Function at 0x14003a4a0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1401c7808]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
lea rbx, [0x1401c7a08]
mov rcx, qword [0x1401c7a08]
cmp rcx, rbx
je 0x14003a50e
test byte [rcx + 0x1c], 2
je 0x14003a50e
cmp byte [rcx + 0x19], 4
jb 0x14003a50e
lea edx, [r15 + 0xa]
lea r8, [0x14015ee08]
mov rcx, qword [rcx + 0x10]
call fcn.140008930
lea r8, [0x14015f188]
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.140080700
test eax, eax
je 0x14003a559
mov rcx, qword [0x1401c7a08]
cmp rcx, rbx
je 0x14003a559
test byte [rcx + 0x1c], 2
je 0x14003a559
cmp byte [rcx + 0x19], 2
jb 0x14003a559
mov edx, 0xb
lea r8, [0x14015ee08]
mov rcx, qword [rcx + 0x10]
call fcn.140008930
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003a900
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14003a5c3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003a900
xorps xmm0, xmm0
mov eax, dword [rsp + 0x40]
mov ebx, eax
movdqu xmmword [rsp + 0x50], xmm0
mov r13, r15
mov qword [rsp + 0x60], r15
test eax, eax
je 0x14003a646
cmp rax, 0x1000
jb 0x14003a612
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14003a932
lfence
call fcn.14013bb30
test rax, rax
je 0x14003a943
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14003a620
lfence
mov rcx, rbx
call fcn.14013bb30
mov rdi, rax
mov qword [rsp + 0x50], rdi
lea r13, [rdi + rbx]
mov qword [rsp + 0x60], r13
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14012f310
mov qword [rsp + 0x58], r13
mov eax, dword [rsp + 0x40]
jmp 0x14003a64b
mov rdi, qword [rsp + 0x50]
mov esi, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x30], r15
mov rbx, r15
test eax, eax
je 0x14003a6cd
cmp rsi, 0x1000
jb 0x14003a69a
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14003a938
lfence
call fcn.14013bb30
test rax, rax
je 0x14003a93d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14003a6a8
lfence
mov rcx, rsi
call fcn.14013bb30
mov rbx, rax
mov r12, rbx
lea r14, [rbx + rsi]
mov qword [rsp + 0x30], r14
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.14012f310
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
jmp 0x14003a6d2
mov r12, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14003a782
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14003a745
sub r14, rbx
cmp r14, 0x1000
jb 0x14003a739
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14003a93d
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.14013b860
nop
test rdi, rdi
je 0x14003a77d
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14003a772
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a943
mov rdx, r13
mov rcx, rdi
call fcn.14013b860
jmp 0x14003a900
cmp byte [rdi], 0
je 0x14003a7c4
mov rsi, r15
nop word [rax + rax]
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x14003a7bb
mov r14, r12
sub r14, rdi
movsx ecx, al
call fcn.14010ddb4
mov byte [r14 + rbx], al
inc rsi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14003a7a1
inc rsi
cmp byte [rsi + rdi], 0
jne 0x14003a790
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0x80], xmm0
mov eax, dword [0x14015f230]
mov dword [rsp + 0x90], eax
mov esi, r15d
cmp byte [r12], r15b
je 0x14003a888
mov r14, r15
mov rax, r12
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003a807
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14010dcb0
test rax, rax
jne 0x14003a843
cmp r15d, esi
je 0x14003a83f
lea eax, [rbx + 1]
movsxd r8, eax
lea rdx, [r14 + rdi]
movsxd rcx, esi
add rcx, rdi
call fcn.14012ec40
inc esi
add esi, ebx
inc r15d
add r15d, ebx
movsxd r14, r15d
lea rax, [r14 + r12]
cmp byte [rax], 0
jne 0x14003a800
cmp r15d, esi
je 0x14003a888
movsxd rax, esi
mov byte [rax + rdi], 0
lea eax, [rsi + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
je 0x14003a8cb
mov rdx, qword [rsp + 0x30]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x14003a8c2
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a93d
mov rcx, r12
call fcn.14013b860
nop
test rdi, rdi
je 0x14003a900
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14003a8f4
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a943
mov rdx, r13
mov rcx, rdi
call fcn.14013b860
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14013b830
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140009190
nop
call fcn.140009190
call fcn.140107b20
nop
call fcn.140107b20
int3