Function at 0xaac000
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Connect pipe
Contain obfuscated stackstrings
Create pipe
Delete file
Get common file path
Get geographical location
Get keyboard layout
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set thread local storage value
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xaacefb
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaac036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaac1d6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaac0b8
call fcn.00489352
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaac07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaac094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaac094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaac04a
mov byte [ebp - 0x70], 7
mov byte [ebp - 0x6f], 0x62
mov byte [ebp - 0x6e], 3
mov byte [ebp - 0x6d], 0x23
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 0x77
mov byte [ebp - 0x6a], 5
mov byte [ebp - 0x69], 0x70
mov byte [ebp - 0x68], 9
mov byte [ebp - 0x67], 0x72
mov byte [ebp - 0x66], 1
mov byte [ebp - 0x65], 0x80
mov byte [ebp - 0x64], 2
mov byte [ebp - 0x63], 0x7b
mov byte [ebp - 0x62], 8
mov byte [ebp - 0x61], 0x7f
mov byte [ebp - 0x60], 0x13
mov byte [ebp - 0x5f], 0xac
mov byte [ebp - 0x5e], 0x2d
mov byte [ebp - 0x5d], 0x2d
mov byte [ebp - 0x5c], 0xd2
mov byte [ebp - 0x5b], 0x64
mov byte [ebp - 0x5a], 0xdd
mov byte [ebp - 0x59], 0xd4
mov byte [ebp - 0x58], 1
mov byte [ebp - 0x57], 0xb3
mov byte [ebp - 0x56], 0x9f
mov byte [ebp - 0x55], 0xc4
mov byte [ebp - 0x54], 0xcf
mov byte [ebp - 0x53], 0xab
mov byte [ebp - 0x52], 0xc9
mov byte [ebp - 0x51], 0x4c
mov byte [ebp - 0x50], 0x62
mov byte [ebp - 0x4f], 0xb0
mov byte [ebp - 0x4e], 0xc3
mov byte [ebp - 0x4d], 4
mov byte [ebp - 0x4c], 0x88
mov byte [ebp - 0x4b], 6
mov byte [ebp - 0x4a], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaac166
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x27
jae 0xaac1cb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaac192
mov dword [ebp - 0x24], 0x13
mov eax, dword [ebp - 8]
add eax, 0x11
mov dword [ebp - 8], eax
jmp 0xaac15e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaac1ba
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaac1a7
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaac15e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa03ba
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407b1b
mov ecx, eax
call fcn.00402e47
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402deb
and dword [ebp - 0x1c], 0
jmp 0xaac20e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaac21e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaac207
push 0x16b6
call dword [sym.imp.KERNEL32.dll_ExitProcess]