Function at 0xaa7000
Capabilities:
Accept command line arguments
Allocate thread local storage
Connect pipe
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Get common file path
Get disk information
Get system information on windows
Query environment variable
Query service status
Read .ini file
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x10], 0xaa77eb
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaa7036
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x20], 0xaa71d2
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jae 0xaa70b8
call fcn.00485712
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jb 0xaa707a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaa7094
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jae 0xaa7094
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaa704a
mov byte [ebp - 0x70], 9
mov byte [ebp - 0x6f], 0x6a
mov byte [ebp - 0x6e], 5
mov byte [ebp - 0x6d], 0x6c
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 0x77
mov byte [ebp - 0x6a], 4
mov byte [ebp - 0x69], 0x7e
mov byte [ebp - 0x68], 6
mov byte [ebp - 0x67], 0x77
mov byte [ebp - 0x66], 1
mov byte [ebp - 0x65], 0x80
mov byte [ebp - 0x64], 3
mov byte [ebp - 0x63], 0x2d
mov byte [ebp - 0x62], 8
mov byte [ebp - 0x61], 0x7f
mov byte [ebp - 0x60], 7
mov byte [ebp - 0x5f], 0x72
mov byte [ebp - 0x5e], 2
mov byte [ebp - 0x5d], 0x81
mov byte [ebp - 0x5c], 0x12
mov byte [ebp - 0x5b], 0xe6
mov byte [ebp - 0x5a], 0x6b
mov byte [ebp - 0x59], 4
mov byte [ebp - 0x58], 0xb0
mov byte [ebp - 0x57], 0x75
mov byte [ebp - 0x56], 0x37
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 0x4e
mov byte [ebp - 0x53], 0x59
mov byte [ebp - 0x52], 0x90
mov byte [ebp - 0x51], 0x94
mov byte [ebp - 0x50], 0x7b
mov byte [ebp - 0x4f], 0x1e
mov byte [ebp - 0x4e], 0xa0
mov byte [ebp - 0x4d], 0x8e
mov byte [ebp - 0x4c], 0x57
mov byte [ebp - 0x4b], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x24], 0
jmp 0xaa7162
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x26
jae 0xaa71c7
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x70]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaa718e
mov dword [ebp - 0x24], 0x12
mov eax, dword [ebp - 8]
add eax, 0x10
mov dword [ebp - 8], eax
jmp 0xaa715a
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x6f]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0xaa71b6
mov eax, dword [ebp - 0x18]
add eax, 0x100
mov dword [ebp - 0x18], eax
jmp 0xaa71a3
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x70]
mov cl, byte [ebp - 0x18]
mov byte [ebp + eax - 0x30], cl
jmp 0xaa715a
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x30], 0
push 0
push 0xa9be7a
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407375
mov ecx, eax
call fcn.00402ae1
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x48]
call fcn.00402a85
and dword [ebp - 0x1c], 0
jmp 0xaa720a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xb
jae 0xaa721a
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x30], 0
jmp 0xaa7203
push 0
push 0x1f45
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 0xb82
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0x902
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0
push 0x1fe8
push 0
push 0x2240
push 0x1e67
push 0
push 0xc18
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x11fd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push 0
push 0x213c
push 0x231d
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0
push 0x7b8
push 0
push 0x24c2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0x22cc
push 0x625
push 0
push 0x17a2
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
push 0
push 0
push 0x1562
push 0xb98
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
push 0x1353
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xfc
push 0x2634
push 0x213d
push 0x1053
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0x18a5
push 0
push 0x134c
push 0x269f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0x5ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x1685
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push 0x1119
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x2360
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0
push 0xc0f
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0x386
push 0
push 0
push 0x16d0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 0
push 0x2233
push 0xcac
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0xcbf
push 0
push 0x647
push 0x18be
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
push 0
push 0x1fa0
push 0x1967
push 0
push 0x1b3a
push 0x133e
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0xdf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x1403
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 0x906
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0x1209
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x23b4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x1ffc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x1c64
push 0xe06
push 0x34d
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x66
push 0
push 0x1445
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
push 0
push 0x1896
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xeb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0x22d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x1bae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
push 0x210b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0xd18
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2173
call dword [sym.imp.KERNEL32.dll_ExitProcess]