Function at 0x18002ad90
Capabilities:
Check os version
Create service
Persist via windows service
Set registry value
Start service

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x370
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
mov r12d, 1
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0xc8
mov edi, r12d
mov r15d, r9d
call fcn.180113150
mov rdx, rbp
mov rcx, rbx
call sym.SafeBase64.dll_CopyDriverFile
lea r8, str.System32Drivers_
lea edx, [r12 + 0x62]
lea rcx, [rsp + 0x80]
call fcn.1801259f0
mov r8, rbp
lea edx, [r12 + 0x62]
lea rcx, [rsp + 0x80]
call fcn.180125a58
lea r8, str..sys
lea edx, [r12 + 0x62]
lea rcx, [rsp + 0x80]
call fcn.180125a58
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x18002affa
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov qword [rsp + 0x60], 0
lea rdx, [0x1801589f8]
mov qword [rsp + 0x58], 0
lea rcx, str.tcpip
cmp al, 6
mov r9d, 0xf01ff
lea rax, [rsp + 0x70]
mov r8, rbp
cmovae rcx, rdx
mov rdx, rbp
mov qword [rsp + 0x50], rcx
mov rcx, r14
mov qword [rsp + 0x48], rax
lea rax, str.PNP_TDI
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r12d, dword [rsp + 0x3d0]
mov rbx, rax
test rax, rax
jne 0x18002b01c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x18002aef4
mov edx, r15d
mov rcx, rbp
call sym.SafeBase64.dll_SetDriverStartType
xor edi, edi
jmp 0x18002af17
test r12d, r12d
je 0x18002af17
mov r8d, 0xf003f
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x18002b028
mov rcx, rbp
call sym.SafeBase64.dll_CheckDriverRemoved
test eax, eax
je 0x18002af2e
mov edx, r15d
mov rcx, rbp
call sym.SafeBase64.dll_SetDriverStartType
mov r15d, 1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x18002aff8
test rsi, rsi
je 0x18002aff8
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x208
call fcn.180113150
mov r9, rbp
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x103
lea rcx, [rsp + 0x150]
call fcn.18000f870
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], 0
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x150]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18002aff8
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x18002afc0
mov rcx, qword [rsp + 0x70]
lea rdx, str.InstPath
add eax, eax
mov r9d, r15d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x370
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rsp + 0x70]
mov rcx, r14
call fcn.18002a9c0
test r12d, r12d
je 0x18002b064
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, eax
test eax, eax
jne 0x18002b075
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, 1
mov rcx, rbx
cmp eax, 0x420
cmove edi, r15d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18002af34
mov rcx, rbx
mov r15d, edi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18002af34
mov rcx, rbx
mov r15d, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18002af34