Function at 0x1000151f8
Capabilities:
Check os version
Create service
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
push r13
push r14
push r15
sub rsp, 0x710
mov rax, qword [0x10002c180]
xor rax, rsp
mov qword [rsp + 0x700], rax
lea r15, [0x10002ed10]
mov r14d, 0x104
lea r8, [0x100013558]
lea rcx, [r11 - 0x448]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x64
call fcn.100015be0
mov ebx, eax
test eax, eax
jne 0x10001561a
lea r8, [0x100013558]
lea rcx, [rsp + 0x4f0]
mov r9, r15
mov rdx, r14
mov dword [rsp + 0x20], 0x65
call fcn.100015be0
mov ebx, eax
test eax, eax
jne 0x10001561a
lea r8d, [rax + 3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13d, 1
lea rbp, [0x100013510]
mov rbx, rax
test rax, rax
je 0x100015371
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
lea rax, [0x100013528]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r13d
lea r9d, [r13 + 3]
lea r8, [rsp + 0x2e0]
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x100015329
lea rcx, [0x100013d40]
mov rdx, rbp
call fcn.10001e018
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100015366
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x10001533f
lea rcx, [0x100013d80]
jmp 0x10001534d
cmp eax, 0x436
jne 0x100015354
lea rcx, [0x100013e10]
call fcn.10001e018
jmp 0x100015366
lea rcx, [0x100013f20]
mov r8d, eax
mov rdx, rbp
call fcn.10001e018
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001538b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100013f80]
mov edx, eax
call fcn.10001e018
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rsp + 0x4f0]
lea r8, [rsp + 0x70]
mov edx, r13d
mov rcx, rbp
mov qword [rsp + 0x70], rax
call fcn.10001af88
mov ebx, eax
test eax, eax
jne 0x10001561a
mov eax, dword [0x10002ef34]
test eax, eax
jne 0x100015454
mov ebx, 0x114
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8, rbx
mov dword [0x10002ef34], r13d
call fcn.10001f020
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10001544e
mov eax, dword [rsp + 0xd4]
cmp eax, 5
jne 0x10001541e
mov eax, dword [rsp + 0xd8]
neg eax
sbb ecx, ecx
neg ecx
add ecx, 2
mov dword [0x10002ef34], ecx
jmp 0x1000154ed
cmp eax, 6
jb 0x10001544e
cmp dword [rsp + 0xd8], 0
jne 0x100015441
cmp eax, 6
jne 0x100015441
mov dword [0x10002ef34], 4
jmp 0x1000154ed
mov eax, 5
mov dword [0x10002ef34], eax
jmp 0x100015454
mov eax, dword [0x10002ef34]
cmp eax, 5
jl 0x1000154ed
and qword [rsp + 0xc0], 0
lea rax, [0x100013628]
lea r8, [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [0x100013678]
mov edx, 8
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x70], 2
mov dword [rsp + 0x74], 0x28
mov dword [rsp + 0x90], r13d
mov dword [rsp + 0x94], r13d
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xa0], r13d
mov dword [rsp + 0xb0], r13d
call fcn.10001af88
mov ebx, eax
test eax, eax
jne 0x10001561a
and qword [rsp + 0x70], 0
lea r9, [0x100013540]
lea r8, [0x100014140]
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov dword [rsp + 0x80], 7
mov qword [rsp + 0x20], rbp
call fcn.100015be0
mov ebx, eax
test eax, eax
jne 0x10001560a
lea rax, [rsp + 0x88]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10001557c
lea rcx, [0x1000141b0]
jmp 0x1000155f5
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x70]
lea rdx, [0x100014240]
lea eax, [rax + rax + 2]
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000155ba
lea rcx, [0x100014270]
jmp 0x1000155f5
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea rdx, [0x100014308]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10001560a
lea rcx, [0x100014330]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10001e018
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x10001561a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x700]
xor rcx, rsp
call fcn.10001dd30
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret