Function at 0x1000152b8
Capabilities:
Check os version
Create service
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
push r13
push r14
push r15
sub rsp, 0x710
mov rax, qword [0x100030180]
xor rax, rsp
mov qword [rsp + 0x700], rax
lea r15, [0x100033010]
mov r14d, 0x104
lea r8, [0x100013568]
lea rcx, [r11 - 0x448]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x64
call fcn.100015ca0
mov ebx, eax
test eax, eax
jne 0x1000156da
lea r8, [0x100013568]
lea rcx, [rsp + 0x4f0]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x65
call fcn.100015ca0
mov ebx, eax
test eax, eax
jne 0x1000156da
lea r8d, [rax + 3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13d, 1
lea rbp, [0x100013520]
mov rbx, rax
test rax, rax
je 0x100015431
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x100013538]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
lea r9d, [r13 + 3]
lea r8, [rsp + 0x2e0]
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x1000153e9
lea rcx, [0x100013db0]
mov rdx, rbp
call fcn.10001e3a8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100015426
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x1000153ff
lea rcx, [0x100013df0]
jmp 0x10001540d
cmp eax, 0x436
jne 0x100015414
lea rcx, [fcn.100013e80]
call fcn.10001e3a8
jmp 0x100015426
lea rcx, [0x100013f90]
mov r8d, eax
mov rdx, rbp
call fcn.10001e3a8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001544b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100013ff0]
mov edx, eax
call fcn.10001e3a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rsp + 0x4f0]
lea r8, [rsp + 0x70]
mov edx, r13d
mov rcx, rbp
mov qword [rsp + 0x70], rax
call fcn.10001b37c
mov ebx, eax
test eax, eax
jne 0x1000156da
mov eax, dword [0x100033234]
test eax, eax
jne 0x100015514
mov ebx, 0x114
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8, rbx
mov dword [0x100033234], r13d
call fcn.10001f590
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10001550e
mov eax, dword [rsp + 0xd4]
cmp eax, 5
jne 0x1000154de
mov eax, dword [rsp + 0xd8]
neg eax
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [0x100033234], ecx
jmp 0x1000155ad
cmp eax, 6
jb 0x10001550e
cmp dword [rsp + 0xd8], 0
jne 0x100015501
cmp eax, 6
jne 0x100015501
mov dword [0x100033234], 4
jmp 0x1000155ad
mov eax, 5
mov dword [0x100033234], eax
jmp 0x100015514
mov eax, dword [0x100033234]
cmp eax, 5
jl 0x1000155ad
and qword [rsp + 0xc0], 0
lea rax, [0x100013638]
lea r8, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [0x100013688]
mov edx, 8
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x74], 0x28
mov dword [rsp + 0x90], r13d
mov dword [rsp + 0x94], r13d
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xa0], r13d
mov dword [rsp + 0xb0], r13d
call fcn.10001b37c
mov ebx, eax
test eax, eax
jne 0x1000156da
and qword [rsp + 0x70], 0
lea r9, [0x100013550]
lea r8, [0x1000141b0]
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov dword [rsp + 0x80], 7
mov qword [rsp + 0x20], rbp
call fcn.100015ca0
mov ebx, eax
test eax, eax
jne 0x1000156ca
lea rax, [rsp + 0x88]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10001563c
lea rcx, [0x100014220]
jmp 0x1000156b5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1000142b0]
lea eax, [rax + rax + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10001567a
lea rcx, [0x1000142e0]
jmp 0x1000156b5
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea rdx, [0x100014378]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000156ca
lea rcx, [0x1000143a0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10001e3a8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1000156da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.10001e0c0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret