Function at 0x180008130
Capabilities:
Check if file exists
Get session user name
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800880b8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x20], r15d
lea rbx, [rcx + 0x90]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000818e
mov r8, qword [rbx]
lea r9, str.InstallLocation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180002a10
nop
cmp qword [rsp + 0x40], 0
jbe 0x1800081dc
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180004b60
mov edi, 1
cmp qword [rax + 0x10], 0
ja 0x1800081dc
movzx esi, dil
jmp 0x1800081df
xor sil, sil
test dil, 1
je 0x18000822a
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000822a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087ae
call fcn.180018a54
test sil, sil
je 0x180008249
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp byte [r14 + 0xd0], 0
jne 0x18000839b
cmp qword [rsp + 0x40], 0
ja 0x1800086e9
cmp qword [rbx + 0x18], 8
jb 0x18000826d
mov rbx, qword [rbx]
lea r9, str.InstallLocation
mov r8, rbx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x50]
call fcn.180002a10
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x1800082c0
lea rcx, [rsp + 0x30]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180008302
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087b4
call fcn.180018a54
cmp qword [rsp + 0x40], 0
jbe 0x180008333
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180004b60
or edi, 2
cmp qword [rax + 0x10], 0
ja 0x180008333
mov bl, 1
jmp 0x180008335
xor bl, bl
test dil, 2
je 0x18000837d
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000837d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087ba
call fcn.180018a54
test bl, bl
je 0x18000839b
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp qword [rsp + 0x40], 0
ja 0x1800086e9
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.180037410
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x180063aa0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.180002d10
nop
lea rcx, [rsp + 0x70]
call fcn.180004d30
nop
cmp byte [r14 + 0xd0], 0
jne 0x1800084cb
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180004040
test al, al
je 0x1800084cb
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x50]
call fcn.180004c50
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180008481
lea rcx, [rsp + 0x30]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1800085d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800085cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087a8
jmp 0x1800085cb
lea rcx, [rsp + 0x50]
call fcn.180004e10
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x50]
call fcn.1800027f0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180002a10
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000854d
lea rcx, [rsp + 0x30]
call fcn.180002ca0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000858e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087c0
call fcn.180018a54
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1800085d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800085cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087c6
call fcn.180018a54
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180008600
lea r8d, [rax + 0x16]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rsp + 0x30]
call fcn.180002d10
cmp qword [rsp + 0x40], 0
jbe 0x180008655
lea rcx, [rsp + 0x30]
call fcn.180003fc0
test eax, eax
jne 0x18000862b
lea r8d, [rax + 1]
lea rdx, [0x180063a30]
lea rcx, [rsp + 0x30]
call fcn.1800027f0
lea rdx, [r14 + 0xb0]
cmp qword [r14 + 0xc8], 8
jb 0x180008643
mov rdx, qword [r14 + 0xb0]
mov r8, qword [r14 + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.1800027f0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180008696
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008691
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087cc
call fcn.180018a54
movdqa xmm0, xmmword [0x180063aa0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1800086e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800086e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087d2
call fcn.180018a54
lea rcx, [rsp + 0x30]
call fcn.180003fc0
test eax, eax
jne 0x18000870c
lea r8d, [rax + 1]
lea rdx, [0x180063a30]
lea rcx, [rsp + 0x30]
call fcn.1800027f0
lea rcx, [r14 + 0x10]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x180008736
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
call fcn.180002d10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180008774
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000876f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800087a2
call fcn.180018a54
mov al, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1800191e0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18003a474
nop
call fcn.18003a474
nop
call fcn.18003a474
int3
call fcn.18003a474
int3
call fcn.18003a474
nop
call fcn.18003a474
nop
call fcn.18003a474
nop
call fcn.18003a474
nop
call fcn.18003a474
int3