Function at 0x14000161c
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
xor r10d, r10d
mov eax, edx
mov qword [rsp + 0x78], r10
mov rsi, rcx
mov rbx, rdx
mov qword [rsp + 0x88], rax
mov rax, qword [0x140038260]
lea rdi, [rsp + 0x78]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x80], r10
test rax, rax
jne 0x1400016ab
mov rcx, qword [0x140038058]
mov qword [rsp + 0x68], r9
lea rdx, str.NtAllocateVirtualMemory
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rcx, rcx
jne 0x14000169d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtAllocateVirtualMemory
mov qword [0x140038058], rax
mov rcx, rax
call rbp
mov r9, qword [rsp + 0x68]
mov qword [0x140038260], rax
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov rdx, rdi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
call rax
test eax, eax
jne 0x1400018b6
mov rcx, rbx
mov rdi, qword [rsp + 0x78]
lea rbx, [rsp + 0x80]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x140038280]
test rax, rax
jne 0x14000172e
mov rcx, qword [0x140038058]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThreadEx
test rcx, rcx
jne 0x140001725
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtCreateThreadEx
mov qword [0x140038058], rax
mov rcx, rax
call rsi
mov qword [0x140038280], rax
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x28], r9
or r9, 0xffffffffffffffff
mov qword [rsp + 0x20], rdx
mov edx, 0x1fffff
call rax
test eax, eax
jne 0x1400018b6
mov rax, qword [0x1400382d8]
test rax, rax
jne 0x1400017c4
mov rcx, qword [0x140038058]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueueApcThread
test rcx, rcx
jne 0x1400017bb
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueueApcThread
mov qword [0x140038058], rax
mov rcx, rax
call rbx
mov qword [0x1400382d8], rax
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x78]
call rax
test eax, eax
jne 0x1400018b6
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000185e
mov rax, qword [0x140038320]
test rax, rax
jne 0x140001854
mov rcx, qword [0x140038058]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWaitForSingleObject
test rcx, rcx
jne 0x140001839
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtWaitForSingleObject
mov qword [0x140038058], rax
mov rcx, rax
call rbx
mov rcx, qword [rsp + 0x80]
xor r8d, r8d
mov edx, 1
mov qword [0x140038320], rax
jmp 0x14000185c
xor r8d, r8d
mov edx, 1
call rax
mov rax, qword [0x140038268]
test rax, rax
jne 0x1400018ab
mov rcx, qword [0x140038058]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
test rcx, rcx
jne 0x1400018a2
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtClose
mov qword [0x140038058], rax
mov rcx, rax
call rbx
mov qword [0x140038268], rax
mov rcx, qword [rsp + 0x80]
call rax
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret