Function at 0x18000b520
Capabilities:
Check if file exists
Get session user name
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800a21e8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x20], r15d
lea rbx, [rcx + 0xb0]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000b57e
mov r8, qword [rbx]
lea r9, str.InstallLocation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180006ae0
nop
cmp qword [rsp + 0x40], 0
jbe 0x18000b5cc
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007f50
mov edi, 1
cmp qword [rax + 0x10], 0
ja 0x18000b5cc
movzx esi, dil
jmp 0x18000b5cf
xor sil, sil
test dil, 1
je 0x18000b61a
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b61a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b615
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbe6
call fcn.18002a370
test sil, sil
je 0x18000b639
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp byte [r14 + 0xd0], 0
jne 0x18000b78b
cmp qword [rsp + 0x40], 0
ja 0x18000bb21
cmp qword [rbx + 0x18], 8
jb 0x18000b65d
mov rbx, qword [rbx]
lea r9, str.InstallLocation
mov r8, rbx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x50]
call fcn.180006ae0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000b6b0
lea rcx, [rsp + 0x30]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b6f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b6ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbec
call fcn.18002a370
cmp qword [rsp + 0x40], 0
jbe 0x18000b723
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007f50
or edi, 2
cmp qword [rax + 0x10], 0
ja 0x18000b723
mov bl, 1
jmp 0x18000b725
xor bl, bl
test dil, 2
je 0x18000b76d
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b76d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbf2
call fcn.18002a370
test bl, bl
je 0x18000b78b
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp qword [rsp + 0x40], 0
ja 0x18000bb21
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.180048640
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.1800041c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800082d0
nop
cmp byte [r14 + 0xd0], 0
jne 0x18000b8bb
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180007680
test al, al
je 0x18000b8bb
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x50]
call fcn.1800081f0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000b871
lea rcx, [rsp + 0x30]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b9c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b9bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbe0
jmp 0x18000b9bb
lea rcx, [rsp + 0x50]
call fcn.180008490
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x50]
call fcn.180004040
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180006ae0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000b93d
lea rcx, [rsp + 0x30]
call fcn.180003f60
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000b97e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbf8
call fcn.18002a370
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b9c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b9bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbfe
call fcn.18002a370
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000b9f0
lea r8d, [rax + 0x16]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rsp + 0x30]
call fcn.1800041c0
cmp qword [rsp + 0x40], 0
jbe 0x18000ba8d
lea rcx, [rsp + 0x30]
call fcn.180007600
test eax, eax
jne 0x18000ba1f
lea r8d, [rax + 1]
lea rdx, [0x18007836c]
lea rcx, [rsp + 0x30]
call fcn.180004040
lea rdx, str.SOFT_NAME_EN
lea rcx, [rbp - 0x50]
call fcn.18000fb70
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x18000ba3d
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x30]
call fcn.180004040
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000ba8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ba87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bc04
call fcn.18002a370
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000bace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bc0a
call fcn.18002a370
movdqa xmm0, xmmword [0x1800783e0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000bb21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bb1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bc10
call fcn.18002a370
lea rcx, [rsp + 0x30]
call fcn.180007600
test eax, eax
jne 0x18000bb44
lea r8d, [rax + 1]
lea rdx, [0x18007836c]
lea rcx, [rsp + 0x30]
call fcn.180004040
lea rcx, [r14 + 0x10]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x18000bb6e
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
call fcn.1800041c0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000bbac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bba7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000bbda
call fcn.18002a370
mov al, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.18002a480
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
int3
call fcn.18004bf34
int3
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
int3
call fcn.18004bf34
nop
call fcn.18004bf34
nop
call fcn.18004bf34
int3