Function at 0x140039dd0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1401b6838]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
lea rbx, [0x1401b6898]
mov rcx, qword [0x1401b6898]
cmp rcx, rbx
je 0x140039e3e
test byte [rcx + 0x1c], 2
je 0x140039e3e
cmp byte [rcx + 0x19], 4
jb 0x140039e3e
lea edx, [r15 + 0xa]
lea r8, [0x14014fc88]
mov rcx, qword [rcx + 0x10]
call fcn.1400196a0
lea r8, [0x14014ffe8]
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.14007dfd0
test eax, eax
je 0x140039e89
mov rcx, qword [0x1401b6898]
cmp rcx, rbx
je 0x140039e89
test byte [rcx + 0x1c], 2
je 0x140039e89
cmp byte [rcx + 0x19], 2
jb 0x140039e89
mov edx, 0xb
lea r8, [0x14014fc88]
mov rcx, qword [rcx + 0x10]
call fcn.1400196a0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x14003a1c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x140039ef3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x14003a1c0
xorps xmm0, xmm0
mov eax, dword [rsp + 0x40]
mov ebx, eax
movdqu xmmword [rsp + 0x50], xmm0
mov r13, r15
mov qword [rsp + 0x60], r15
test eax, eax
je 0x140039f41
lfence
mov ecx, eax
call fcn.140015200
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r13, [rax + rbx]
mov qword [rsp + 0x60], r13
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140123210
mov qword [rsp + 0x58], r13
mov eax, dword [rsp + 0x40]
jmp 0x140039f46
mov rsi, qword [rsp + 0x50]
mov edi, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x30], r15
mov rbx, r15
test eax, eax
je 0x140039f92
lfence
mov ecx, edi
call fcn.140015200
mov rbx, rax
mov r12, rax
lea r14, [rax + rdi]
mov qword [rsp + 0x30], r14
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140123210
mov r13, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
jmp 0x140039f97
mov r12, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x14003a047
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test rbx, rbx
je 0x14003a00a
sub r14, rbx
cmp r14, 0x1000
jb 0x140039ffe
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14003a1f2
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.14012e940
nop
test rsi, rsi
je 0x14003a042
sub r13, rsi
mov rax, rsi
cmp r13, 0x1000
jb 0x14003a037
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a1f8
mov rdx, r13
mov rcx, rsi
call fcn.14012e940
jmp 0x14003a1c0
cmp byte [rsi], 0
je 0x14003a084
mov rdi, r15
nop
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x14003a07b
mov r14, r12
sub r14, rsi
movsx ecx, al
call fcn.140102fc4
mov byte [r14 + rbx], al
inc rdi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14003a061
inc rdi
cmp byte [rsi + rdi], 0
jne 0x14003a050
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0x80], xmm0
mov eax, dword [0x140150090]
mov dword [rsp + 0x90], eax
mov edi, r15d
cmp byte [r12], r15b
je 0x14003a148
mov r14, r15
mov rax, r12
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14003a0c7
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140102ec0
test rax, rax
jne 0x14003a103
cmp r15d, edi
je 0x14003a0ff
lea eax, [rbx + 1]
movsxd r8, eax
lea rdx, [rsi + r14]
movsxd rcx, edi
add rcx, rsi
call fcn.140122e00
inc edi
add edi, ebx
inc r15d
add r15d, ebx
movsxd r14, r15d
lea rax, [r12 + r14]
cmp byte [rax], 0
jne 0x14003a0c0
cmp r15d, edi
je 0x14003a148
movsxd rax, edi
mov byte [rax + rsi], 0
lea eax, [rdi + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test r12, r12
je 0x14003a18b
mov rdx, qword [rsp + 0x30]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x14003a182
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a1f2
mov rcx, r12
call fcn.14012e940
nop
test rsi, rsi
je 0x14003a1c0
sub r13, rsi
mov rax, rsi
cmp r13, 0x1000
jb 0x14003a1b4
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a1f8
mov rdx, r13
mov rcx, rsi
call fcn.14012e940
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14012e910
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1400fec40
nop
call fcn.1400fec40
int3