Function at 0x146b4
Capabilities:
Install driver
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x340
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x330], rax
xor ebp, ebp
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0xf2]
lea r8d, [rbp + 0x3e]
xor edx, edx
mov qword [rsp + 0x40], rbp
mov word [rsp + 0xf0], bp
call fcn.00028240
mov esi, 0xfe
lea rcx, [rsp + 0x132]
xor edx, edx
mov r8, rsi
mov word [rsp + 0x130], bp
call fcn.00028240
lea rcx, [rsp + 0x232]
mov r8, rsi
xor edx, edx
mov word [rsp + 0x230], bp
call fcn.00028240
lea eax, [rbp + 0xc]
lea esi, [rbp + 1]
mov word [rsp + 0xaa], ax
lea ecx, [rbp + 0xa]
lea rax, [0x00028930]
mov qword [rsp + 0xb0], rax
lea rax, [0x00028940]
mov word [rsp + 0xa8], cx
mov qword [rsp + 0x80], rax
mov word [rsp + 0x7a], cx
lea eax, [rbp + 6]
mov word [rsp + 0x58], ax
lea rax, [0x00028970]
lea r8d, [rbp + 8]
mov qword [rsp + 0x60], rax
lea eax, [rbp + 0x12]
mov dword [rsp + 0x50], esi
mov word [rsp + 0x88], ax
lea eax, [rbp + 0x14]
mov dword [rsp + 0x54], esi
mov word [rsp + 0x8a], ax
lea rax, [0x00028980]
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x90], rax
lea eax, [rbp + 0x16]
mov dword [rsp + 0x4c], esi
mov word [rsp + 0x98], ax
lea eax, [rbp + 0x18]
mov word [rsp + 0x78], r8w
mov word [rsp + 0x9a], ax
lea rax, [0x000289a0]
mov word [rsp + 0x5a], r8w
mov qword [rsp + 0xa0], rax
lea ecx, [rdi + rbx]
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
lea rdx, [rsp + 0xf0]
add ecx, eax
call fcn.00014a90
lea r9, [rsp + 0xf0]
lea r8, [0x000289c0]
lea rcx, [rsp + 0x130]
mov edx, 0x100
call fcn.00014080
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x68]
call qword [fcn.004e696c]
lea rcx, [rsp + 0x130]
mov r8d, ebx
mov rdx, rdi
call fcn.0001517c
cmp eax, ebp
mov edi, eax
jl 0x14a1d
lea r9, [rsp + 0xf0]
lea r8, [0x00028a10]
lea rcx, [rsp + 0x230]
mov edx, 0x100
call fcn.00014080
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x68]
call qword [fcn.004e696c]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0xb8]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0xd0], 0x240
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0xe0], rbp
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, ebp
mov edi, eax
jl 0x14a1d
mov rcx, qword [rsp + 0x40]
lea edi, [rbp + 4]
lea rax, [rsp + 0x54]
lea rdx, [rsp + 0xa8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x78]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x4c]
lea rdx, [rsp + 0x58]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
xor eax, eax
or rbx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
mov rcx, rbx
lea rdx, [rsp + 0x98]
repne scasw ax, word [rdi]
mov r9d, esi
xor r8d, r8d
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
xor eax, eax
lea rdi, [rsp + 0x130]
mov rcx, rbx
lea r9d, [rbp + 2]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x88]
xor r8d, r8d
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov rcx, qword [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.000281c0
mov rbx, qword [rsp + 0x370]
add rsp, 0x340
pop rdi
pop rsi
pop rbp
ret