Function at 0x1400012a4
Capabilities:
Install driver
Persist via windows service
Set registry value

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
call fcn.140001000
lea rdx, [0x140002890]
mov dword [rbp + 0x88], 1
lea rcx, [rbp - 0x58]
mov dword [rbp + 0x80], 3
mov dword [rbp + 0x90], 1
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400028a0]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400028c0]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400028e0]
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140002900]
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140002910]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx eax, word [0x140002880]
lea r8, [rsp + 0x68]
movaps xmm0, xmmword [0x140002830]
lea rcx, [rsp + 0x40]
movaps xmm1, xmmword [0x140002840]
mov r15d, 4
and qword [rsp + 0x40], 0
xor r9d, r9d
and dword [rsp + 0x6c], 0
mov edx, 0xf003f
and dword [rbp - 0x7c], 0
and qword [rsp + 0x70], 0
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x140002850]
mov word [rbp + 0x40], ax
movzx eax, word [0x140002988]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [0x140002870]
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x58]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm0, qword [0x140002980]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x30], rax
movsd qword [rsp + 0x48], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [0x140002860]
mov dword [rsp + 0x28], r15d
and qword [rsp + 0x20], 0
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x68], 0x30
movaps xmmword [rbp + 0x20], xmm1
mov dword [rbp - 0x80], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x1400014ff
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x28], r15d
lea rdx, [rbp - 0x68]
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x58]
xor ebx, ebx
mov dword [rsp + 0x28], r15d
test eax, eax
mov edi, 0xc0000001
lea rax, [rbp + 0x88]
mov r9d, r15d
cmovs ebx, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x48]
test eax, eax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x90]
mov r9d, r15d
cmovs ebx, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea r9d, [r15 - 3]
test eax, eax
mov dword [rsp + 0x28], 0xa
lea rax, [rsp + 0x48]
cmovs ebx, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
lea r9d, [r15 - 2]
test eax, eax
mov dword [rsp + 0x28], 0x52
lea rax, [rbp - 0x10]
cmovs ebx, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
test eax, eax
cmovs ebx, edi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x14000150c
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov ebx, eax
mov eax, ebx
add rsp, 0x158
pop r15
pop rdi
pop rbx
pop rbp
ret