Function at 0x14014a740
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1401d2670]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x58], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x60]
call fcn.140021760
nop
lea rbx, [0x1401d2a10]
mov rcx, qword [0x1401d2a10]
cmp rcx, rbx
je 0x14014a7d7
test byte [rcx + 0x1c], 1
je 0x14014a7d7
cmp byte [rcx + 0x19], 4
jb 0x14014a7d7
lea edx, [r12 + 0x18]
lea r8, [0x140192160]
mov rcx, qword [rcx + 0x10]
call fcn.14001f730
lea r8, str.BootMigrationPhase
lea rdx, str.systemcurrentControlSetServicesiaStorAfsService
mov rcx, 0xffffffff80000002
call fcn.14008e750
test eax, eax
je 0x14014a822
mov rcx, qword [0x1401d2a10]
cmp rcx, rbx
je 0x14014a822
test byte [rcx + 0x1c], 1
je 0x14014a822
cmp byte [rcx + 0x19], 2
jb 0x14014a822
mov edx, 0x19
lea r8, [0x140192160]
mov rcx, qword [rcx + 0x10]
call fcn.14001f730
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x2011b
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14014a88c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Unregister_Optane_native_app:_Failed_to_open_session_manager_registry_key.
mov r8d, eax
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140021fb0
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400217e0
nop
lea rcx, [rsp + 0x60]
call fcn.140021ae0
mov rax, r15
jmp 0x14014acc7
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14014a8d1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Unregister_Optane_native_app:_Failed_to_query_BootExecute_value_length.
jmp 0x14014a85a
xorps xmm0, xmm0
mov eax, dword [rsp + 0x58]
mov ebx, eax
movdqu xmmword [rsp + 0x88], xmm0
mov r13, r12
mov qword [rsp + 0x98], r12
test eax, eax
je 0x14014a963
cmp rax, 0x1000
jb 0x14014a926
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14014acf4
lfence
call fcn.1401449d4
test rax, rax
je 0x14014ad05
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14014a934
lfence
mov rcx, rbx
call fcn.1401449d4
mov rdi, rax
mov qword [rsp + 0x88], rdi
lea r13, [rdi + rbx]
mov qword [rsp + 0x98], r13
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1401386b0
mov qword [rsp + 0x90], r13
mov eax, dword [rsp + 0x58]
jmp 0x14014a96b
mov rdi, qword [rsp + 0x88]
xorps xmm0, xmm0
mov esi, eax
movdqu xmmword [rsp + 0xa0], xmm0
mov rbx, r12
mov qword [rsp + 0xb0], rbx
test eax, eax
je 0x14014aa06
cmp rsi, 0x1000
jb 0x14014a9bd
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14014acfa
lfence
call fcn.1401449d4
test rax, rax
je 0x14014acff
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14014a9cb
lfence
mov rcx, rsi
call fcn.1401449d4
mov r14, rax
mov qword [rsp + 0xa0], r14
lea rbx, [r14 + rsi]
mov qword [rsp + 0xb0], rbx
mov r8, rsi
xor edx, edx
mov rcx, r14
call fcn.1401386b0
mov qword [rsp + 0xa8], rbx
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x88]
jmp 0x14014aa0e
mov r14, qword [rsp + 0xa0]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14014aaf9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.Unregister_Optane_native_app:_Failed_to_query_BootExecute_value.
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140021fb0
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400217e0
nop
test r14, r14
je 0x14014aaae
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x14014aaa2
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014acff
mov rdx, rbx
mov rcx, r14
call fcn.140144a10
nop
test rdi, rdi
je 0x14014aae7
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14014aadb
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014ad05
mov rdx, r13
mov rcx, rdi
call fcn.140144a10
nop
lea rcx, [rsp + 0x60]
call fcn.140021ae0
mov rax, r15
jmp 0x14014acc7
cmp byte [rdi], 0
je 0x14014ab35
mov rsi, r12
lea rbx, [rsi + rdi]
movzx eax, byte [rbx]
test al, al
je 0x14014ab2c
mov r15, r14
sub r15, rdi
movsx ecx, al
call fcn.14014ef9c
mov byte [r15 + rbx], al
inc rsi
lea rbx, [rbx + 1]
movzx eax, byte [rbx]
test al, al
jne 0x14014ab12
inc rsi
cmp byte [rsi + rdi], 0
jne 0x14014ab01
movups xmm0, xmmword [str.iastorafsnative.exe]
movups xmmword [rsp + 0xb8], xmm0
mov eax, dword [0x1401925b8]
mov dword [rsp + 0xc8], eax
mov ebx, r12d
cmp byte [r14], r12b
je 0x14014ac21
mov qword [rsp + 0x30], r12
mov r15, r14
nop word [rax + rax]
mov edx, dword [rsp + 0x58]
sub edx, r12d
mov rcx, r15
call fcn.140124c40
mov rsi, rax
lea rdx, [rsp + 0xb8]
mov rcx, r15
call fcn.14014ee98
test rax, rax
jne 0x14014abb9
cmp r12d, ebx
je 0x14014abb5
lea ecx, [rsi + 1]
movsxd r8, ecx
mov rdx, qword [rsp + 0x30]
add rdx, rdi
movsxd rcx, ebx
add rcx, rdi
call fcn.140137fe0
inc ebx
add ebx, esi
inc r12d
add r12d, esi
movsxd rax, r12d
mov qword [rsp + 0x30], rax
lea r15, [rax + r14]
cmp byte [r15], 0
jne 0x14014ab70
cmp r12d, ebx
je 0x14014ac21
movsxd rax, ebx
mov byte [rax + rdi], 0
lea eax, [rbx + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, str.BootExecute
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14014ac21
lea r9, str.Unregister_Optane_native_app:_Failed_to_set_BootExecute_value.
mov r8d, eax
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140021fb0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x14014ac6b
mov rdx, qword [rsp + 0xb0]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x14014ac62
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014acff
mov rcx, r14
call fcn.140144a10
nop
test rdi, rdi
je 0x14014aca0
sub r13, rdi
mov rax, rdi
cmp r13, 0x1000
jb 0x14014ac94
add r13, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014ad05
mov rdx, r13
mov rcx, rdi
call fcn.140144a10
nop
mov rbx, qword [rsp + 0x38]
jmp 0x14014acac
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400217e0
nop
lea rcx, [rsp + 0x60]
call fcn.140021ae0
mov rax, rbx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401449b0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14001ee20
nop
call fcn.14001ee20
call fcn.140115ca0
nop
call fcn.140115ca0
int3