Function at 0x140001000
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
cmp qword [0x140416fc8], 0
jne 0x140001054
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001054
xor ebx, ebx
mov esi, ebx
jmp 0x1400010e0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x14000107f
mov esi, ebx
jmp 0x1400010e0
mov rcx, qword [0x140416fc8]
lea r8, [rbp - 9]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp - 9]
lea r8, [rbp + 0x27]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f16], eax
mov rdx, rdi
movzx eax, word [rbp - 5]
mov word [0x140416f1a], ax
mov eax, dword [rdi]
mov dword [rbp + 0x27], eax
movzx eax, word [rdi + 4]
mov word [rbp + 0x2b], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140416fc8], 0
jne 0x140001111
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001111
mov edi, ebx
jmp 0x14000119b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005490]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000113a
mov edi, ebx
jmp 0x14000119b
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f1c], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f20], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140416fc8], 0
jne 0x1400011ce
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400011ce
mov eax, ebx
jmp 0x140001256
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400011f7
mov eax, ebx
jmp 0x140001256
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f22], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f26], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001289
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001289
mov eax, ebx
jmp 0x140001311
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400012b2
mov eax, ebx
jmp 0x140001311
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f28], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f2c], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001344
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001344
mov eax, ebx
jmp 0x1400013cc
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14000136d
mov eax, ebx
jmp 0x1400013cc
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f2e], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f32], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400013ff
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400013ff
mov eax, ebx
jmp 0x140001487
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140001428
mov eax, ebx
jmp 0x140001487
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f34], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f38], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400014ba
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400014ba
mov esi, ebx
jmp 0x140001544
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400014e3
mov esi, ebx
jmp 0x140001544
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f3a], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f3e], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
and esi, edi
cmp qword [0x140416fc8], 0
jne 0x140001578
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001578
mov r14d, ebx
jmp 0x140001604
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400015a2
mov r14d, ebx
jmp 0x140001604
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f4c], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f50], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
and r14d, esi
cmp qword [0x140416fc8], 0
jne 0x140001638
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001638
mov edi, ebx
jmp 0x1400016c2
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140001661
mov edi, ebx
jmp 0x1400016c2
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f52], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f56], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, r14d
cmp qword [0x140416fc8], 0
jne 0x1400016f6
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400016f6
mov esi, ebx
jmp 0x140001780
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005518]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14000171f
mov esi, ebx
jmp 0x140001780
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f58], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f5c], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
and esi, edi
cmp qword [0x140416fc8], 0
jne 0x1400017b4
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400017b4
mov r14d, ebx
jmp 0x140001840
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400017de
mov r14d, ebx
jmp 0x140001840
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f5e], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f62], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
and r14d, esi
cmp qword [0x140416fc8], 0
jne 0x140001874
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001874
mov edi, ebx
jmp 0x1400018fe
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000189d
mov edi, ebx
jmp 0x1400018fe
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f64], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f68], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, r14d
cmp qword [0x140416fc8], 0
jne 0x140001932
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001932
mov esi, ebx
jmp 0x1400019bc
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005548]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14000195b
mov esi, ebx
jmp 0x1400019bc
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f6a], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f6e], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
and esi, edi
cmp qword [0x140416fc8], 0
jne 0x1400019ef
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400019ef
mov edi, ebx
jmp 0x140001a79
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140001a18
mov edi, ebx
jmp 0x140001a79
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f70], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f74], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140416fc8], 0
jne 0x140001aac
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001aac
mov esi, ebx
jmp 0x140001b36
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140001ad5
mov esi, ebx
jmp 0x140001b36
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f76], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f7a], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
and esi, edi
cmp qword [0x140416fc8], 0
jne 0x140001b69
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001b69
mov edi, ebx
jmp 0x140001bf3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140001b92
mov edi, ebx
jmp 0x140001bf3
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f7c], eax
mov rdx, rdi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f80], ax
mov eax, dword [rdi]
mov dword [rbp - 9], eax
movzx eax, word [rdi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140416fc8], 0
jne 0x140001c23
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
je 0x140001ca9
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005570]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140001ca9
mov rcx, qword [0x140416fc8]
lea r8, [rbp + 0x27]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0x27]
lea r8, [rbp - 9]
mov rcx, qword [0x140416fc8]
mov r9d, 6
mov dword [0x140416f82], eax
mov rdx, rsi
movzx eax, word [rbp + 0x2b]
mov word [0x140416f86], ax
mov eax, dword [rsi]
mov dword [rbp - 9], eax
movzx eax, word [rsi + 4]
mov word [rbp - 5], ax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
lea r11, [rsp + 0x90]
and ebx, edi
mov rsi, qword [r11 + 0x18]
and ebx, 1
mov rdi, qword [r11 + 0x20]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret