Function at 0xa8a000
Capabilities:
Accept command line arguments
Allocate thread local storage
Contain obfuscated stackstrings
Enumerate gui resources
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xa8aae5
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8a036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8a1ee
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8a0b8
call fcn.004682a2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8a07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8a094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8a094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8a04a
mov byte [ebp - 0x78], 7
mov byte [ebp - 0x77], 0x62
mov byte [ebp - 0x76], 8
mov byte [ebp - 0x75], 0x73
mov byte [ebp - 0x74], 6
mov byte [ebp - 0x73], 0x73
mov byte [ebp - 0x72], 3
mov byte [ebp - 0x71], 0x27
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x77
mov byte [ebp - 0x6e], 9
mov byte [ebp - 0x6d], 0x74
mov byte [ebp - 0x6c], 5
mov byte [ebp - 0x6b], 0x76
mov byte [ebp - 0x6a], 0
mov byte [ebp - 0x69], 0x81
mov byte [ebp - 0x68], 0x19
mov byte [ebp - 0x67], 0x3d
mov byte [ebp - 0x66], 0x7e
mov byte [ebp - 0x65], 0xc0
mov byte [ebp - 0x64], 0xd9
mov byte [ebp - 0x63], 0x24
mov byte [ebp - 0x62], 0xf2
mov byte [ebp - 0x61], 0x2b
mov byte [ebp - 0x60], 0x82
mov byte [ebp - 0x5f], 0xa9
mov byte [ebp - 0x5e], 0x23
mov byte [ebp - 0x5d], 0x94
mov byte [ebp - 0x5c], 0x94
mov byte [ebp - 0x5b], 0xcf
mov byte [ebp - 0x5a], 0xdd
mov byte [ebp - 0x59], 0x29
mov byte [ebp - 0x58], 0xd2
mov byte [ebp - 0x57], 0x5e
mov byte [ebp - 0x56], 0x90
mov byte [ebp - 0x55], 0x24
mov byte [ebp - 0x54], 0xdf
mov byte [ebp - 0x53], 0x7f
mov byte [ebp - 0x52], 0x9c
mov byte [ebp - 0x51], 0xfd
mov byte [ebp - 0x50], 0xa3
mov byte [ebp - 0x4f], 4
mov byte [ebp - 0x4e], 0x88
mov byte [ebp - 0x4d], 1
mov byte [ebp - 0x4c], 0x88
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8a17e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d
jae 0xa8a1e3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8a1aa
mov dword [ebp - 0x24], 0x19
mov eax, dword [ebp - 8]
add eax, 0x17
mov dword [ebp - 8], eax
jmp 0xa8a176
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8a1d2
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8a1bf
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8a176
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7ebaa
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407760
mov ecx, eax
call fcn.00402c19
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402bbd
and dword [ebp - 0x1c], 0
jmp 0xa8a226
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8a236
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8a21f
push 0x2307
call dword [sym.imp.KERNEL32.dll_ExitProcess]