Function at 0x449090
Capabilities:
Create directory
Delete directory
Log keystrokes via polling

Disassembly:
mov eax, 0x2cdc
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2cd8], eax
mov eax, dword [esp + 0x2ce0]
push ebx
mov ebx, dword [esp + 0x2cf0]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x2cec]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
cmp ecx, 0x4e
jne 0x449c67
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
xor eax, eax
lea ebx, [ebx]
cmp dword [eax + 0x4d719c], ecx
je 0x4490f2
add eax, 4
cmp eax, 0x1c
jb 0x4490e0
jmp 0x449105
mov eax, dword [0x527edc]
push esi
push esi
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 8]
add eax, 0xb1
push edi
cmp eax, 0xb0
ja case.0x449120.174
movzx ecx, byte [eax + 0x449cac]
jmp dword [ecx*4 + 0x449c80]
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebp
movzx esi, ax
shr esi, 0xf
push 0x12
and esi, 1
call ebp
movzx edi, ax
shr edi, 0xf
push 0x11
and edi, 1
call ebp
movzx ebp, ax
shr ebp, 0xf
and ebp, 1
cmp word [ebx + 0xc], 0x79
jne 0x44916c
test esi, esi
jne 0x449163
test edi, edi
je 0x44917c
mov ecx, dword [esp + 0x10]
call fcn.004457a0
test esi, esi
jne case.0x449120.174
test edi, edi
jne case.0x449120.174
test ebp, ebp
jne case.0x449120.174
movzx eax, word [ebx + 0xc]
add eax, 0xfffffff7
cmp eax, 0x6b
ja case.0x449120.174
movzx edx, byte [eax + 0x449d80]
jmp dword [edx*4 + 0x449d60]
call fcn.004b0205
mov ecx, dword [esp + 0x10]
push 0
push 1
mov dword [0x53e5f8], eax
call fcn.00448c20
call fcn.004b0205
mov dword [0x53e5f8], eax
jmp case.0x449120.174
mov ecx, dword [esp + 0x10]
call fcn.00445710
jmp case.0x449120.174
mov eax, dword [0x527edc]
push 0
push 0xb4
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x449120.174
mov ecx, dword [esp + 0x10]
call fcn.00443f30
jmp case.0x449120.174
mov ecx, 0x52d6b0
call fcn.00406eb0
jmp case.0x449120.174
mov ecx, 0x52d6c0
call fcn.00448b20
jmp case.0x449120.174
cmp dword [0x52761c], 0
je case.0x449120.174
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx]
jne case.0x449120.174
mov edx, dword [0x52761c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x449120.174
push esi
push str.SingleClick
push str.FileList
call fcn.0045fbd0
test eax, eax
je case.0x449120.174
mov ecx, ebp
call fcn.00443da0
test eax, eax
je case.0x449120.174
call fcn.004b0205
sub eax, dword [0x53e5f8]
cmp eax, 0x3e8
jle case.0x449120.174
push esi
push 1
mov ecx, ebp
call fcn.00448c20
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x2ce0]
pop ebp
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x2cdc
ret 0x10
mov ecx, ebp
call fcn.00443da0
test eax, eax
je case.0x449120.174
jmp 0x44926d
call fcn.004245b0
jmp case.0x449120.174
mov eax, dword [ebx + 0x10]
push eax
mov ecx, ebp
call fcn.00448a60
jmp case.0x449120.174
mov ecx, 0x52dfe8
call fcn.00411850
mov dword [esp + 0x18], edx
cmp dword [0x527634], esi
jne 0x4493c3
cmp byte [ebp + 0x81a], 0
jne 0x4493c3
cmp byte [0x526d89], 0
je 0x4492f7
and eax, 0x40
xor ecx, ecx
or eax, ecx
jne 0x4492f7
cmp byte [ebp + 0x18], cl
je 0x4493c3
cmp byte [ebp + 0x18], 0
je 0x449308
xor ecx, ecx
mov word [ebp + 0x1a], cx
jmp case.0x449120.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
call edi
test eax, eax
je 0x4493c3
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0xb2c]
push eax
mov ecx, 0x53dd20
call fcn.00443130
push 0x400
lea ecx, [esp + 0xb2c]
push ecx
lea esi, [ebp + 0x1a]
call fcn.00455b40
push eax
push esi
call fcn.0046f260
mov edx, dword [ebp]
push 0
push 0
push 0x1018
push edx
call edi
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 0x4c5b18
lea esp, [esp]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4493b6
test cx, cx
je 0x4493b2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4493b6
add esi, 4
add eax, 4
test cx, cx
jne 0x449390
xor eax, eax
jmp 0x4493bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne case.0x449120.174
mov eax, 1
jmp 0x449279
xor eax, eax
mov word [0x53ddf8], ax
mov eax, dword [ebx + 0x20]
xor ecx, ecx
mov dword [esp + 0x10], esi
mov word [esp + 0x1ce8], cx
lea edi, [ecx + 1]
cmp eax, esi
jne 0x44942c
cmp byte [ebp + 0x18], cl
je case.0x449120.174
mov ecx, dword [ebp]
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
push 0x104b
push ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], 0x53ddf8
mov dword [esp + 0x44], 0x400
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x449486
push 0x400
push eax
push 0x53ddf8
call fcn.0046f260
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x53ddd4]
jae 0x449486
push eax
lea edx, [esp + 0xb2c]
push edx
mov ecx, 0x53dd20
call fcn.00443130
push 0x400
lea eax, [esp + 0xb2c]
push eax
lea ecx, [esp + 0x1cf0]
push ecx
call fcn.0046f260
lea edx, [esp + 0x1ce8]
push edx
call fcn.00455b40
xor ecx, ecx
mov word [eax], cx
cmp word [0x53ddf8], si
je case.0x449120.174
cmp byte [ebp + 0x18], 0
je 0x4496a4
mov byte [ebp + 0x18], 0
cmp byte [0x526d89], 0
push esi
je 0x44967d
lea edx, [esp + 0xb2c]
push edx
push str.Rar_MD
call fcn.0048a730
test al, al
je 0x449918
xor eax, eax
mov ebx, 2
movzx ecx, word [esp + eax + 0xb28]
mov word [esp + eax + 0x14e8], cx
add eax, ebx
test cx, cx
jne 0x4494d0
lea eax, [esp + 0x14e8]
push eax
call fcn.004554c0
mov eax, 0x53ddf8
mov edx, eax
jmp 0x449500
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x449500
lea edi, [esp + 0x14e8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x449516
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x14ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44965d
push 0
call fcn.00486900
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
mov ecx, dword [0x536aac]
lea edx, [esp + 0x14e8]
push edx
call fcn.0046f9f0
push 0x400
push 0x532b04
mov ecx, 0x52dfe8
mov dword [0x533838], ebx
mov dword [0x533834], ebx
mov byte [0x533876], 0
call fcn.00412e70
xor eax, eax
movzx ecx, word [eax + 0x532b04]
mov word [esp + eax + 0x24e8], cx
add eax, ebx
test cx, cx
jne 0x4495a0
lea eax, [esp + 0x24e8]
push eax
call fcn.004554c0
mov eax, 0x53ddf8
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x4495d0
lea edi, [esp + 0x24e8]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x4495e6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x449610
movzx ecx, word [esp + eax + 0x24e8]
mov word [eax + 0x53ddf8], cx
add eax, ebx
test cx, cx
jne 0x449610
mov ecx, dword [0x52e1f4]
mov dword [0x53423c], ecx
push 0
mov ecx, 0x52dfe8
call fcn.00417650
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea edx, [esp + 0x14e8]
push edx
call esi
lea eax, [esp + 0xb28]
push eax
call esi
jmp 0x449918
lea ecx, [esp + 0x14e8]
push ecx
push 0x1f7
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 8
jmp 0x44990e
push 0x53ddf8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4498ef
cmp word [0x53ddf8], si
je 0x449918
push 0x53ddf8
jmp 0x449665
cmp byte [0x526d89], 0
je 0x4498d9
lea edx, [esp + 0xb28]
push edx
mov ecx, ebp
call fcn.00444720
test al, al
je 0x4496da
push 0x400
lea eax, [esp + 0xb2c]
push eax
lea ecx, [ebp + 0x1a]
push ecx
call fcn.0046f260
push esi
call fcn.00486900
push 0x400
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.00412e90
mov edx, dword [0x52e1f4]
push esi
push 0x4c6a68
push str.FileList
mov dword [0x53423c], edx
call fcn.0045fbd0
test eax, eax
je 0x44973a
xor eax, eax
jmp 0x449720
movzx ecx, word [esp + eax + 0x1ce8]
mov word [esp + eax + 0x24e8], cx
add eax, 2
cmp cx, si
jne 0x449720
jmp 0x44975e
push 0x400
lea eax, [esp + 0x24ec]
push eax
mov ecx, 0x52dfe8
call fcn.00412e70
lea ecx, [esp + 0x24e8]
push ecx
call fcn.004554c0
mov ecx, dword [0x536aac]
lea ebx, [ebp + 0x1a]
push ebx
call fcn.0046f9f0
xor eax, eax
nop
movzx ecx, word [esp + eax + 0x24e8]
mov word [esp + eax + 0x14e8], cx
add eax, 2
cmp cx, si
jne 0x449770
mov eax, 0x53ddf8
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x449790
lea edi, [esp + 0x14e8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4497b0
mov cx, word [edi + 2]
add edi, 2
cmp cx, si
jne 0x4497b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x536abc]
call fcn.0046f5f0
mov ecx, dword [0x536abc]
lea edx, [esp + 0x14e8]
push edx
call fcn.0046f9f0
push 0
push 0
lea eax, [esp + 0x14f0]
push eax
push 0
mov ecx, 0x53dd20
call fcn.00443230
test al, al
je 0x449877
lea ecx, [esp + 0x14e8]
push ecx
push ebx
call fcn.00477c80
test eax, eax
jne 0x449850
lea ecx, [esp + 0x14e8]
mov eax, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449847
test dx, dx
je 0x449843
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449847
add eax, 4
add ecx, 4
test dx, dx
jne 0x449821
xor eax, eax
jmp 0x44984c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x449877
lea edx, [esp + 0x14e8]
push edx
mov ecx, ebp
call fcn.00446ac0
push 0x50d
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 4
jmp 0x449918
cmp word [0x53ddf8], 0
mov esi, 0x53ddf8
je 0x4498a4
movzx eax, word [esi]
push eax
mov eax, dword [str._____:]
push eax
call fcn.004afd82
add esp, 8
test eax, eax
jne 0x4498b0
add esi, 2
cmp word [esi], ax
jne 0x449886
push 0
mov ecx, 0x52dfe8
call fcn.004139b0
xor eax, eax
jmp 0x4498c0
movzx ecx, word [esp + eax + 0x14e8]
mov word [eax + 0x53ddf8], cx
add eax, 2
test cx, cx
jne 0x4498c0
jmp 0x449918
push 0x53ddf8
push 0
lea esi, [ebp + 0x1a]
push esi
push 0
call fcn.00432650
test al, al
je 0x4498f5
mov dword [esp + 0x10], edi
jmp 0x449918
push 0x53ddf8
push esi
push 0x207
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 0xc
mov ecx, 0x513904
call fcn.004298d0
mov ecx, dword [0x527edc]
push 0x53ddf8
push 0
push 0x8002
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x10]
jmp 0x449279
push 0x30
push 0x65
call fcn.00465ec0
push eax
push 0x1f4
call fcn.00465ec0
mov edx, dword [0x527edc]
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x449120.174
mov eax, dword [ebx + 0xc]
sub eax, 1
je 0x4499f4
sub eax, 0x10000
jne case.0x449120.174
cmp dword [0x4d7194], 0xffffffff
jne 0x4499b3
push 0xff0000
push str.AltColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
call fcn.0045fbd0
push 0xd9213
push str.AltEncryptionColor
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [0x4d7194], eax
call fcn.0045fbd0
mov dword [0x53ddf4], eax
mov eax, dword [ebx + 0x2c]
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, 0x53dd20
call fcn.00443130
mov eax, dword [eax + 0x810]
test eax, 0x800
je 0x4499dc
mov edx, dword [0x4d7194]
mov dword [ebx + 0x30], edx
test eax, 0x4000
je case.0x449120.174
mov eax, dword [0x53ddf4]
mov dword [ebx + 0x30], eax
jmp case.0x449120.174
movzx eax, byte [0x52dfe0]
neg eax
sbb eax, eax
and eax, 0x20
jmp 0x449279
test byte [ebx + 0xc], 2
je case.0x449120.174
mov eax, dword [ebx + 0x2c]
cmp eax, dword [0x53ddd4]
jae case.0x449120.174
push eax
mov ecx, 0x53dd20
call fcn.00443300
mov ebp, eax
mov ebx, 0x4401
call fcn.00442d90
cmp eax, 0x501
jb 0x449a47
cmp byte [0x526d89], 0
je 0x449a4c
mov ebx, 0x4411
push 0x400
lea ecx, [esp + 0x1cec]
push ecx
call fcn.0048af80
cmp byte [0x526d89], 0
mov esi, dword [ebp]
je 0x449a8b
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449a70
sub eax, edx
sar eax, 1
cmp eax, 0x101
ja 0x449ac8
jmp 0x449b04
lea eax, [esp + 0x1ce8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449a95
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, esi
lea edi, [eax + 2]
jmp 0x449ab0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449ab0
sub eax, edi
sar eax, 1
add eax, edx
cmp eax, 0x101
jbe 0x449b22
push esi
or ebx, 0x10
call fcn.00455ed0
mov esi, eax
test esi, esi
je 0x449af6
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449ae0
sub eax, edx
sar eax, 1
cmp eax, 0x101
jbe 0x449afb
mov esi, str.dummy
cmp byte [0x526d89], 0
je 0x449b22
movzx edx, word [esi]
push edx
call fcn.00455490
test al, al
je 0x449b22
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.00455490
test al, al
jne 0x449b11
mov edx, dword [ebp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 0x2b4
lea ecx, [esp + 0x87c]
push ecx
push edx
push esi
call edi
test eax, eax
setne al
test al, al
jne 0x449b74
test bl, 0x10
jne 0x449bf7
mov ecx, dword [ebp + 0x18]
or ebx, 0x10
push ebx
push 0x2b4
lea eax, [esp + 0x87c]
push eax
push ecx
push esi
call edi
test eax, eax
setne al
test al, al
je 0x449bf7
push 0xc8
lea edx, [esp + 0xa8c]
push edx
lea eax, [esp + 0x1360]
push eax
call fcn.0046f260
cmp word [esp + 0x1358], 0
jne 0x449bb3
mov edx, dword [ebp]
push 0xc8
lea ecx, [esp + 0x135c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00443f70
movzx eax, byte [0x526d89]
mov esi, dword [esp + 0x14]
add eax, 2
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x135c]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
push 0x1074
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x878]
mov dword [esi + 0x28], eax
jmp 0x449bfb
mov esi, dword [esp + 0x14]
or dword [esi + 0xc], 0x1000
push 0x400
lea ecx, [esp + 0xb2c]
push ecx
call fcn.0048af80
lea ecx, [esp + 0xb28]
lea eax, [esp + 0x1ce8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449c48
test dx, dx
je 0x449c44
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449c48
add eax, 4
add ecx, 4
test dx, dx
jne 0x449c22
xor eax, eax
jmp 0x449c4d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je case.0x449120.174
lea edx, [esp + 0x1ce8]
push edx
call fcn.0048af60
jmp case.0x449120.174
mov edx, dword [esp + 0x2cf0]
push ebx
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x44927b