Function at 0xa8f000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create thread
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk information
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x10], 0xa8f79f
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8f036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8f18f
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8f0b8
call fcn.0046d252
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8f07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8f094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8f094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8f04a
mov byte [ebp - 0x48], 2
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 3
mov byte [ebp - 0x45], 0x23
mov byte [ebp - 0x44], 9
mov byte [ebp - 0x43], 0x6e
mov byte [ebp - 0x42], 2
mov byte [ebp - 0x41], 0x44
mov byte [ebp - 0x40], 1
mov byte [ebp - 0x3f], 0x7c
mov byte [ebp - 0x3e], 4
mov byte [ebp - 0x3d], 0x80
mov byte [ebp - 0x3c], 8
mov byte [ebp - 0x3b], 0x7b
mov byte [ebp - 0x3a], 5
mov byte [ebp - 0x39], 0x76
mov byte [ebp - 0x38], 6
mov byte [ebp - 0x37], 0x7d
mov byte [ebp - 0x36], 7
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0x85
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8f122
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x16
jae 0xa8f184
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x48]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8f14b
mov dword [ebp - 0x24], 2
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0xa8f11a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x47]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8f173
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8f160
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x48]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8f11a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa83b7a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x60]
call fcn.00407dc2
mov ecx, eax
call fcn.00402e58
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x60]
call fcn.00402dfc
and dword [ebp - 0x1c], 0
jmp 0xa8f1c7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8f1d7
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8f1c0
push 0
push 0x1681
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0x1c83
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x1a2f
push 0x119b
push 0
push 0
push 0x213e
push 0x538
push 0x24f3
push 0x1bd1
push 0x613
push 0x215f
push 0xb0c
push 0x1106
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0x19cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0
push 0x231
push 0
push 0x2f1
push 0x16c2
push 0
push 0x215f
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0x2145
push 0xb90
push 0x17f2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0
push 0x365
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0x1f81
push 0x1bd3
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0
push 0x900
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0xaa1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x1380
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 0x934
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0xccc
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0x2686
push 0
push 0x52f
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0
push 0xc93
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0x1e38
push 0x10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
push 0x1a2f
push 0
push 0x1fe
push 0
push 0x6c9
push 0x192c
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x1d7c
push 0x159
push 0x1d2
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
push 0xd9e
push 0xfb0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1c21
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0x159a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xe0a
push 0x1cbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x20ae
push 0
push 0x39
push 0x603
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x20b1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0x1597
push 0
push 0
push 0x8e8
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x14d6
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0x19ea
push 0x812
push 0x351
push 0x207d
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0x1167
push 0x1f1d
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
push 0x2363
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x2434
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1d4a
push 0xe95
push 0x1248
push 0x1d4f
push 0xee5
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
push 0x19ab
push 0x208d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x2d1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0x2669
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x14c0
push 0x733
push 0
push 0x1cba
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0x18ab
push 0x1504
push 0x184b
push 0xf0b
push 0x15fb
push 0x13d2
push 0x1957
push 0x13b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0x24a5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xd16
push 0x1637
push 0
push 0x462
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0xfb6
push 0
push 0x1b06
push 0
push 0x113e
push 0x949
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
push 0x23a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x18b1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0x93e
push 0
push 0
push 0x767
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xbc9
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0x2295
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x1477
push 0x1c8f
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
push 0x1438
push 0x384
push 0x17af
push 0x225f
push 0x46
push 0xf76
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0xa8f7a9
mov esp, ebp
pop ebp
ret