Function at 0x100006188
Capabilities:
Check os version
Create service
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
push r13
push r14
push r15
sub rsp, 0x710
mov rax, qword [0x10001d180]
xor rax, rsp
mov qword [rsp + 0x700], rax
lea r15, [0x10001fd10]
mov r14d, 0x104
lea r8, [0x100004548]
lea rcx, [r11 - 0x448]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x64
call fcn.100006b70
mov ebx, eax
test eax, eax
jne 0x1000065aa
lea r8, [0x100004548]
lea rcx, [rsp + 0x4f0]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x65
call fcn.100006b70
mov ebx, eax
test eax, eax
jne 0x1000065aa
lea r8d, [rax + 3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13d, 1
lea rbp, [0x100004500]
mov rbx, rax
test rax, rax
je 0x100006301
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x100004518]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
lea r9d, [r13 + 3]
lea r8, [rsp + 0x2e0]
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x1000062b9
lea rcx, [0x100004cd0]
mov rdx, rbp
call fcn.10000ec98
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000062f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x1000062cf
lea rcx, [0x100004d10]
jmp 0x1000062dd
cmp eax, 0x436
jne 0x1000062e4
lea rcx, [0x100004da0]
call fcn.10000ec98
jmp 0x1000062f6
lea rcx, [0x100004eb0]
mov r8d, eax
mov rdx, rbp
call fcn.10000ec98
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000631b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100004f10]
mov edx, eax
call fcn.10000ec98
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rsp + 0x4f0]
lea r8, [rsp + 0x70]
mov edx, r13d
mov rcx, rbp
mov qword [rsp + 0x70], rax
call fcn.10000bc00
mov ebx, eax
test eax, eax
jne 0x1000065aa
mov eax, dword [0x10001ff34]
test eax, eax
jne 0x1000063e4
mov ebx, 0x114
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8, rbx
mov dword [0x10001ff34], r13d
call fcn.10000fbe0
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000063de
mov eax, dword [rsp + 0xd4]
cmp eax, 5
jne 0x1000063ae
mov eax, dword [rsp + 0xd8]
neg eax
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [0x10001ff34], ecx
jmp 0x10000647d
cmp eax, 6
jb 0x1000063de
cmp dword [rsp + 0xd8], 0
jne 0x1000063d1
cmp eax, 6
jne 0x1000063d1
mov dword [0x10001ff34], 4
jmp 0x10000647d
mov eax, 5
mov dword [0x10001ff34], eax
jmp 0x1000063e4
mov eax, dword [0x10001ff34]
cmp eax, 5
jl 0x10000647d
and qword [rsp + 0xc0], 0
lea rax, [0x100004618]
lea r8, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [0x100004668]
mov edx, 8
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x74], 0x28
mov dword [rsp + 0x90], r13d
mov dword [rsp + 0x94], r13d
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xa0], r13d
mov dword [rsp + 0xb0], r13d
call fcn.10000bc00
mov ebx, eax
test eax, eax
jne 0x1000065aa
and qword [rsp + 0x70], 0
lea r9, [0x100004530]
lea r8, [0x1000050d0]
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov dword [rsp + 0x80], 7
mov qword [rsp + 0x20], rbp
call fcn.100006b70
mov ebx, eax
test eax, eax
jne 0x10000659a
lea rax, [rsp + 0x88]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10000650c
lea rcx, [0x100005140]
jmp 0x100006585
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1000051d0]
lea eax, [rax + rax + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10000654a
lea rcx, [0x100005200]
jmp 0x100006585
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea rdx, [0x100005298]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10000659a
lea rcx, [0x1000052c0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10000ec98
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1000065aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.10000e9b0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret