea rdx, [rsp + 0x2400]
mov r8, rdi
call fcn.1400805a0
xor ecx, ecx
call fcn.14009e138
lea r13, [0x1401575c0]
lea rdx, [0x140166802]
mov rcx, r13
mov r8, rdi
call fcn.140014e94
mov edx, dword [0x1401579d4]
lea rcx, str.FileList
mov dword [0x140163790], edx
lea rdx, str.FlatView
xor r8d, r8d
call fcn.14006d3c4
cmp eax, ebx
je 0x140052580
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x45f0]
add rcx, 2
mov word [rsp + rcx + 0x139e], ax
cmp ax, bx
jne 0x140052565
jmp 0x1400525a3
lea rdx, [rsp + 0x13a0]
mov r8, rdi
mov rcx, r13
call fcn.140014e74
lea rcx, [rsp + 0x13a0]
mov rdx, rdi
call fcn.14006119c
lea rsi, [rbp + 0x2a]
lea rcx, [0x140167808]
mov rdx, rsi
call fcn.140080bc0
lea rdx, [rsp + 0x13a0]
lea rcx, [rsp + 0x35f0]
mov r8, rdi
call fcn.1400805a0
lea rcx, [rsp + 0x35f0]
mov r8, rdi
mov rdx, r12
call fcn.1400805dc
lea rcx, [0x140167ae8]
call fcn.140080b98
lea rdx, [rsp + 0x35f0]
lea rcx, [0x140167ae8]
call fcn.140080bc0
lea rdx, [rsp + 0x35f0]
lea rcx, [0x1401756e0]
xor r9d, r9d
xor r8d, r8d
call fcn.14004b508
cmp al, bl
je 0x14005267c
lea rdx, [rsp + 0x35f0]
mov rcx, rsi
call fcn.1400883c8
cmp eax, ebx
jne 0x140052655
lea rdx, [rsp + 0x35f0]
sub rdx, rsi
movzx eax, word [rsi]
movzx ecx, word [rsi + rdx]
sub eax, ecx
jne 0x140052651
add rsi, 2
test ecx, ecx
jne 0x14005263e
cmp eax, ebx
jne 0x14005267c
lea rdx, [rsp + 0x35f0]
mov rcx, rbp
call fcn.14004f3a0
mov ecx, 0x50d
call fcn.140076080
mov rcx, rax
call fcn.1400b189c
jmp 0x140052767
mov ecx, 0x20
mov rbp, r12
cmp word [0x1401757f0], cx
jne 0x140052697
add rbp, 2
cmp word [rbp], cx
je 0x14005268d
cmp word [rbp], bx
je 0x1400526ef
mov rdi, rbp
movzx edx, word [rdi]
lea rcx, str._____:
call fcn.1400c7b54
cmp rax, rbx
jne 0x1400526ef
add rdi, 2
cmp word [rdi], bx
jne 0x1400526a0
lea rdi, [0x1400e1dd8]
mov rsi, rbp
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1400526ef
lea rdi, [0x1400e0bd8]
mov rsi, rbp
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1400526ef
xor edx, edx
mov rcx, r13
call fcn.1400159ec
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x35f0]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, bx
jne 0x1400526f2
jmp 0x140052767
lea r8, [rbp + 0x2a]
lea rdx, [rbp + 0x2a]
mov r9, rdi
call fcn.14004bca8
mov r9, rdi
mov r8, r12
mov rdx, r12
mov rcx, rbp
call fcn.14004bca8
lea rcx, [rbp + 0x2a]
mov rdx, r12
call fcn.14003bde4
cmp al, bl
je 0x140052742
mov ebx, 1
jmp 0x140052767
mov ecx, 0x208
call fcn.140076080
lea rdx, [rbp + 0x2a]
mov r8, r12
mov rcx, rax
call fcn.1400b189c
lea rcx, [0x140134b90]
call fcn.1400330fc
mov rcx, qword [0x14014aae0]
mov r9, r12
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rax, ebx
jmp 0x140052b41
test byte [rsi + 0x18], 2
je 0x140052a69
mov rdx, qword [rsi + 0x40]
cmp rdx, qword [0x1401757b8]
jae 0x140052a69
lea rcx, [0x1401756e0]
call fcn.14004b5b8
mov r14d, 0x4401
mov r13, rax
call fcn.14004b0ac
cmp eax, 0x501
jb 0x1400527cb
cmp byte [0x140148965], bl
je 0x1400527d1
mov r14d, 0x4411
mov r12, qword [r13]
cmp byte [0x140148965], bl
jne 0x140052819
mov edi, 0x800
lea rdx, [rsp + 0x13a0]
mov rcx, rbp
mov r8, rdi
call fcn.14004bc74
mov rdx, qword [r13]
lea r8, [rsp + 0x45f0]
lea rcx, [rsp + 0x13a0]
mov r9, rdi
call fcn.1400611e8
lea r12, [rsp + 0x45f0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
jbe 0x14005286a
mov rcx, r12
or r14d, 0x10
call fcn.140061804
mov r12, rax
cmp rax, rbx
je 0x140052863
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x101
jbe 0x14005286a
lea r12, str.dummy
cmp byte [0x140148965], bl
je 0x140052886
jmp 0x140052878
add r12, 2
movzx ecx, word [r12]
call fcn.140061180
cmp al, bl
jne 0x140052874
mov edx, dword [r13 + 0x20]
mov edi, 0x2b8
lea r8, [rsp + 0x10e0]
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
jne 0x1400528eb
test r14b, 0x10
jne 0x1400529f8
mov edx, dword [r13 + 0x20]
lea r8, [rsp + 0x10e0]
or r14d, 0x10
mov r9d, edi
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rbx
setne al
cmp al, bl
je 0x1400529f8
mov edi, 0xc8
lea rdx, [rsp + 0x12f8]
lea rcx, [rsp + 0x3460]
mov r8, rdi
call fcn.1400805a0
test byte [r13 + 0x2c], 0x40
je 0x14005292c
mov ecx, 0x618
call fcn.140076080
lea rcx, [rsp + 0x3460]
mov r8, rdi
mov rdx, rax
call fcn.1400805a0
test byte [r13 + 0x2c], 0x80
je 0x140052950
mov ecx, 0x619
call fcn.140076080
lea rcx, [rsp + 0x3460]
mov r8, rdi
mov rdx, rax
call fcn.1400805a0
bt dword [r13 + 0x2c], 8
jae 0x140052975
mov ecx, 0x61a
call fcn.140076080
lea rcx, [rsp + 0x3460]
mov r8, rdi
mov rdx, rax
call fcn.1400805a0
bt dword [r13 + 0x2c], 9
jae 0x14005299a
mov ecx, 0x61b
call fcn.140076080
lea rcx, [rsp + 0x3460]
mov r8, rdi
mov rdx, rax
call fcn.1400805a0
cmp word [rsp + 0x3460], bx
jne 0x1400529bb
mov rdx, qword [r13]
lea r8, [rsp + 0x3460]
mov r9, rdi
mov rcx, rbp
call fcn.14004c630
movzx eax, byte [0x140148965]
movsxd r8, dword [rsi + 0x1c]
mov rcx, qword [rbp]
add eax, 2
lea r9, [rsp + 0x30]
mov edx, 0x1074
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x3460]
mov qword [rsp + 0x48], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x10e8]
mov dword [rsi + 0x3c], edx
bts dword [rsi + 0x18], 0xc
jmp 0x140052a69
call fcn.14002df04
jmp 0x140052a69
cmp eax, 0xffffff94
je 0x140052b20
cmp eax, 0xfffffff4
je 0x140052a70
cmp eax, 0xfffffffd
je 0x140052a50
cmp eax, 0xffffffff
jne 0x140052a69
mov ecx, 0x65
call fcn.140076080
mov ecx, 0x1f4
mov rdi, rax
call fcn.140076080
mov rcx, qword [0x14014aae0]
mov r9d, 0x30
mov r8, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140052a69
mov rcx, rbp
call fcn.14004c424
cmp eax, ebx
je 0x140052a69
xor r8d, r8d
mov dl, 1
mov rcx, rbp
call fcn.140051a3c
xor eax, eax
jmp 0x140052b41
mov eax, dword [rsi + 0x18]
sub eax, 1
je 0x140052b0f
cmp eax, 0x10000
jne 0x140052a69
cmp dword [0x1400feb5c], 0xffffffff
jne 0x140052aca
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xff0000
call fcn.14006d3c4
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xd9213
mov dword [0x1400feb5c], eax
call fcn.14006d3c4
mov dword [0x1401757ec], eax
mov r8, qword [rsi + 0x48]
lea rdx, [rsp + 0x80]
lea rcx, [0x1401756e0]
call fcn.14004b388
mov ecx, dword [rax + 0x1010]
bt ecx, 0xb
jae 0x140052af7
mov eax, dword [0x1400feb5c]
mov dword [rsi + 0x50], eax
bt ecx, 0xe
jae 0x140052a69
mov eax, dword [0x1401757ec]
mov dword [rsi + 0x50], eax
jmp 0x140052a69
mov al, byte [0x1401575b4]
neg al
sbb rax, rax
and rax, 0x20
jmp 0x140052b41
mov edx, dword [rsi + 0x1c]
mov rcx, rbp
call fcn.14005171c
jmp 0x140052a69
mov r9, rsi
mov r8, r10
mov edx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x55f0]
xor rcx, rsp
call fcn.1400c6350
add rsp, 0x5600
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret