Function at 0x180009840
Capabilities:
Check if file exists
Get session user name
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800851e8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x20], r15d
lea rbx, [rcx + 0xb0]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000989e
mov r8, qword [rbx]
lea r9, str.InstallLocation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180006690
nop
cmp qword [rsp + 0x40], 0
jbe 0x1800098ec
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007750
mov edi, 1
cmp qword [rax + 0x10], 0
ja 0x1800098ec
movzx esi, dil
jmp 0x1800098ef
xor sil, sil
test dil, 1
je 0x18000993a
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000993a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009935
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f06
call fcn.18001c898
test sil, sil
je 0x180009959
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp byte [r14 + 0xd0], 0
jne 0x180009aab
cmp qword [rsp + 0x40], 0
ja 0x180009e41
cmp qword [rbx + 0x18], 8
jb 0x18000997d
mov rbx, qword [rbx]
lea r9, str.InstallLocation
mov r8, rbx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x50]
call fcn.180006690
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x1800099d0
lea rcx, [rsp + 0x30]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180009a12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009a0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f0c
call fcn.18001c898
cmp qword [rsp + 0x40], 0
jbe 0x180009a43
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007750
or edi, 2
cmp qword [rax + 0x10], 0
ja 0x180009a43
mov bl, 1
jmp 0x180009a45
xor bl, bl
test dil, 2
je 0x180009a8d
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180009a8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009a88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f12
call fcn.18001c898
test bl, bl
je 0x180009aab
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp qword [rsp + 0x40], 0
ja 0x180009e41
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.18003ab60
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.180003ed0
nop
lea rcx, [rsp + 0x70]
call fcn.180007ad0
nop
cmp byte [r14 + 0xd0], 0
jne 0x180009bdb
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.1800071e0
test al, al
je 0x180009bdb
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x50]
call fcn.1800079f0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180009b91
lea rcx, [rsp + 0x30]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180009ce0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f00
jmp 0x180009cdb
lea rcx, [rsp + 0x50]
call fcn.180007c90
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x50]
call fcn.180003d50
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180006690
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x180009c5d
lea rcx, [rsp + 0x30]
call fcn.180003c70
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180009c9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009c98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f18
call fcn.18001c898
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180009ce0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f1e
call fcn.18001c898
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180009d10
lea r8d, [rax + 0x16]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rsp + 0x30]
call fcn.180003ed0
cmp qword [rsp + 0x40], 0
jbe 0x180009dad
lea rcx, [rsp + 0x30]
call fcn.1800071a0
test eax, eax
jne 0x180009d3f
lea r8d, [rax + 1]
lea rdx, [0x1800602c4]
lea rcx, [rsp + 0x30]
call fcn.180003d50
lea rdx, str.SOFT_NAME_EN
lea rcx, [rbp - 0x50]
call fcn.18000dc30
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x180009d5d
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x30]
call fcn.180003d50
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180009dad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009da7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f24
call fcn.18001c898
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180009dee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f2a
call fcn.18001c898
movdqa xmm0, xmmword [0x1800602e0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180009e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009f30
call fcn.18001c898
lea rcx, [rsp + 0x30]
call fcn.1800071a0
test eax, eax
jne 0x180009e64
lea r8d, [rax + 1]
lea rdx, [0x1800602c4]
lea rcx, [rsp + 0x30]
call fcn.180003d50
lea rcx, [r14 + 0x10]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x180009e8e
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
call fcn.180003ed0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180009ecc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009efa
call fcn.18001c898
mov al, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.18001c9b0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3
call fcn.18003e394
int3
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3
call fcn.18003e394
nop
call fcn.18003e394
nop
call fcn.18003e394
int3