Function at 0x1400243ed
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
mov qword [rsp + 0x50], rcx
mov esi, 8
mov ecx, 0x40
mov edx, 8
call fcn.1400078f7
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunHKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunHKCUSOFTWAREMicrosoftWindowsCurrentVersionRunHKCUSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunHKLMHKCUsrccoreutils_regeditmod.rs
mov qword [rax], rcx
mov r8d, 0x32
mov qword [rax + 8], r8
lea rcx, [0x1401162b2]
mov qword [rax + 0x10], rcx
mov ecx, 0x3e
mov qword [rax + 0x18], rcx
lea rdx, [0x1401162f0]
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], r8
lea rdx, [0x140116322]
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rcx
lea rcx, [rsp + 0x158]
mov qword [rcx], rsi
xorps xmm6, xmm6
movups xmmword [rcx + 8], xmm6
lea rcx, [rsp + 0x170]
mov qword [rcx], rsi
movups xmmword [rcx + 8], xmm6
lea rcx, [rsp + 0x188]
mov qword [rcx], rsi
movups xmmword [rcx + 8], xmm6
lea rcx, [rax + 0x40]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], 4
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rcx
lea r12, [rsp + 0xa8]
lea rax, [r12 + rsi]
mov qword [rsp + 0xe0], rax
lea rbx, [rsp + 0x30]
lea rax, [rbx + rsi]
mov qword [rsp + 0xd8], rax
lea r13, [rsp + 0x78]
lea rax, [rsp + 0x60]
add rsi, rax
mov qword [rsp + 0xd0], rsi
xor ecx, ecx
lea r15, [rsp + 0x148]
cmp rcx, 4
je 0x140024a86
mov rax, rcx
shl rax, 4
inc rcx
mov qword [rsp + 0xc8], rcx
shl rcx, 4
mov rdx, qword [rsp + 0xc0]
add rcx, rdx
mov qword [rsp + 0x128], rcx
mov rsi, qword [rdx + rax]
mov rdi, qword [rdx + rax + 8]
mov r9d, 4
mov rcx, rsi
mov rdx, rdi
lea r8, [0x140116360]
call fcn.1400b4f76
mov r14, 0xffffffff80000002
lea r9, [0x1401163a0]
test al, al
jne 0x14002459f
mov r9d, 4
mov rcx, rsi
mov rdx, rdi
lea r8, [0x140116364]
call fcn.1400b4f76
mov r14, 0xffffffff80000001
lea r9, [0x140116388]
test al, al
je 0x140024a61
mov r8d, 5
mov rcx, rsi
mov rdx, rdi
call fcn.140001f92
mov r9, rdx
lea rsi, [rsp + 0x138]
mov rcx, rsi
mov rdx, r14
mov r8, rax
call fcn.14000aaa8
cmp qword [rsp + 0x138], 0
je 0x1400245e1
mov rcx, rsi
call fcn.1400067ab
jmp 0x140024a61
lea rax, [rsp + 0x58]
mov qword [rsp + 0x200], rax
and dword [rsp + 0x208], 0
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x58], rax
mov al, 0xd
mov byte [rsp + 0x240], al
mov byte [rsp + 0x278], al
lea rsi, [rsp + 0x60]
lea rdi, [rsp + 0x1b8]
lea rcx, [rsp + 0x288]
lea rdx, [rsp + 0x200]
call fcn.1400013be
cmp byte [rsp + 0x2b8], 0xc
je 0x140024a4a
lea rax, [rsp + 0x2a0]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
mov rcx, rsi
lea rdx, [rsp + 0xf0]
call fcn.140004eba
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rbp, str._RUST_BACKTRACElibrary_std_srcenv.rsenvironment_variable_not_found
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, rsi
lea r9, [0x140141ac5]
call fcn.140007551
mov rdi, qword [rsp + 0x1b8]
mov r8, qword [rsp + 0x1c8]
lea rax, [0x1401435b0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
lea r9, [0x140141ac7]
call fcn.140007551
mov r14, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x1a0]
mov rdx, r14
lea r9, str.__srccoreutils_runasmod.rs
call fcn.140007551
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.140053c1b
mov rdx, qword [rsp + 0x1c0]
mov rcx, rdi
lea rdi, [rsp + 0x1b8]
call fcn.140053c1b
mov rdx, qword [rsp + 0x68]
mov rcx, rsi
call fcn.140053c1b
mov rdx, qword [rsp + 0x1a0]
mov rax, qword [rsp + 0x1b0]
add rax, rdx
mov qword [rsp + 0xa8], 8
mov rcx, qword [rsp + 0xe0]
movups xmmword [rcx], xmm6
mov qword [rsp + 0x30], 1
mov rcx, qword [rsp + 0xd8]
movups xmmword [rcx], xmm6
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0x148], rdx
mov qword [rsp + 0x150], rax
xor eax, eax
mov esi, eax
mov rcx, r15
call fcn.14000cf66
cmp eax, 0x20
je 0x140024795
cmp eax, 0x22
je 0x1400247d0
cmp eax, 0x110000
jne 0x14002479a
jmp 0x14002480c
test sil, sil
je 0x1400247a6
mov rcx, rbx
mov edx, eax
call fcn.140007b7a
jmp 0x14002477a
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x14002477a
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140033d40
mov rcx, r12
mov rdx, rdi
call fcn.1400076cb
and qword [rsp + 0x40], 0
jmp 0x14002477a
mov al, 1
test sil, sil
je 0x140024778
xor sil, 1
mov r8, qword [rsp + 0x40]
mov eax, esi
test r8, r8
je 0x140024778
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140033d40
mov rcx, r12
mov rdx, rdi
call fcn.1400076cb
and qword [rsp + 0x40], 0
mov eax, esi
jmp 0x140024778
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x140024821
mov rcx, r12
mov rdx, rbx
call fcn.1400076cb
mov rsi, qword [rsp + 0xb8]
test rsi, rsi
je 0x14002485d
lea rcx, [rsp + 0x60]
mov rdx, r12
lea r8, [0x1401163d0]
call fcn.140045257
mov rax, qword [rsp + 0xb8]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [r13], xmm0
jmp 0x14002487f
mov rax, qword [rsp + 0xd0]
movups xmmword [rax], xmm6
movups xmmword [r13 + 8], xmm6
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x78], 8
test rdi, rdi
jne 0x140024893
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
call fcn.140053c1b
test rsi, rsi
lea rdi, [rsp + 0x1b8]
jne 0x1400248a8
mov rcx, r12
call fcn.140006544
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rcx, r13
call fcn.140006544
cmp byte [rsp + 0x108], 2
lea rsi, [rsp + 0x60]
jne 0x140024908
mov rcx, rdi
mov rdx, rbp
mov r8, r12
call fcn.14001953d
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140007069
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, rbp
mov r8, r12
call fcn.140033d40
lea rcx, [rsp + 0x158]
mov rdx, rsi
call fcn.1400076cb
mov rcx, rbx
mov rdx, rbp
mov r8, r12
call fcn.1400ac550
mov r13, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, r13
call fcn.140098dd0
cmp dword [rsp + 0x60], 2
jne 0x140024973
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1b8], 2
mov rcx, rdi
call fcn.1400066ae
jmp 0x1400249ab
mov ecx, 9
lea rdi, [rsp + 0x1b8]
lea rsi, [rsp + 0x60]
rep movsq qword [rdi], qword [rsi]
lea rdi, [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b8]
mov rcx, rdi
call fcn.1400066ae
cmp rsi, 2
lea rsi, [rsp + 0x60]
jne 0x1400249c3
mov rcx, rsi
mov rdx, rbp
mov r8, r12
call fcn.140033d40
lea rcx, [rsp + 0x188]
jmp 0x1400249d9
mov rcx, rsi
mov rdx, rbp
mov r8, r12
call fcn.140033d40
lea rcx, [rsp + 0x170]
mov rdx, rsi
call fcn.1400076cb
lea r12, [rsp + 0xa8]
mov rdx, qword [rsp + 0x38]
mov rcx, r13
call fcn.140053c1b
mov rcx, rbp
mov rdx, r14
call fcn.140053c1b
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0xe8]
call fcn.140053c1b
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
call fcn.140053c1b
mov rcx, qword [rsp + 0x288]
mov rdx, qword [rsp + 0x290]
call fcn.140053c1b
lea r13, [rsp + 0x78]
jmp 0x140024620
lea rcx, [rsp + 0x200]
call fcn.140006775
mov rcx, qword [rsp + 0x58]
call fcn.1400d4a43
mov rcx, 0xffffffff80000001
call fcn.1400d4a43
mov rcx, 0xffffffff80000002
call fcn.1400d4a43
mov rcx, qword [rsp + 0xc8]
jmp 0x14002450b
lea rcx, [rsp + 0x118]
call fcn.1400cb02b
movups xmm0, xmmword [rsp + 0x158]
lea rsi, [rsp + 0x218]
movaps xmmword [rsi - 0x18], xmm0
mov rax, qword [rsp + 0x168]
mov qword [rsi - 8], rax
movups xmm0, xmmword [rsp + 0x170]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x180]
mov qword [rsi + 0x10], rax
lea rdi, [rsp + 0x230]
movups xmm0, xmmword [rsp + 0x188]
movaps xmmword [rdi], xmm0
mov rax, qword [rsp + 0x198]
mov qword [rdi + 0x10], rax
lea r14, [rsp + 0x248]
xorps xmm6, xmm6
movaps xmmword [r14 + 8], xmm6
movups xmmword [r14 + 0x20], xmm6
mov r12d, 1
mov qword [r14], r12
mov qword [r14 + 0x18], r12
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.14001939a
lea r8, [0x1401163b8]
lea r15, [rsp + 0x1b8]
mov rcx, r15
mov rdx, rbx
call fcn.140007039
mov qword [rbx], r12
movups xmmword [rbx + 8], xmm6
mov r12, qword [r15]
mov r8, qword [r15 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, r14
mov rdx, r12
call fcn.140012d44
loope case.0x1400d0732.52
invalid
mov ecx, 1
xor edx, edx
call fcn.140053c1b
mov rcx, qword [r14 - 0x30]
mov rdx, qword [r14 - 0x20]
mov rbx, qword [r14]
mov r9, qword [r14 + 0x10]
mov r8, rbx
call fcn.140006f3a
mov ebp, eax
mov rdx, qword [r15 + 8]
mov rcx, r12
call fcn.140053c1b
test bpl, bpl
je 0x140024b91
mov rax, qword [rsp + 0x50]
mov byte [rax + 9], 1
jmp 0x140024bc8
mov rdx, qword [rsp + 0x230]