Function at 0xa91000
Capabilities:
Accept command line arguments
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Get common file path
Get geographical location
Get session user name
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xa91b60
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa91036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa911a6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa910b8
call fcn.0046e584
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9107a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa91094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa91094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9104a
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x63], 0x76
mov byte [ebp - 0x62], 0
mov byte [ebp - 0x61], 0x75
mov byte [ebp - 0x60], 7
mov byte [ebp - 0x5f], 0xea
mov byte [ebp - 0x5e], 0
mov byte [ebp - 0x5d], 0x7b
mov byte [ebp - 0x5c], 0x42
mov byte [ebp - 0x5b], 0xf3
mov byte [ebp - 0x5a], 0xbe
mov byte [ebp - 0x59], 6
mov byte [ebp - 0x58], 0x73
mov byte [ebp - 0x57], 7
mov byte [ebp - 0x56], 0x68
mov byte [ebp - 0x55], 9
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 2
mov byte [ebp - 0x52], 0x79
mov byte [ebp - 0x51], 3
mov byte [ebp - 0x50], 0x2d
mov byte [ebp - 0x4f], 5
mov byte [ebp - 0x4e], 0x78
mov byte [ebp - 0x4d], 8
mov byte [ebp - 0x4c], 0x81
mov byte [ebp - 0x4b], 4
mov byte [ebp - 0x4a], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa91136
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
jae 0xa9119b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa91162
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 8]
add eax, 5
mov dword [ebp - 8], eax
jmp 0xa9112e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9118a
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa91177
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9112e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa85ada
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407c31
mov ecx, eax
call fcn.00402c7b
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402c1f
and dword [ebp - 0x1c], 0
jmp 0xa911de
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa911ee
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa911d7
push 0x14f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0
push 0x1900
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0x20f3
push 0x1da1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
push 0xe2f
push 0x1921
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0x82c
push 0x11fa
push 0xd0b
push 0x1055
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0x18e3
push 0xdd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0xf6d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x1434
push 0x249f
push 0x234b
push 0x19ef
push 0xf52
push 0x1603
push 0x13b1
push 0x17af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x1c07
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 1
push 0x83e
push 0x382
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0xd73
push 0x1001
push 0x1e74
push 0x1c2c
push 0x18f9
push 0xb7c
push 0x1d35
push 0x8f6
push 0x3d8
push 0x8b5
push 0xc4a
push 0x21c6
push 0x15e
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0xe30
push 0
push 0x882
push 0x20cf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x16d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1fda
push 0x323
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x1107
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0x252f
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0x225e
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x580
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2490
push 0x6b8
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x1202
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1ad7
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0x3c
push 0x1280
push 0x21d4
push 0xf01
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x53e
push 0x946
push 0
push 0
push 0x72c
push 0x179c
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x1fd7
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x113f
push 0x1969
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0x10c0
push 0
push 0
push 0x27a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0xf52
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0xb93
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
push 0x1b5c
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0xf5a
push 0
push 0x15ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x12ec
push 0x1bbf
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push 0
push 0xa10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0
push 0x1d43
push 0x18ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x3bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0x2282
push 0x2460
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x12c6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0x180f
push 0x165b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0x1599
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0xe03
push 0x283
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x10e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x11c6
push 0x7d0
push 0x6ff
push 0x1f97
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0x25b0
push 0xb7f
push 0xa4f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0x10c3
push 0
push 0x1f9
push 0
push 0x1cce
push 0xa64
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x1d19
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0x61c
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x12ff
push 0x2a2
push 0x1e2
push 0x12ad
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0x241e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1057
push 0x160c
push 0x255c
push 0x2475
push 0x1d88
push 0x1ea6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0x1dd5
push 0x8e3
push 0x1a3f
push 0x149f
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0x26ad
push 0x126e
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x81f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0x72d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
push 0x2308
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x3c7
push 0x1498
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push 0xbec
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0xc25
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
push 0x1107
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
push 0
push 0
push 0
push 0x455
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x747
push 0x84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2444
push 0xea3
push 0x17aa
push 0x20af
push 0x110b
push 0x68c
push 0xcda
push 0x206
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0x84a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0x1e60
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0x1445
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8c2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0xd31
push 0x890
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0xc12
push 0xee3
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0
push 0x17be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
push 0x2156
push 0
push 0
push 0x15d2
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1d18
push 0xf5c
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x8b8
push 0x159f
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0xdbf
push 0
push 0
push 0
push 0x12e0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0x7d8
push 0
push 0x15d9
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0xa91b6a
mov esp, ebp
pop ebp
ret