Function at 0x140038330
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1401b3838]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor r15d, r15d
mov dword [rsp + 0x40], r15d
lea rbx, [0x1401b3898]
mov rcx, qword [0x1401b3898]
cmp rcx, rbx
je 0x14003839e
test byte [rcx + 0x1c], 2
je 0x14003839e
cmp byte [rcx + 0x19], 4
jb 0x14003839e
lea edx, [r15 + 0xa]
lea r8, [0x14014da60]
mov rcx, qword [rcx + 0x10]
call fcn.140019610
lea r8, [0x14014dda8]
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.140078720
test eax, eax
je 0x1400383e9
mov rcx, qword [0x1401b3898]
cmp rcx, rbx
je 0x1400383e9
test byte [rcx + 0x1c], 2
je 0x1400383e9
cmp byte [rcx + 0x19], 2
jb 0x1400383e9
mov edx, 0xb
lea r8, [0x14014da60]
mov rcx, qword [rcx + 0x10]
call fcn.140019610
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x140038720
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x140038453
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x140038720
xorps xmm0, xmm0
mov eax, dword [rsp + 0x40]
mov ebx, eax
movdqu xmmword [rsp + 0x50], xmm0
mov r13, r15
mov qword [rsp + 0x60], r15
test eax, eax
je 0x1400384a1
lfence
mov ecx, eax
call fcn.140015170
mov rsi, rax
mov qword [rsp + 0x50], rax
lea r13, [rax + rbx]
mov qword [rsp + 0x60], r13
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140121c70
mov qword [rsp + 0x58], r13
mov eax, dword [rsp + 0x40]
jmp 0x1400384a6
mov rsi, qword [rsp + 0x50]
mov edi, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r14, r15
mov qword [rsp + 0x30], r15
mov rbx, r15
test eax, eax
je 0x1400384f2
lfence
mov ecx, edi
call fcn.140015170
mov rbx, rax
mov r12, rax
lea r14, [rax + rdi]
mov qword [rsp + 0x30], r14
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.140121c70
mov r13, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
jmp 0x1400384f7
mov r12, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
je 0x1400385a7
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test rbx, rbx
je 0x14003856a
sub r14, rbx
cmp r14, 0x1000
jb 0x14003855e
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140038752
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.14012d3b0
nop
test rsi, rsi
je 0x1400385a2
sub r13, rsi
mov rax, rsi
cmp r13, 0x1000
jb 0x140038597
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038758
mov rdx, r13
mov rcx, rsi
call fcn.14012d3b0
jmp 0x140038720
cmp byte [rsi], 0
je 0x1400385e4
mov rdi, r15
nop
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x1400385db
mov r14, r12
sub r14, rsi
movsx ecx, al
call fcn.140101774
mov byte [r14 + rbx], al
inc rdi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x1400385c1
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1400385b0
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0x80], xmm0
mov eax, dword [0x14014de50]
mov dword [rsp + 0x90], eax
mov edi, r15d
cmp byte [r12], r15b
je 0x1400386a8
mov r14, r15
mov rax, r12
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140038627
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140101670
test rax, rax
jne 0x140038663
cmp r15d, edi
je 0x14003865f
lea eax, [rbx + 1]
movsxd r8, eax
lea rdx, [rsi + r14]
movsxd rcx, edi
add rcx, rsi
call fcn.140121860
inc edi
add edi, ebx
inc r15d
add r15d, ebx
movsxd r14, r15d
lea rax, [r12 + r14]
cmp byte [rax], 0
jne 0x140038620
cmp r15d, edi
je 0x1400386a8
movsxd rax, edi
mov byte [rax + rsi], 0
lea eax, [rdi + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
test r12, r12
je 0x1400386eb
mov rdx, qword [rsp + 0x30]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x1400386e2
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038752
mov rcx, r12
call fcn.14012d3b0
nop
test rsi, rsi
je 0x140038720
sub r13, rsi
mov rax, rsi
cmp r13, 0x1000
jb 0x140038714
add r13, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038758
mov rdx, r13
mov rcx, rsi
call fcn.14012d3b0
nop
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14012d380
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1400fd3f0
nop
call fcn.1400fd3f0
int3