Function at 0x140002ddb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rdx
mov rdx, qword [rbp + 0x100]
lea rax, [rbp - 0x30]
mov r8, rdx
lea rdx, str.C:WindowsSystem32_s
mov rcx, rax
call fcn.140019d50
mov dword [rbp - 0x35], 0
mov byte [rbp - 0x31], 0
lea rcx, [rbp - 0x35]
mov rdx, qword [rbp + 0x108]
lea rax, [rbp - 0x30]
mov r9d, 5
mov r8, rcx
mov rcx, rax
call fcn.140002b00
test eax, eax
sete al
test al, al
je 0x140002e63
lea rax, str.____Failed_to_read_bytes_from_disk._n
mov rcx, rax
call fcn.140019cf0
mov eax, 0
jmp 0x1400031c8
mov rax, qword [rbp + 0x108]
mov rdx, rax
lea rax, str.___First_5_bytes_of__s:
mov rcx, rax
call fcn.140019cf0
mov dword [rbp + 0xec], 0
jmp 0x140002eb0
mov eax, dword [rbp + 0xec]
cdqe
movzx eax, byte [rbp + rax - 0x35]
movzx eax, al
mov edx, eax
lea rax, str._02X
mov rcx, rax
call fcn.140019cf0
add dword [rbp + 0xec], 1
cmp dword [rbp + 0xec], 4
jle 0x140002e88
lea rax, [0x140115585]
mov rcx, rax
call fcn.140019cf0
mov rax, qword [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xe0], rax
cmp qword [rbp + 0xe0], 0
jne 0x140002f0f
mov rax, qword [rbp + 0x100]
mov rdx, rax
lea rax, str.____Failed_to_load__s._n
mov rcx, rax
call fcn.140019cf0
mov eax, 0
jmp 0x1400031c8
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x140002f7a
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov r8, rdx
mov rdx, rax
lea rax, str.____Failed_to_get_address_of__s_in__s._n
mov rcx, rax
call fcn.140019cf0
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 0
jmp 0x1400031c8
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x108]
mov r8, rdx
mov rdx, rax
lea rax, str.___Obtained_function_address_for__s_in__s._n
mov rcx, rax
call fcn.140019cf0
lea rdx, [rbp - 0x3c]
mov rax, qword [rbp + 0xd8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x140003019
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r9d, edx
mov r8, rcx
mov rdx, rax
lea rax, str.____Failed_to_change_memory_protection_of__s__s._Error_Code:__lu_n
mov rcx, rax
call fcn.140019cf0
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 0
jmp 0x1400031c8
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r8, rdx
mov rdx, rax
lea rax, str.___Updated_memory_protection_of__s__s._n
mov rcx, rax
call fcn.140019cf0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea r8, [rbp - 0x35]
mov rax, qword [rbp + 0xd8]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 5
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x1400030ea
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r9d, edx
mov r8, rcx
mov rdx, rax
lea rax, str.____Failed_to_write_to__s__s._Error_Code:__lu_n
mov rcx, rax
call fcn.140019cf0
mov edx, dword [rbp - 0x3c]
lea rcx, [rbp - 0x3c]
mov rax, qword [rbp + 0xd8]
mov r9, rcx
mov r8d, edx
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 0
jmp 0x1400031c8
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r9, rcx
mov r8, rdx
mov rdx, rax
lea rax, str.___Successfully_wrote_to__s__s._Bytes_written:__llu_n
mov rcx, rax
call fcn.140019cf0
mov edx, dword [rbp - 0x3c]
lea rcx, [rbp - 0x4c]
mov rax, qword [rbp + 0xd8]
mov r9, rcx
mov r8d, edx
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x14000318d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r9d, edx
mov r8, rcx
mov rdx, rax
lea rax, str.____Failed_to_restore_memory_protection_of__s__s._Error_Code:__lu_n
mov rcx, rax
call fcn.140019cf0
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 0
jmp 0x1400031c8
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x100]
mov r8, rdx
mov rdx, rax
lea rax, str.___Restored_memory_protection_of__s__s._n
mov rcx, rax
call fcn.140019cf0
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov eax, 1
add rsp, 0x170
pop rbp
ret