Function at 0x140035a60
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov byte [rsp + 0x20], 0
lea rcx, [0x14007b830]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x14007b828], 0
je 0x140035b6c
cmp qword [0x14007b818], 0
je 0x140035b6c
cmp qword [0x14007b820], 0
je 0x140035b6c
cmp qword [0x14007b808], 0
je 0x140035b6c
cmp qword [0x14007b810], 0
je 0x140035b6c
cmp qword [0x14007b800], 0
je 0x140035b6c
cmp qword [0x14007b7f8], 0
je 0x140035b6c
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b828]
mov qword [rax + 0x168], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b818]
mov qword [rax + 0x198], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b820]
mov qword [rax + 0x190], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b808]
mov qword [rax + 0x188], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b810]
mov qword [rax + 0x1a0], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b7f8]
mov qword [rax + 0x1a8], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14007b800]
mov qword [rax + 0x510], rcx
mov byte [rsp + 0x20], 1
jmp 0x140035d50
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x168], rcx
cmp qword [rsp + 0x28], 0
jne 0x140035b9e
xor al, al
jmp 0x140035d62
lea rdx, str.EnumProcessModules
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x198], rax
lea rdx, str.GetModuleFileNameExW
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x190], rax
lea rdx, str.GetModuleBaseNameW
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x188], rax
lea rdx, str.GetProcessMemoryInfo
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x1a0], rax
lea rdx, str.QueryWorkingSet
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x168]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x1a8], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x510], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x168]
mov qword [0x14007b828], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x198]
mov qword [0x14007b818], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x190]
mov qword [0x14007b820], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x188]
mov qword [0x14007b808], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x1a0]
mov qword [0x14007b810], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x1a8]
mov qword [0x14007b7f8], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x510]
mov qword [0x14007b800], rax
cmp qword [0x14007b828], 0
je 0x140035d50
cmp qword [0x14007b818], 0
je 0x140035d50
cmp qword [0x14007b820], 0
je 0x140035d50
cmp qword [0x14007b808], 0
je 0x140035d50
cmp qword [0x14007b810], 0
je 0x140035d50
cmp qword [0x14007b800], 0
je 0x140035d50
cmp qword [0x14007b7f8], 0
je 0x140035d50
mov byte [rsp + 0x20], 1
lea rcx, [0x14007b830]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret