Function at 0x18000ce90
Capabilities:
Check if file exists
Get session user name
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800961e8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x20], r15d
lea rbx, [rcx + 0x90]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000ceee
mov r8, qword [rbx]
lea r9, str.InstallLocation
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.180006160
nop
cmp qword [rsp + 0x40], 0
jbe 0x18000cf3c
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007c50
mov edi, 1
cmp qword [rax + 0x10], 0
ja 0x18000cf3c
movzx esi, dil
jmp 0x18000cf3f
xor sil, sil
test dil, 1
je 0x18000cf8a
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000cf8a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cf85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d50e
call fcn.1800229f4
test sil, sil
je 0x18000cfa9
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp byte [r14 + 0xd0], 0
jne 0x18000d0fb
cmp qword [rsp + 0x40], 0
ja 0x18000d449
cmp qword [rbx + 0x18], 8
jb 0x18000cfcd
mov rbx, qword [rbx]
lea r9, str.InstallLocation
mov r8, rbx
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x50]
call fcn.180006160
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000d020
lea rcx, [rsp + 0x30]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000d062
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d05d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d514
call fcn.1800229f4
cmp qword [rsp + 0x40], 0
jbe 0x18000d093
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180007c50
or edi, 2
cmp qword [rax + 0x10], 0
ja 0x18000d093
mov bl, 1
jmp 0x18000d095
xor bl, bl
test dil, 2
je 0x18000d0dd
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000d0dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d0d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d51a
call fcn.1800229f4
test bl, bl
je 0x18000d0fb
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rax], r15w
cmp qword [rsp + 0x40], 0
ja 0x18000d449
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.180040cd0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, dword [rsp + 0x20]
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.180004370
nop
lea rcx, [rsp + 0x70]
call fcn.180007fd0
nop
cmp byte [r14 + 0xd0], 0
jne 0x18000d22b
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.180007250
test al, al
je 0x18000d22b
xor r8d, r8d
lea edx, [r8 + 0x1c]
lea rcx, [rsp + 0x50]
call fcn.180007ef0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000d1e1
lea rcx, [rsp + 0x30]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000d330
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d32b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d508
jmp 0x18000d32b
lea rcx, [rsp + 0x50]
call fcn.180008190
nop
mov r8d, 0x42
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
lea rcx, [rsp + 0x50]
call fcn.1800041f0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
lea r9, str.Local_AppData
mov rdx, 0xffffffff80000003
lea rcx, [rbp - 0x50]
call fcn.180006160
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x18000d2ad
lea rcx, [rsp + 0x30]
call fcn.1800040f0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x18000d2ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d2e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d520
call fcn.1800229f4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000d330
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d32b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d526
call fcn.1800229f4
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000d360
lea r8d, [rax + 0x16]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rsp + 0x30]
call fcn.180004370
cmp qword [rsp + 0x40], 0
jbe 0x18000d3b5
lea rcx, [rsp + 0x30]
call fcn.180006eb0
test eax, eax
jne 0x18000d38b
lea r8d, [rax + 1]
lea rdx, [0x18006e34c]
lea rcx, [rsp + 0x30]
call fcn.1800041f0
lea rdx, [r14 + 0xb0]
cmp qword [r14 + 0xc8], 8
jb 0x18000d3a3
mov rdx, qword [r14 + 0xb0]
mov r8, qword [r14 + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.1800041f0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x18000d3f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d52c
call fcn.1800229f4
movdqa xmm0, xmmword [0x18006e3e0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000d449
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d444
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d532
call fcn.1800229f4
lea rcx, [rsp + 0x30]
call fcn.180006eb0
test eax, eax
jne 0x18000d46c
lea r8d, [rax + 1]
lea rdx, [0x18006e34c]
lea rcx, [rsp + 0x30]
call fcn.1800041f0
lea rcx, [r14 + 0x10]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x18000d496
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
call fcn.180004370
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000d4d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d4cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d502
call fcn.1800229f4
mov al, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.180022b10
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
int3
call fcn.1800445c4
int3
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
nop
call fcn.1800445c4
int3