Function at 0x18000c320
Capabilities:
Check if file exists
Get session user name
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x300
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800900b0]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x30], r15d
lea rbx, [rcx + 0x90]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000c37e
mov r8, qword [rbx]
lea r9, str.InstallLocation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.180005a20
nop
cmp qword [rsp + 0x50], 0
jbe 0x18000c3cc
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007b20
mov edi, 1
cmp qword [rax + 0x10], 0
ja 0x18000c3cc
movzx esi, dil
jmp 0x18000c3cf
xor sil, sil
test dil, 1
je 0x18000c41a
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c41a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c415
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cae2
call fcn.18001f4e0
test sil, sil
je 0x18000c439
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax], r15w
cmp byte [r14 + 0xd0], 0
jne 0x18000c58b
cmp qword [rsp + 0x50], 0
ja 0x18000c9d0
cmp qword [rbx + 0x18], 8
jb 0x18000c45d
mov rbx, qword [rbx]
lea r9, str.InstallLocation
mov r8, rbx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x60]
call fcn.180005a20
mov rbx, rax
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x18000c4b0
lea rcx, [rsp + 0x40]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c4f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c4ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cae8
call fcn.18001f4e0
cmp qword [rsp + 0x50], 0
jbe 0x18000c523
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180007b20
or edi, 2
cmp qword [rax + 0x10], 0
ja 0x18000c523
mov bl, 1
jmp 0x18000c525
xor bl, bl
test dil, 2
je 0x18000c56d
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c56d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c568
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000caee
call fcn.18001f4e0
test bl, bl
je 0x18000c58b
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax], r15w
cmp qword [rsp + 0x50], 0
ja 0x18000c9d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x20]
call fcn.18003eed0
mov dword [rsp + 0x30], 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x30]
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r15w
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.180005be0
nop
lea rcx, [rbp - 0x60]
call fcn.180007d30
nop
cmp byte [r14 + 0xd0], 0
jne 0x18000c6bb
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.180006fd0
test al, al
je 0x18000c6bb
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rbp - 0x80]
call fcn.180007c10
mov rbx, rax
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x18000c673
lea rcx, [rsp + 0x40]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000c80b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000caf4
jmp 0x18000c806
lea rcx, [rbp - 0x80]
call fcn.180007e00
nop
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0x42
jb 0x18000c70b
lea rdi, [rcx + 0x42]
mov qword [rbp - 0x70], rdi
lea rbx, [rbp - 0x80]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x80]
lea rcx, [rbx + rcx*2]
mov r8d, 0x84
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
call fcn.18003e0a0
mov word [rbx + rdi*2], r15w
jmp 0x18000c72d
xor eax, eax
mov qword [rsp + 0x20], 0x42
lea r9, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
movzx r8d, al
lea edx, [rax + 0x42]
lea rcx, [rbp - 0x80]
call fcn.180005680
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r8, qword [rbp - 0x80]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x40]
call fcn.180005a20
mov rbx, rax
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x18000c78a
lea rcx, [rsp + 0x40]
call fcn.180005b70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x18000c7cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c7c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cafa
call fcn.18001f4e0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000c80b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cb00
call fcn.18001f4e0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000c83b
lea r8d, [rax + 0x16]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rsp + 0x40]
call fcn.180005be0
cmp qword [rsp + 0x50], 0
jbe 0x18000c93c
lea rcx, [rsp + 0x40]
call fcn.180006c70
test eax, eax
jne 0x18000c8c3
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18000c8a0
lea rdi, [rcx + 1]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x18006c610]
call fcn.18003e0a0
mov word [rbx + rdi*2], r15w
jmp 0x18000c8c3
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18006c610]
movzx r8d, al
lea edx, [rax + 1]
lea rcx, [rsp + 0x40]
call fcn.180005680
lea r9, [r14 + 0xb0]
cmp qword [r14 + 0xc8], 8
jb 0x18000c8db
mov r9, qword [r14 + 0xb0]
mov rdx, qword [r14 + 0xc0]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18000c926
lea rdi, [rcx + rdx]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp r8, 8
cmovae rbx, qword [rsp + 0x40]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.18003e0a0
mov word [rbx + rdi*2], r15w
jmp 0x18000c93c
xor eax, eax
mov qword [rsp + 0x20], rdx
movzx r8d, al
lea rcx, [rsp + 0x40]
call fcn.180005680
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x18000c97c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c977
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cb06
call fcn.18001f4e0
movdqa xmm0, xmmword [0x18006c680]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000c9d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cb0c
call fcn.18001f4e0
lea rcx, [rsp + 0x40]
call fcn.180006c70
test eax, eax
jne 0x18000ca4c
mov rcx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x18000ca29
lea rdi, [rcx + 1]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp r9, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x18006c610]
call fcn.18003e0a0
mov word [rbx + rdi*2], r15w
jmp 0x18000ca4c
xor eax, eax
mov qword [rsp + 0x20], 1
lea r9, [0x18006c610]
movzx r8d, al
lea edx, [rax + 1]
lea rcx, [rsp + 0x40]
call fcn.180005680
lea rcx, [r14 + 0x10]
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x18000ca76
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.180005be0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000cab4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000caaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cb12
call fcn.18001f4e0
mov al, 1
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.18001fcf0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180041e0c
nop
call fcn.180041e0c
int3
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
nop
call fcn.180041e0c
int3