Function at 0x140001ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
mov r12, rcx
mov rcx, r9
mov qword [rbp + 0x260], r8
mov r13, rdx
mov r14, r9
call sub.msvcrt.dll_strlen
mov r15d, eax
mov ebx, eax
and r15d, 1
jne 0x140001e30
mov edx, eax
shr edx, 1
mov dword [rbp - 0x28], edx
test eax, eax
je 0x140001c20
mov rdi, rbp
lea rsi, str._2hhx
nop word [rax + rax]
mov eax, r15d
mov ecx, r15d
mov rdx, rsi
add r15d, 2
shr eax, 1
add rcx, r14
lea r8, [rdi + rax]
call fcn.140001670
cmp r15d, ebx
jb 0x140001c00
mov rcx, qword [rbp + 0x270]
call sub.msvcrt.dll_strlen
mov r14d, eax
mov ebx, eax
and r14d, 1
jne 0x140001e18
mov edx, eax
shr edx, 1
mov dword [rbp - 0x28], edx
test eax, eax
je 0x140001c80
mov r15, qword [rbp + 0x270]
lea rsi, str._2hhx
lea rdi, [rbp + 0x100]
nop dword [rax + rax]
mov eax, r14d
mov ecx, r14d
mov rdx, rsi
add r14d, 2
shr eax, 1
add rcx, r15
lea r8, [rdi + rax]
call fcn.140001670
cmp r14d, ebx
jb 0x140001c60
lea rax, [rbp - 0x18]
mov r9d, 0x40
mov rdx, r13
mov rcx, r12
mov dword [rbp - 0x14], 0x40
mov r14, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], rax
mov r8, qword [rbp + 0x260]
call r14
test eax, eax
je 0x140001e00
mov r15d, dword [rbp - 0x28]
lea rcx, str.byte_size:__d_n
mov edx, r15d
call fcn.140001620
mov rdx, qword [rbp + 0x260]
lea rcx, str.region_size:__lld_n
call fcn.140001620
cmp r15, qword [rbp + 0x260]
jae 0x140001e48
lea rax, [r15 + 0xf]
xor r10d, r10d
lea rbx, [rbp - 0x10]
mov qword [rbp - 0x48], r14
shr rax, 4
mov dword [rbp - 0x34], r10d
mov rsi, r13
mov r14, rbx
shl rax, 4
mov qword [rbp - 0x30], rbp
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x100]
mov qword [rbp - 0x40], rax
jmp 0x140001d39
mov rax, r15
add rsi, 1
mov rsp, rbx
sub rax, r13
add rax, rsi
cmp rax, qword [rbp + 0x260]
jae 0x140001da0
mov rax, qword [rbp - 0x28]
mov rbx, rsp
call fcn.140002ec0
sub rsp, rax
mov rdx, rsi
mov rcx, r12
mov r9, r15
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp - 0x30]
mov r8, r15
mov rcx, rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140001d20
lea rax, [rbp - 8]
mov r9, r15
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r8, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp qword [rbp - 8], 0
je 0x140001de8
add dword [rbp - 0x34], 1
jmp 0x140001d20
mov r10d, dword [rbp - 0x34]
mov r14, qword [rbp - 0x48]
lea rax, [rbp - 0x14]
mov dword [rbp - 0x28], r10d
mov r9d, dword [rbp - 0x18]
mov rdx, r13
mov qword [rsp + 0x20], rax
mov rcx, r12
mov r8, qword [rbp + 0x260]
call r14
mov r10d, dword [rbp - 0x28]
mov eax, r10d
lea rsp, [rbp + 0x208]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.Error:_Cannot_overwrite
call fcn.140001620
jmp 0x140001d9a
lea rcx, str.Unable_to_change_the_memory_protection_n
mov dword [rbp - 0x28], eax
call fcn.140001620
mov r10d, dword [rbp - 0x28]
jmp 0x140001dcd
lea rcx, str.Invalid_hex_string_n
call fcn.140001620
jmp 0x140001c80
lea rcx, str.Invalid_hex_string_n
call fcn.140001620
jmp 0x140001c20
xor r10d, r10d
jmp 0x140001da8