Function at 0xa8e000
Capabilities:
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create thread
Delete file
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get file attributes
Get file size
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Get thread local storage value
Identify system language via api
Log keystrokes
Modify service
Query environment variable
Query or enumerate registry value
Query service status
Read .ini file
Resume thread
Set environment variable
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xa8edb0
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8e036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8e1d2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8e0b8
call fcn.0046bf92
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8e07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8e094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8e094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8e04a
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x76
mov byte [ebp - 0x6e], 7
mov byte [ebp - 0x6d], 0x64
mov byte [ebp - 0x6c], 0x12
mov byte [ebp - 0x6b], 0x2d
mov byte [ebp - 0x6a], 0xac
mov byte [ebp - 0x69], 0xd7
mov byte [ebp - 0x68], 0xd4
mov byte [ebp - 0x67], 0x15
mov byte [ebp - 0x66], 0x96
mov byte [ebp - 0x65], 0x76
mov byte [ebp - 0x64], 0x1d
mov byte [ebp - 0x63], 2
mov byte [ebp - 0x62], 0xb0
mov byte [ebp - 0x61], 0xc4
mov byte [ebp - 0x60], 0xa4
mov byte [ebp - 0x5f], 0x5f
mov byte [ebp - 0x5e], 0xe
mov byte [ebp - 0x5d], 0x90
mov byte [ebp - 0x5c], 0xc9
mov byte [ebp - 0x5b], 0x94
mov byte [ebp - 0x5a], 3
mov byte [ebp - 0x59], 0x25
mov byte [ebp - 0x58], 6
mov byte [ebp - 0x57], 0x75
mov byte [ebp - 0x56], 4
mov byte [ebp - 0x55], 0x80
mov byte [ebp - 0x54], 8
mov byte [ebp - 0x53], 0x7b
mov byte [ebp - 0x52], 2
mov byte [ebp - 0x51], 0x7b
mov byte [ebp - 0x50], 5
mov byte [ebp - 0x4f], 0x78
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x83
mov byte [ebp - 0x4c], 9
mov byte [ebp - 0x4b], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8e162
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x26
jae 0xa8e1c7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8e18e
mov dword [ebp - 0x24], 0x12
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
jmp 0xa8e15a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8e1b6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8e1a3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8e15a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa8309a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407ea6
mov ecx, eax
call fcn.00403036
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402fda
and dword [ebp - 0x1c], 0
jmp 0xa8e20a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8e21a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8e203
push 0x1d1a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x59
push 0
push 0x2188
push 0x151a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x2558
push 0x342
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xa12
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x252d
push 0x1a03
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x5c2
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x2096
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x11c9
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x9cd
push 0x5e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0x664
push 0
push 0xd87
push 0
push 0x1521
push 0x1c29
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x26d0
push 0x8c4
push 0x2319
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x22cc
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x129
push 0x1101
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0x2183
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0x8c1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x336
push 0
push 0x16f6
push 0x256e
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
push 0xc0a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x2486
push 0
push 0x149a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
push 0
push 0x1e61
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x2254
push 0x423
push 0
push 0x2422
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x150c
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 1
push 0x10a8
push 0x2405
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0x117
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0x1c57
push 0
push 0x10e1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x1b92
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0x322
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xbfa
push 0xed7
push 0x6d
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0x22d9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x1892
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
push 0x1ed2
push 0
push 0x1d83
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0
push 0
push 0x1350
push 0
push 0x193f
push 0
push 0x120
push 0xd7d
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0xa4d
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0x103d
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x136a
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
push 0x25d7
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
push 0x15d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0x11af
push 0x2423
push 0x25c8
push 0xe5f
push 0x12e7
push 0xb3d
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0x21b7
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0x2079
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xa58
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x206c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
push 0x1a88
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0xae1
push 0xabe
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa4e
push 0
push 0x15f2
push 0xcf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0x772
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x1c6e
push 0x2508
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
push 0
push 0
push 0x15
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x1eed
push 0x1699
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0xc06
push 0x885
push 0xd34
push 0x47a
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0x70a
push 0x154
push 0x241d
push 0x17dc
push 0x1a9b
push 0x26b9
push 0xa8d
push 0x2383
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0
push 0x13b4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0x1ac8
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0x1129
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x2467
push 0x1fcf
push 0
push 0
push 0x1ddc
push 0x1e32
call dword [sym.imp.USER32.dll_ToUnicode]
push 0x1156
push 0xb35
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x1786
push 0x126d
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
push 0x1af4
push 0xc9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x1893
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0x914
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push 0
push 0x1477
push 0x21ee
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
push 0x1ad1
push 0xd89
push 0x13fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 1
push 0x1b03
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0x1c00
push 0x13aa
push 0x240b
call dword [sym.imp.KERNEL32.dll_RaiseException]