Function at 0xab01a2
Capabilities:
Compare security identifiers
Create directory
Create process on windows
Extract resource via kernel32 functions
Get graphical window text
Identify system language via api
Query or enumerate registry key
Read .ini file
Set registry value
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xab0770
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab0036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab01a2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab00b8
call fcn.0048dbf2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab007a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab0094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab0094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab004a
mov byte [ebp - 0x64], 6
mov byte [ebp - 0x63], 0x6f
mov byte [ebp - 0x62], 0
mov byte [ebp - 0x61], 0x75
mov byte [ebp - 0x60], 7
mov byte [ebp - 0x5f], 0x66
mov byte [ebp - 0x5e], 5
mov byte [ebp - 0x5d], 0x70
mov byte [ebp - 0x5c], 4
mov byte [ebp - 0x5b], 0x80
mov byte [ebp - 0x5a], 9
mov byte [ebp - 0x59], 0x74
mov byte [ebp - 0x58], 2
mov byte [ebp - 0x57], 0x7b
mov byte [ebp - 0x56], 6
mov byte [ebp - 0x55], 0xc6
mov byte [ebp - 0x54], 0x53
mov byte [ebp - 0x53], 0xfe
mov byte [ebp - 0x52], 0xb4
mov byte [ebp - 0x51], 0x5d
mov byte [ebp - 0x50], 1
mov byte [ebp - 0x4f], 0x84
mov byte [ebp - 0x4e], 8
mov byte [ebp - 0x4d], 0x81
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x33
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab0132
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1a
jae 0xab0197
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab015e
mov dword [ebp - 0x24], 6
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
jmp 0xab012a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab0186
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab0173
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab012a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa513a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407759
mov ecx, eax
call fcn.00402aa5
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402a49
and dword [ebp - 0x1c], 0
jmp 0xab01da
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab01ea
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab01d3
push 0
push 0
push 0x249c
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0x287
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x66f
push 0x23cf
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
push 0x24f7
push 0x183f
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0x261c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0x6d9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x76a
push 0
push 0x1361
push 0xac9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x23d7
push 0
push 0x1653
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0x24e3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0
push 0x1f39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xb11
push 0x1750
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0
push 0x2272
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x11d2
push 0x1834
push 0x2072
push 0x812
call dword [sym.imp.GDI32.dll_CreateRectRgn]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x78f
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x206d
push 0
push 0
push 0
push 0
push 0x13ce
push 0x1e00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
push 0x2574
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
push 0x1ab3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0x2298
push 0x26a8
push 1
push 0
push 0x1847
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0x1987
call dword [sym.imp.USER32.dll_GetKeyboardType]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.USER32.dll_DestroyCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x36
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0xc72
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
push 0x2191
push 0x18f7
push 0x1172
push 0x108e
push 0x95f
push 0x2034
push 0x12df
push 0x21f4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x2d9
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x1aca
push 0x1e19
push 0x2403
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xa9
push 0x137d
push 0x1c07
push 0x2036
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0xec6
push 0
push 0
push 0xaf4
push 0xf68
push 0x210a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x2424
call dword [sym.imp.KERNEL32.dll_ExitThread]