Function at 0x140053790
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
lea rbx, [0x140187398]
mov rcx, qword [0x140187398]
cmp rcx, rbx
je 0x1400537fe
test byte [rcx + 0x1c], 2
je 0x1400537fe
cmp byte [rcx + 0x19], 4
jb 0x1400537fe
lea edx, [r15 + 0xa]
lea r8, [0x140134478]
mov rcx, qword [rcx + 0x10]
call fcn.14000a720
lea r8, [0x140134778]
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.1400941a0
test eax, eax
je 0x140053849
mov rcx, qword [0x140187398]
cmp rcx, rbx
je 0x140053849
test byte [rcx + 0x1c], 2
je 0x140053849
cmp byte [rcx + 0x19], 2
jb 0x140053849
mov edx, 0xb
lea r8, [0x140134478]
mov rcx, qword [rcx + 0x10]
call fcn.14000a720
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140053bf0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1400538b3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140053bf0
xorps xmm0, xmm0
mov eax, dword [rsp + 0x40]
mov ebx, eax
movdqu xmmword [rsp + 0x50], xmm0
mov r13, r15
mov qword [rsp + 0x60], r15
test eax, eax
je 0x140053936
cmp rax, 0x1000
jb 0x140053902
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x140053c22
lfence
call fcn.1400e9d0c
test rax, rax
je 0x140053c33
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140053910
lfence
mov rcx, rbx
call fcn.1400e9d0c
mov rdi, rax
mov qword [rsp + 0x50], rdi
lea r13, [rdi + rbx]
mov qword [rsp + 0x60], r13
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1400ec650
mov qword [rsp + 0x58], r13
mov eax, dword [rsp + 0x40]
jmp 0x14005393b
mov rdi, qword [rsp + 0x50]
mov esi, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x30], r15
mov rbx, r15
test eax, eax
je 0x1400539bd
cmp rsi, 0x1000
jb 0x14005398a
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140053c28
lfence
call fcn.1400e9d0c
test rax, rax
je 0x140053c2d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140053998
lfence
mov rcx, rsi
call fcn.1400e9d0c
mov rbx, rax
mov r12, rbx
lea r14, [rbx + rsi]
mov qword [rsp + 0x30], r14
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1400ec650
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
jmp 0x1400539c2
mov r12, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140053a72
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140053a35
sub r14, rbx
cmp r14, 0x1000
jb 0x140053a29
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140053c2d
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.1400e9cd4
nop
test rdi, rdi
je 0x140053a6d
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x140053a62
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053c33
mov rdx, r13
mov rcx, rdi
call fcn.1400e9cd4
jmp 0x140053bf0
cmp byte [rdi], 0
je 0x140053ab4
mov rsi, r15
nop word [rax + rax]
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x140053aab
mov r14, r12
sub r14, rdi
movsx ecx, al
call fcn.1400fdd48
mov byte [r14 + rbx], al
inc rsi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x140053a91
inc rsi
cmp byte [rsi + rdi], 0
jne 0x140053a80
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0x80], xmm0
mov eax, dword [0x140134820]
mov dword [rsp + 0x90], eax
mov esi, r15d
cmp byte [r12], r15b
je 0x140053b78
mov r14, r15
mov rax, r12
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140053af7
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1400fdc44
test rax, rax
jne 0x140053b33
cmp r15d, esi
je 0x140053b2f
lea eax, [rbx + 1]
movsxd r8, eax
lea rdx, [r14 + rdi]
movsxd rcx, esi
add rcx, rdi
call fcn.1400ebf80
inc esi
add esi, ebx
inc r15d
add r15d, ebx
movsxd r14, r15d
lea rax, [r14 + r12]
cmp byte [rax], 0
jne 0x140053af0
cmp r15d, esi
je 0x140053b78
movsxd rax, esi
mov byte [rax + rdi], 0
lea eax, [rsi + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
je 0x140053bbb
mov rdx, qword [rsp + 0x30]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x140053bb2
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053c2d
mov rcx, r12
call fcn.1400e9cd4
nop
test rdi, rdi
je 0x140053bf0
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x140053be4
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053c33
mov rdx, r13
mov rcx, rdi
call fcn.1400e9cd4
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400e9cb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140007ed0
nop
call fcn.140007ed0
call fcn.1400f8ad4
nop
call fcn.1400f8ad4
int3