Function at 0x1800256b0
Capabilities:
Check os version
Create process on windows
Get common file path
Persist via windows service
Query or enumerate registry key
Query service status
Set registry value
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x940]
sub rsp, 0xa40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x930], rax
mov r12d, ecx
xor r13d, r13d
lea rcx, [rbp + 0x510]
mov dword [rbp - 0x80], r13d
xor edx, edx
mov r8d, 0x208
mov esi, r13d
call fcn.180113150
lea rcx, [rsp + 0x70]
test r12d, r12d
je 0x18002575a
mov dword [rsp + 0x70], r13d
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x180025729
cmp dword [rsp + 0x70], r13d
jne 0x18002578f
mov ecx, 1
call qword [sym.imp.dwmapi.dll_Ordinal_102]
lea rcx, [rsp + 0x70]
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x180025749
cmp dword [rsp + 0x70], esi
jne 0x18002578f
mov edi, 2
mov r14d, r13d
lea ebx, [rdi - 1]
lea r15d, [rdi + 2]
jmp 0x1800257aa
mov dword [rsp + 0x70], 1
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x180025772
cmp dword [rsp + 0x70], esi
je 0x18002578f
xor ecx, ecx
call qword [sym.imp.dwmapi.dll_Ordinal_102]
lea rcx, [rsp + 0x70]
call qword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jne 0x180025799
cmp dword [rsp + 0x70], esi
jne 0x180025799
mov eax, 1
jmp 0x180025d96
mov r15d, 1
mov edi, 4
mov r14d, r15d
mov ebx, r13d
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Composition
mov dword [rsp + 0x68], ebx
lea rdx, str.SoftwareMicrosoftWindowsDWM
mov rcx, 0xffffffff80000001
call sym.SafeBase64.dll_SetRegValue
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.VisualFXSetting
mov dword [rsp + 0x68], ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffects
mov rcx, 0xffffffff80000001
call sym.SafeBase64.dll_SetRegValue
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.DefaultApplied
mov dword [rsp + 0x68], ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerVisualEffectsDWMEnabled
mov rcx, 0xffffffff80000001
call sym.SafeBase64.dll_SetRegValue
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.ThemeActive
mov dword [rsp + 0x68], ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov rcx, 0xffffffff80000001
call sym.SafeBase64.dll_SetRegValue
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x1fe
call fcn.180113150
xor edx, edx
lea rcx, [rbp + 0x300]
mov r8d, 0x208
call fcn.180113150
lea rax, [rsp + 0x60]
mov dword [rbp - 0x7c], 0x104
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], r13d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_Policy_Objects
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800259a9
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], r13
lea r8, [rbp - 0x7c]
mov qword [rsp + 0x50], r13
lea rdx, [rbp + 0x300]
mov qword [rsp + 0x48], r13
xor r9d, r9d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, r13d
cmp dword [rsp + 0x68], ebx
jbe 0x18002599e
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x38], r13
lea r8, [rbp + 0xf0]
mov qword [rsp + 0x30], r13
mov edx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x78], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180025996
lea rdx, str.User
lea rcx, [rbp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180025afc
inc ebx
cmp ebx, dword [rsp + 0x68]
jb 0x180025940
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, str.UxSms
call sym.SafeBase64.dll_QueryDriverValue
cmp edi, dword [rbp - 0x80]
je 0x180025a9c
xor edx, edx
mov dword [rbp - 0x80], edi
mov r8d, 0x208
mov dword [rsp + 0x68], edi
lea rcx, [rbp + 0xf0]
call fcn.180113150
lea r8, str.SystemCurrentControlSetServices_
mov edx, 0x103
lea rcx, [rbp + 0xf0]
call fcn.1801259f0
lea r8, str.UxSms
mov edx, 0x103
lea rcx, [rbp + 0xf0]
call fcn.180125a58
cmp dword [rsp + 0x68], 4
ja 0x180025a9c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xf0]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180025a9c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x180025ba7
mov r8d, 0xf01ff
lea rdx, str.UxSms
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180025b9e
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x180025b92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180025b95
lea r8, [rbp + 0xf0]
mov edx, 0x103
lea rcx, [rbp + 0x510]
call fcn.180125a58
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.SOFTWAREPoliciesMicrosoftWindowsDWM
mov edx, 0x103
mov qword [rsp + 0x28], rax
lea r9, str.SoftwareMicrosoftWindowsCurrentVersionGroup_Policy_Objects
lea rax, [rbp + 0x510]
lea r8, str._s_s_s
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x720]
call fcn.18000f870
lea rax, [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.DisallowComposition
mov dword [rsp + 0x78], r14d
lea rdx, [rbp + 0x720]
mov rcx, 0xffffffff80000001
call sym.SafeBase64.dll_SetRegValue
jmp 0x1800259a9
mov esi, dword [rbp - 0x74]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp r15d, esi
je 0x180025c87
test r12d, r12d
je 0x180025bc6
lea rcx, str.UxSms
call sym.SafeBase64.dll_StartDriver
jmp 0x180025c87
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180025c2d
lea r8, [rbp - 0x74]
xor ecx, ecx
lea rdx, str.SeLoadDriverPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rbp - 0x78], 1
mov dword [rbp - 0x6c], 2
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x180025c87
mov r8d, 0x24
lea rdx, str.UxSms
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180025c7e
lea r8, [rbp - 0x58]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
lea rcx, [rbp - 0x2c]
mov r8d, 0x118
call fcn.180113150
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x2c], 6
mov ebx, eax
jne 0x180025d94
cmp dword [rbp - 0x28], 2
jae 0x180025d94
xor edx, edx
lea rcx, [rbp + 0x300]
mov r8d, 0x104
call fcn.180113150
mov edx, 0x104
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, str.Resources_themes_aero.theme
mov edx, 0x103
lea rcx, [rbp + 0x300]
call fcn.180127860
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x104
call fcn.180113150
lea rax, [rbp + 0x300]
mov edx, 0x103
lea r9, str.rundll32.exe_shell32.dll__Control_RunDLL_desk.cpl_desk__Themes__Action:OpenTheme__file:
mov qword [rsp + 0x20], rax
lea r8, str._s__s_
lea rcx, [rbp + 0xf0]
call fcn.180010810
mov edx, 5
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.N_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x180025d81
xor edx, edx
lea rcx, str.CabinetWClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x180025d94
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
mov rcx, qword [rbp + 0x930]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0xa40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret