Function at 0x18000c3a0
Capabilities:
Check if file exists
Persist via run registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800ea550]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x49], rdx
xor r12d, r12d
mov dword [rbp - 0x59], r12d
cmp qword [rcx + 0x60], r12
je 0x18000c431
cmp qword [rcx + 0x68], 8
jb 0x18000c3f4
mov rcx, qword [rcx + 0x50]
jmp 0x18000c3f8
add rcx, 0x50
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete al
test al, al
je 0x18000c431
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x50]
mov rcx, rbx
call fcn.180005820
nop
jmp 0x18000c623
cmp byte [rsi + 0x1b8], r12b
je 0x18000c4dc
cmp qword [rsi + 0x1a0], r12
je 0x18000c4dc
call fcn.18001cfc0
lea rcx, [rsi + 0x50]
test eax, eax
je 0x18000c49a
mov r8d, 9
lea rdx, str.C:Users_
call fcn.1800076f0
lea rdx, [rsi + 0x190]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rax
call fcn.180008ec0
mov r8d, 0x10
lea rdx, str.AppDataRoaming
mov rcx, rax
call fcn.1800076f0
jmp 0x18000c600
mov r8d, 0x1a
lea rdx, str.C:Documents_and_Settings_
call fcn.1800076f0
lea rdx, [rsi + 0x190]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rax
call fcn.180008ec0
mov r8d, 0x11
lea rdx, str.Application_Data
mov rcx, rax
call fcn.1800076f0
jmp 0x18000c600
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 7
lea rdx, str.AppData
lea rcx, [rbp + 0x17]
call fcn.180007850
nop
mov qword [rbp + 7], 7
mov qword [rbp - 1], r12
mov word [rbp - 0x11], r12w
mov r8d, 0x40
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [rbp - 0x11]
call fcn.180007850
nop
mov qword [rbp - 0x51], 0xffffffff80000001
lea r9, [rbp + 0x17]
lea r8, [rbp - 0x11]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x39]
call fcn.18000c920
nop
mov rdx, rax
lea rcx, [rsi + 0x50]
call fcn.18000a370
nop
cmp qword [rbp - 0x21], 8
jb 0x18000c567
mov rcx, qword [rbp - 0x39]
call fcn.18007309c
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
cmp qword [rbp + 7], 8
jb 0x18000c588
mov rcx, qword [rbp - 0x11]
call fcn.18007309c
mov qword [rbp + 7], 7
mov qword [rbp - 1], r12
mov word [rbp - 0x11], r12w
cmp qword [rbp + 0x2f], 8
jb 0x18000c5a9
mov rcx, qword [rbp + 0x17]
call fcn.18007309c
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
cmp qword [rsi + 0x60], 0
jne 0x18000c600
lea rdx, [0x1800b26c8]
lea rcx, [rbp - 0x39]
call fcn.18000cb30
nop
mov rdx, rax
lea rcx, [rsi + 0x50]
call fcn.18000a370
nop
cmp qword [rbp - 0x21], 8
jb 0x18000c5ef
mov rcx, qword [rbp - 0x39]
call fcn.18007309c
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r12
mov word [rbp - 0x39], r12w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsi + 0x50]
mov rcx, rbx
call fcn.180005820
mov dword [rbp - 0x59], 1
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180073c80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret