Function at 0x1400457a0
Capabilities:
Create directory
Delete directory
Get file system object information
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2d58
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x2d40], rax
mov rbp, qword [rsp + 0x2dc0]
mov rsi, r9
mov eax, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x4e
jne 0x140046390
mov ecx, dword [rbp + 0x10]
xor esi, esi
mov rax, rsi
lea rdx, [0x1400df2c8]
mov r15d, 0x400
cmp dword [rax + rdx], ecx
je 0x140045810
add rax, 4
cmp rax, 0x1c
jb 0x1400457f2
jmp 0x140045826
mov rcx, qword [0x1400ffd80]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rbp + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x140046266
je 0x14004625f
cmp eax, 0xffffff4f
je 0x140046030
cmp eax, 0xffffff50
je 0x140045b19
cmp eax, 0xffffff51
je 0x140045a25
cmp eax, 0xffffff65
je 0x1400458b6
cmp eax, 0xffffff8e
jne 0x1400462c9
lea rdx, str.SingleClick
lea rcx, str.FileList
xor r8d, r8d
call fcn.14005c490
cmp eax, esi
je 0x1400462c9
mov rcx, rbx
call fcn.14003fcc4
cmp eax, esi
je 0x1400462c9
call fcn.1400a97ac
sub eax, dword [0x140116ba0]
cmp eax, 0x3e8
jle 0x1400462c9
jmp 0x1400462bc
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
mov di, ax
shr edi, 0xf
and edi, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
mov r12w, ax
shr r12d, 0xf
and r12d, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13w, ax
shr r13d, 0xf
and r13d, 1
cmp word [rbp + 0x18], 0x79
jne 0x140045910
cmp edi, esi
jne 0x140045908
cmp r12d, esi
je 0x140045921
mov rcx, rbx
call fcn.1400418c8
cmp edi, esi
jne 0x1400462c9
cmp r12d, esi
jne 0x1400462c9
cmp r13d, esi
jne 0x1400462c9
movzx ecx, word [rbp + 0x18]
sub ecx, 9
je 0x1400459f7
sub ecx, 4
je 0x1400459cf
sub ecx, 0x13
je 0x1400459c2
sub ecx, 0xd
je 0x1400459c2
sub ecx, 0x43
je 0x1400459a4
sub ecx, 1
je 0x140045997
sub ecx, 2
je 0x140045986
cmp ecx, 1
jne 0x1400462c9
lea rcx, [0x1401055a0]
cmp byte [0x1400fec05], sil
je 0x14004597c
call fcn.1400447d4
jmp 0x1400462c9
call fcn.140043d34
jmp 0x1400462c9
lea rcx, [0x1400ffd88]
call fcn.140006e44
jmp 0x1400462c9
mov rcx, rbx
call fcn.14003fe6c
jmp 0x1400462c9
mov rcx, qword [0x1400ffd80]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x5d]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400462c9
mov rcx, rbx
call fcn.140041810
jmp 0x1400462c9
call fcn.1400a97ac
xor r8d, r8d
mov dl, 1
mov rcx, rbx
mov dword [0x140116ba0], eax
call fcn.14004528c
call fcn.1400a97ac
mov dword [0x140116ba0], eax
jmp 0x1400462c9
cmp qword [0x1400ff4a8], rsi
je 0x1400462c9
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx]
jne 0x1400462c9
mov rcx, qword [0x1400ff4a8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1400462c9
lea rcx, [0x140105fe0]
call fcn.140010f8c
cmp dword [0x1400ff4a4], esi
jne 0x140045b0a
cmp byte [rbx + 0x82a], sil
jne 0x140045b0a
cmp byte [0x1400fec05], sil
je 0x140045a61
test al, 0x40
jne 0x140045a61
cmp byte [rbx + 0x28], sil
je 0x140045b0a
cmp byte [rbx + 0x28], sil
je 0x140045a70
mov word [rbx + 0x2a], si
jmp 0x1400462c9
mov eax, dword [rbp + 0x1c]
mov rcx, qword [rbx]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, esi
je 0x140045b0a
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0xb70]
lea rcx, [0x140116200]
call fcn.14003f030
lea rcx, [rsp + 0xb70]
lea rsi, [rbx + 0x2a]
call fcn.140052af8
mov r8, r15
mov rcx, rsi
mov rdx, rax
call fcn.14006b658
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdi, [0x1400c39c0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
jne 0x1400462c9
movabs rax, 1
jmp 0x1400463a1
mov word [0x1401163a0], si
mov rdx, qword [rbp + 0x30]
mov word [rsp + 0x2540], si
cmp rdx, rsi
jne 0x140045b77
cmp byte [rbx + 0x28], sil
je 0x1400462c9
mov eax, dword [rbp + 0x1c]
mov rcx, qword [rbx]
lea r12, [0x1401163a0]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140045bd5
lea r12, [0x1401163a0]
mov r8, r15
mov rcx, r12
call fcn.14006b658
mov eax, dword [rbp + 0x40]
cmp rax, qword [0x140116368]
jae 0x140045bd5
mov r8, qword [rbp + 0x40]
lea rdx, [rsp + 0xb70]
lea rcx, [0x140116200]
call fcn.14003f030
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0x2540]
mov r8, r15
call fcn.14006b658
lea rcx, [rsp + 0x2540]
call fcn.140052af8
mov word [rax], si
cmp word [0x1401163a0], si
je 0x1400462c9
cmp byte [rbx + 0x28], sil
je 0x140045dd0
mov byte [rbx + 0x28], sil
cmp byte [0x1400fec05], sil
je 0x140045da1
lea rdx, [rsp + 0xb70]
lea rcx, str.Rar_MDXXXXXX
call fcn.140086dec
cmp al, sil
je 0x140046010
mov rcx, rsi
movzx eax, word [rsp + rcx + 0xb70]
add rcx, 2
mov word [rsp + rcx + 0x153e], ax
cmp ax, si
jne 0x140045c1d
lea rcx, [rsp + 0x1540]
call fcn.140052588
or r13, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1540]
mov rcx, r13
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045c59
lea rcx, [rsp + 0x1540]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x140045d82
xor ecx, ecx
call fcn.140082a9c
lea r14, [0x140105fe0]
lea rdx, [0x14010e71c]
mov rcx, r14
mov r8, r15
call fcn.140012a08
mov rcx, qword [0x14010ef20]
lea rdx, [rsp + 0x1540]
call fcn.14006bb34
lea rdi, [0x14010af78]
mov r8, r15
mov rcx, r14
mov rdx, rdi
mov dword [0x14010bcac], 2
mov dword [0x14010bca8], 2
mov byte [0x14010bcf2], sil
call fcn.1400129e8
mov rdx, rsi
movzx eax, word [rdx + rdi]
add rdx, 2
mov word [rsp + rdx + 0x1d3e], ax
cmp ax, si
jne 0x140045ceb
lea rcx, [rsp + 0x1d40]
call fcn.140052588
xor eax, eax
lea rdi, [rsp + 0x1d40]
mov rcx, r13
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045d1f
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x1d40]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, si
jne 0x140045d35
mov eax, dword [0x1401063f4]
xor edx, edx
mov rcx, r14
mov dword [0x14010c6b4], eax
call fcn.140016b98
lea rcx, [rsp + 0x1540]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rsp + 0xb70]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140046010
mov ecx, 0x1f7
call fcn.140061d94
lea rdx, [rsp + 0x1540]
mov rcx, rax
call fcn.140096028
jmp 0x140046004
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x140045fe4
cmp word [0x1401163a0], si
je 0x140046010
mov ecx, 0x1f7
call fcn.140061d94
mov rdx, r12
jmp 0x140045d94
cmp byte [0x1400fec05], sil
je 0x140045fce
lea rdx, [rsp + 0xb70]
mov rcx, rbx
call fcn.140040708
cmp al, sil
je 0x140045e06
lea rcx, [rbx + 0x2a]
lea rdx, [rsp + 0xb70]
mov r8, r15
call fcn.14006b658
xor ecx, ecx
call fcn.140082a9c
lea r14, [0x140105fe0]
lea rdx, [0x14010e71c]
mov rcx, r14
mov r8, r15
call fcn.140012a08
mov edx, dword [0x1401063f4]
lea rcx, str.FileList
mov dword [0x14010c6b4], edx
lea rdx, str.FlatView
xor r8d, r8d
call fcn.14005c490
cmp eax, esi
je 0x140045e6a
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x2540]
add rcx, 2
mov word [rsp + rcx + 0x1d3e], ax
cmp ax, si
jne 0x140045e4f
jmp 0x140045e8a
lea rdx, [rsp + 0x1d40]
mov r8, r15
mov rcx, r14
call fcn.1400129e8
lea rcx, [rsp + 0x1d40]
call fcn.140052588
mov rcx, qword [0x14010ef20]
lea rbp, [rbx + 0x2a]
mov rdx, rbp
call fcn.14006bb34
mov rdx, rsi
movzx eax, word [rsp + rdx + 0x1d40]
add rdx, 2
mov word [rsp + rdx + 0x153e], ax
cmp ax, si
jne 0x140045ea0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1540]
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [r12 + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x140045ecc
mov rcx, qword [0x14010ef40]
call fcn.14006b85c
mov rcx, qword [0x14010ef40]
lea rdx, [rsp + 0x1540]
call fcn.14006bb34
lea r8, [rsp + 0x1540]
lea rcx, [0x140116200]
xor r9d, r9d
xor edx, edx
mov byte [rsp + 0x20], sil
call fcn.14003f138
cmp al, sil
je 0x140045f80
lea rdx, [rsp + 0x1540]
mov rcx, rbp
call fcn.140073f2c
cmp eax, esi
jne 0x140045f59
lea rdx, [rsp + 0x1540]
sub rdx, rbp
movzx eax, word [rbp]
movzx ecx, word [rdx + rbp]
sub eax, ecx
jne 0x140045f55
add rbp, 2
test ecx, ecx
jne 0x140045f41
cmp eax, esi
jne 0x140045f80
lea rdx, [rsp + 0x1540]
mov rcx, rbx
call fcn.140042de4
mov ecx, 0x50d
call fcn.140061d94
mov rcx, rax
call fcn.140096028
jmp 0x140046010
mov rdi, r12
cmp word [0x1401163a0], si
je 0x140045fa9
movzx edx, word [rdi]
mov rcx, qword [str.py_f_]
call fcn.1400a978c
cmp rax, rsi
jne 0x140045fb3
add rdi, 2
cmp word [rdi], si
jne 0x140045f8c
xor edx, edx
mov rcx, r14
call fcn.1400135fc
mov rcx, rsi
movzx eax, word [rsp + rcx + 0x1540]
mov word [rcx + r12], ax
add rcx, 2
cmp ax, si
jne 0x140045fb6
jmp 0x140046010
lea rdx, [rbx + 0x2a]
mov r9, r12
xor r8d, r8d
xor ecx, ecx
call fcn.140031334
cmp al, sil
je 0x140045feb
mov esi, 1
jmp 0x140046010
mov ecx, 0x207
call fcn.140061d94
lea rdx, [rbx + 0x2a]
mov r8, r12
mov rcx, rax
call fcn.140096028
lea rcx, [0x1400ec668]
call fcn.1400286f0
mov rcx, qword [0x1400ffd80]
mov r9, r12
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_PostMessageW]
movsxd rax, esi
jmp 0x1400463a1
test byte [rbp + 0x18], 2
je 0x1400462c9
mov rdx, qword [rbp + 0x40]
cmp rdx, qword [0x140116368]
jae 0x1400462c9
lea rcx, [0x140116200]
call fcn.14003f20c
mov r14d, 0x4401
mov r12, rax
mov qword [rsp + 0x30], rax
call fcn.14003ed2c
cmp eax, 0x501
jb 0x14004607a
cmp byte [0x1400fec05], sil
je 0x140046080
mov r14d, 0x4411
lea rcx, [rsp + 0x2540]
mov edx, r15d
call fcn.140087598
mov r12, qword [r12]
or r13, 0xffffffffffffffff
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
mov r15d, 0x101
not rcx
cmp byte [0x1400fec05], sil
je 0x1400460bf
dec rcx
cmp rcx, r15
ja 0x1400460df
jmp 0x14004611f
lea rdx, [rcx - 1]
lea rdi, [rsp + 0x2540]
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rdx, rcx
cmp rdx, r15
jbe 0x14004612e
mov rcx, r12
or r14d, 0x10
call fcn.140052ebc
mov r12, rax
cmp rax, rsi
je 0x140046109
xor eax, eax
mov rcx, r13
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, r15
jbe 0x140046110
lea r12, str.dummy
cmp byte [0x1400fec05], sil
je 0x14004612e
jmp 0x14004611f
add r12, 2
movzx ecx, word [r12]
call fcn.14005256c
cmp al, sil
jne 0x14004611b
mov rdi, qword [rsp + 0x30]
mov r13d, 0x2b8
lea r8, [rsp + 0x8b0]
mov edx, dword [rdi + 0x20]
mov r9d, r13d
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rsi
setne al
cmp al, sil
jne 0x140046195
test r14b, 0x10
jne 0x14004620f
mov edx, dword [rdi + 0x20]
lea r8, [rsp + 0x8b0]
or r14d, 0x10
mov r9d, r13d
mov rcx, r12
mov dword [rsp + 0x20], r14d
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp rax, rsi
setne al
cmp al, sil
je 0x14004620f
mov r12d, 0xc8
lea rdx, [rsp + 0xac8]
lea rcx, [rsp + 0x13b0]
mov r8, r12
call fcn.14006b658
cmp word [rsp + 0x13b0], si
jne 0x1400461d3
mov rdx, qword [rdi]
lea r8, [rsp + 0x13b0]
mov r9, r12
mov rcx, rbx
call fcn.14003fec0
movzx eax, byte [0x1400fec05]
movsxd r8, dword [rbp + 0x1c]
mov rcx, qword [rbx]
add eax, 2
lea r9, [rsp + 0x38]
mov edx, 0x1074
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x13b0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0x8b8]
mov dword [rbp + 0x3c], edx
bts dword [rbp + 0x18], 0xc
lea rcx, [rsp + 0xb70]
mov edx, 0x400
call fcn.140087598
lea rdx, [rsp + 0x2540]
lea rdi, [rsp + 0xb70]
sub rdi, rdx
movzx eax, word [rdx]
movzx ecx, word [rdx + rdi]
sub eax, ecx
jne 0x14004624c
add rdx, 2
test ecx, ecx
jne 0x140046239
cmp eax, esi
je 0x1400462c9
lea rcx, [rsp + 0x2540]
call fcn.140087580
jmp 0x1400462c9
call fcn.140023364
jmp 0x1400462c9
cmp eax, 0xffffff94
je 0x140046380
cmp eax, 0xfffffff4
je 0x1400462d0
cmp eax, 0xfffffffd
je 0x1400462b0
cmp eax, 0xffffffff
jne 0x1400462c9
mov ecx, 0x65
call fcn.140061d94
mov ecx, 0x1f4
mov rdi, rax
call fcn.140061d94
mov rcx, qword [0x1400ffd80]
mov r9d, 0x30
mov r8, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400462c9
mov rcx, rbx
call fcn.14003fcc4
cmp eax, esi
je 0x1400462c9
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.14004528c
xor eax, eax
jmp 0x1400463a1
mov eax, dword [rbp + 0x18]
sub eax, 1
je 0x140046370
cmp eax, 0x10000
jne 0x1400462c9
or r13, 0xffffffffffffffff
cmp dword [0x1400df2b8], r13d
jne 0x14004632e
lea rdx, str.AltColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xff0000
call fcn.14005c490
lea rdx, str.AltEncryptionColor
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov r8d, 0xd9213
mov dword [0x1400df2b8], eax
call fcn.14005c490
mov dword [0x14011639c], eax
mov r8, qword [rbp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [0x140116200]
call fcn.14003f030
mov ecx, dword [rax + 0x810]
bt ecx, 0xb
jae 0x140046358
mov eax, dword [0x1400df2b8]
mov dword [rbp + 0x50], eax
bt ecx, 0xe
jae 0x1400462c9
mov eax, dword [0x14011639c]
mov dword [rbp + 0x50], eax
jmp 0x1400462c9
mov al, byte [0x140105fd4]
neg al
sbb rax, rax
and eax, 0x20
jmp 0x1400463a1
mov edx, dword [rbp + 0x1c]
mov rcx, rbx
call fcn.140044d9c
jmp 0x1400462c9
mov r9, rbp
mov r8, rsi
mov edx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rsp + 0x2d40]
xor rcx, rsp
call fcn.1400a86e0
add rsp, 0x2d58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret