Function at 0x14014c800
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1401d6668]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r12, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rcx
xor r15d, r15d
mov dword [rsp + 0x60], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
call fcn.140022e10
nop
lea rbx, [0x1401d6a10]
mov rcx, qword [0x1401d6a10]
cmp rcx, rbx
je 0x14014c896
test byte [rcx + 0x1c], 1
je 0x14014c896
cmp byte [rcx + 0x19], 4
jb 0x14014c896
lea edx, [r15 + 0x18]
lea r8, [0x1401942a0]
mov rcx, qword [rcx + 0x10]
call fcn.140020d80
lea r8, str.BootMigrationPhase
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.14008fb90
test eax, eax
je 0x14014c8e1
mov rcx, qword [0x1401d6a10]
cmp rcx, rbx
je 0x14014c8e1
test byte [rcx + 0x1c], 1
je 0x14014c8e1
cmp byte [rcx + 0x19], 2
jb 0x14014c8e1
mov edx, 0x19
lea r8, [0x1401942a0]
mov rcx, qword [rcx + 0x10]
call fcn.140020d80
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14014c94b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Unregister_Optane_native_app:_Failed_to_open_session_manager_registry_key.
mov r8d, eax
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140023660
lea rdx, [rsp + 0x68]
mov rcx, r12
call fcn.140022e90
nop
lea rcx, [rsp + 0x68]
call fcn.140023190
mov rax, r12
jmp 0x14014cd88
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14014c990
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Unregister_Optane_native_app:_Failed_to_query_BootExecute_value_length.
jmp 0x14014c919
xorps xmm0, xmm0
mov eax, dword [rsp + 0x60]
mov ebx, eax
movdqu xmmword [rsp + 0x90], xmm0
mov r13, r15
mov qword [rsp + 0xa0], r15
test eax, eax
je 0x14014ca22
cmp rax, 0x1000
jb 0x14014c9e5
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14014cdb5
lfence
call fcn.140146a90
test rax, rax
je 0x14014cdc6
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14014c9f3
lfence
mov rcx, rbx
call fcn.140146a90
mov rdi, rax
mov qword [rsp + 0x90], rdi
lea r13, [rdi + rbx]
mov qword [rsp + 0xa0], r13
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14013a3a0
mov qword [rsp + 0x98], r13
mov eax, dword [rsp + 0x60]
jmp 0x14014ca2a
mov rdi, qword [rsp + 0x90]
xorps xmm0, xmm0
mov esi, eax
movdqu xmmword [rsp + 0xa8], xmm0
mov rbx, r15
mov qword [rsp + 0xb8], rbx
test eax, eax
je 0x14014cac5
cmp rsi, 0x1000
jb 0x14014ca7c
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14014cdbb
lfence
call fcn.140146a90
test rax, rax
je 0x14014cdc0
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14014ca8a
lfence
mov rcx, rsi
call fcn.140146a90
mov r14, rax
mov qword [rsp + 0xa8], r14
lea rbx, [r14 + rsi]
mov qword [rsp + 0xb8], rbx
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.14013a3a0
mov qword [rsp + 0xb0], rbx
mov r13, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x90]
jmp 0x14014cacd
mov r14, qword [rsp + 0xa8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14014cbb8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.Unregister_Optane_native_app:_Failed_to_query_BootExecute_value.
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140023660
lea rdx, [rsp + 0x68]
mov rcx, r12
call fcn.140022e90
nop
test r14, r14
je 0x14014cb6d
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x14014cb61
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014cdc0
mov rdx, rbx
mov rcx, r14
call fcn.140146acc
nop
test rdi, rdi
je 0x14014cba6
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14014cb9a
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014cdc6
mov rdx, r13
mov rcx, rdi
call fcn.140146acc
nop
lea rcx, [rsp + 0x68]
call fcn.140023190
mov rax, r12
jmp 0x14014cd88
cmp byte [rdi], 0
je 0x14014cbf4
mov rsi, r15
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x14014cbeb
mov r12, r14
sub r12, rdi
movsx ecx, al
call fcn.1401511e4
mov byte [r12 + rbx], al
inc rsi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14014cbd1
inc rsi
cmp byte [rsi + rdi], 0
jne 0x14014cbc0
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0xc0], xmm0
mov eax, dword [0x1401946f8]
mov dword [rsp + 0xd0], eax
mov ebx, r15d
cmp byte [r14], r15b
je 0x14014cce2
mov qword [rsp + 0x30], r15
mov r12, r14
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rsp + 0x60]
sub edx, r15d
mov rcx, r12
call fcn.14012696c
mov rsi, rax
lea rdx, [rsp + 0xc0]
mov rcx, r12
call fcn.1401510e8
test rax, rax
jne 0x14014cc79
cmp r15d, ebx
je 0x14014cc75
lea ecx, [rsi + 1]
movsxd r8, ecx
mov rdx, qword [rsp + 0x30]
add rdx, rdi
movsxd rcx, ebx
add rcx, rdi
call fcn.140139cd0
inc ebx
add ebx, esi
inc r15d
add r15d, esi
movsxd rax, r15d
mov qword [rsp + 0x30], rax
lea r12, [rax + r14]
cmp byte [r12], 0
jne 0x14014cc30
cmp r15d, ebx
je 0x14014cce2
movsxd rax, ebx
mov byte [rax + rdi], 0
lea eax, [rbx + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14014cce2
lea r9, str.Unregister_Optane_native_app:_Failed_to_set_BootExecute_value.
mov r8d, eax
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140023660
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x14014cd2c
mov rdx, qword [rsp + 0xb8]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x14014cd23
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014cdc0
mov rcx, r14
call fcn.140146acc
nop
test rdi, rdi
je 0x14014cd61
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14014cd55
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014cdc6
mov rdx, r13
mov rcx, rdi
call fcn.140146acc
nop
mov rbx, qword [rsp + 0x40]
jmp 0x14014cd6d
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140022e90
nop
lea rcx, [rsp + 0x68]
call fcn.140023190
mov rax, rbx
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140146a70
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001f7f0
nop
call fcn.14001f7f0
call fcn.140117a1c
nop
call fcn.140117a1c
int3