Function at 0x1800057d0
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800470b8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x49], rdx
lea rbx, [rcx + 0x80]
cmp qword [rbx + 0x10], 0
je 0x180005837
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x180005829
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180005c26
cmp byte [rdi + 0x160], 0
je 0x180005a21
cmp qword [rdi + 0x150], 0
je 0x180005a21
call fcn.180010b30
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
xor esi, esi
test al, al
mov rax, rdx
je 0x1800059a3
sub rax, rcx
cmp rax, 9
jb 0x1800058a9
lea r12, [rcx + 9]
mov qword [rbx + 0x10], r12
mov r14, rbx
cmp rdx, 8
jb 0x180005889
mov r14, qword [rbx]
lea rcx, [r14 + rcx*2]
mov r8d, 0x12
lea rdx, str.C:Users_
call fcn.1800191d0
mov word [r14 + r12*2], si
mov rax, rbx
jmp 0x1800058c9
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
mov edx, 9
xor r8d, r8d
mov rcx, rbx
call fcn.180004fa0
cmp qword [rdi + 0x158], 8
lea rdx, [rdi + 0x140]
jb 0x1800058e1
mov rdx, qword [rdi + 0x140]
mov r8, qword [rdi + 0x150]
mov rcx, rax
call fcn.180004ac0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180005938
lea r12, [rcx + 1]
cmp rdx, 8
mov r14, rdi
mov qword [rdi + 0x10], r12
jb 0x18000591b
mov r14, qword [rdi]
lea rcx, [r14 + rcx*2]
mov r8d, 2
lea rdx, [0x18004033c]
call fcn.1800191d0
mov word [r14 + r12*2], si
jmp 0x18000595a
mov qword [rsp + 0x20], 1
lea r9, [0x18004033c]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.180004fa0
mov rdi, rax
mov rdx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x10]
mov rcx, rdx
sub rcx, rax
cmp rcx, 7
jb 0x1800059fd
lea r14, [rax + 7]
cmp rdx, 8
mov qword [rdi + 0x10], r14
jb 0x180005983
mov rdi, qword [rdi]
lea rcx, [rdi + rax*2]
mov r8d, 0xe
lea rdx, str.Desktop
call fcn.1800191d0
mov word [rdi + r14*2], si
jmp 0x180005c26
sub rax, rcx
cmp rax, 0x1a
jb 0x1800059e3
lea r12, [rcx + 0x1a]
mov qword [rbx + 0x10], r12
mov r14, rbx
cmp rdx, 8
jb 0x1800059c0
mov r14, qword [rbx]
lea rcx, [r14 + rcx*2]
mov r8d, 0x34
lea rdx, str.C:Documents_and_Settings_
call fcn.1800191d0
mov word [r14 + r12*2], si
mov rax, rbx
jmp 0x1800058c9
mov qword [rsp + 0x20], 0x1a
lea r9, str.C:Documents_and_Settings_
mov edx, 0x1a
jmp 0x1800058be
mov qword [rsp + 0x20], 7
lea r9, str.Desktop
xor r8d, r8d
lea edx, [r8 + 7]
mov rcx, rdi
call fcn.180004fa0
jmp 0x180005c26
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp + 0x17], xmm0
xor esi, esi
mov word [rbp + 7], si
lea r8d, [rsi + 7]
lea rdx, str.Desktop
lea rcx, [rbp + 7]
call fcn.180003d10
nop
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], si
lea r8d, [rsi + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [rbp - 0x39]
call fcn.180003d10
nop
mov qword [rbp - 0x49], 0xffffffff80000001
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x19]
call fcn.180006060
mov r14, rax
cmp rbx, rax
je 0x180005ac1
mov rcx, rbx
call fcn.180003ed0
movups xmm0, xmmword [r14]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x180005b01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005afc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005c62
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], si
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x180005b52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005c68
call fcn.180017cf8
movdqa xmm0, xmmword [0x180040ba0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], si
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x180005ba3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005c6e
call fcn.180017cf8
cmp qword [rdi + 0x90], 0
jne 0x180005c26
lea r8, [0x180030758]
lea rdx, [rbp - 0x19]
call fcn.180006290
mov rdi, rax
cmp rbx, rax
je 0x180005bea
mov rcx, rbx
call fcn.180003ed0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x180005c26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005c5c
call fcn.180017cf8
mov rdx, rbx
mov rcx, r15
call fcn.180003c10
mov rax, r15
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180017e90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
nop
call fcn.18001c36c
int3