Function at 0x140008c80
Capabilities:
Check if file exists
Create service
Get common file path
Modify service
Persist via windows service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x690
mov rbx, rcx
lea rdi, [rsp + 0x270]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x478]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x270]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, str.UI0Detect.exe
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x478]
mov edx, 0x104
lea r8, [0x14001a7b8]
lea r9, [rsp + 0x270]
call fcn.14000e950
lea rcx, [rsp + 0x478]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140008d7c
call fcn.140002fe0
cmp eax, 0x42ee
jb 0x140008da0
lea rax, str.Wls0wndh.dll
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x68]
mov edx, 0x104
lea r8, [0x14001a7b8]
lea r9, [rsp + 0x270]
call fcn.14000e950
lea rcx, [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140008da0
mov rcx, rbx
lea rdx, str.Move__Wls0wndh.dll__file_to_the_System32_folder.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140008ef3
mov rcx, rbx
lea rdx, str.Move__UI0Detect.exe__file_to_the_System32_folder.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140008ef3
xor ecx, ecx
xor edx, edx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140008de2
mov rcx, rbx
lea rdx, str.Required_run_as_Administrator.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x140008ef3
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x478]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
mov rcx, rsi
lea rdx, str.UI0Detect
lea r8, str.Interactive_Services_Detection
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
mov dword [rsp + 0x470], 0
mov dword [rsp + 0x470], 1
mov rcx, rbx
mov edx, 5
lea r8, [rsp + 0x470]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xor edi, edi
mov qword [rsp + 0x688], rdi
lea rax, str.SeAssignPrimaryTokenPrivilege
mov qword [rsp + 0x688], rax
mov rcx, rbx
mov edx, 6
lea r8, [rsp + 0x688]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov qword [rsp + 0x680], rdi
lea rax, str.Enables_user_notification_of_user_input_for_interactive_services__which_enables_access_to_dialogs_created_by_interactive_services_when_they_appear._If_this_service_is_stopped__notifications_of_new_interactive_service_dialogs_will_no_longer_function_and_there_might_not_be_access_to_interactive_service_dialogs._If_this_service_is_disabled__both_notifications_of_and_access_to_new_interactive_service_dialogs_will_no_longer_function.
mov qword [rsp + 0x680], rax
mov rcx, rbx
mov edx, 1
lea r8, [rsp + 0x680]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret