Function at 0x1400013b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140021b28], 0
jne 0x1400013ef
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400013ef
xor ebx, ebx
mov esi, ebx
jmp 0x14000143b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001417
mov esi, ebx
jmp 0x14000143b
mov rcx, qword [0x140021b28]
lea r8, [0x140021a76]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140021b28], 0
jne 0x140001469
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x140001469
mov edi, ebx
jmp 0x1400014b3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000148f
mov edi, ebx
jmp 0x1400014b3
mov rcx, qword [0x140021b28]
lea r8, [0x140021a7c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140021b28], 0
jne 0x1400014e3
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400014e3
mov eax, ebx
jmp 0x14000152b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001509
mov eax, ebx
jmp 0x14000152b
mov rcx, qword [0x140021b28]
lea r8, [0x140021a82]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x14000155b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x14000155b
mov eax, ebx
jmp 0x1400015a3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001581
mov eax, ebx
jmp 0x1400015a3
mov rcx, qword [0x140021b28]
lea r8, [0x140021a88]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x1400015d3
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400015d3
mov eax, ebx
jmp 0x14000161b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015f9
mov eax, ebx
jmp 0x14000161b
mov rcx, qword [0x140021b28]
lea r8, [0x140021a8e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x14000164b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x14000164b
mov eax, ebx
jmp 0x140001693
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14001b770]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001671
mov eax, ebx
jmp 0x140001693
mov rcx, qword [0x140021b28]
lea r8, [0x140021a94]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x1400016c3
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400016c3
mov eax, ebx
jmp 0x14000170b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14001b780]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016e9
mov eax, ebx
jmp 0x14000170b
mov rcx, qword [0x140021b28]
lea r8, [0x140021a9a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x14000173b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x14000173b
mov eax, ebx
jmp 0x140001783
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001761
mov eax, ebx
jmp 0x140001783
mov rcx, qword [0x140021b28]
lea r8, [0x140021aac]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x1400017b3
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400017b3
mov eax, ebx
jmp 0x1400017fb
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017d9
mov eax, ebx
jmp 0x1400017fb
mov rcx, qword [0x140021b28]
lea r8, [0x140021ab2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x14000182b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x14000182b
mov eax, ebx
jmp 0x140001873
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001851
mov eax, ebx
jmp 0x140001873
mov rcx, qword [0x140021b28]
lea r8, [0x140021ab8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x1400018a3
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x1400018a3
mov eax, ebx
jmp 0x1400018eb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018c9
mov eax, ebx
jmp 0x1400018eb
mov rcx, qword [0x140021b28]
lea r8, [0x140021abe]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x14000191b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x14000191b
mov eax, ebx
jmp 0x140001963
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001941
mov eax, ebx
jmp 0x140001963
mov rcx, qword [0x140021b28]
lea r8, [0x140021ac4]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x140001993
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x140001993
mov eax, ebx
jmp 0x1400019db
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019b9
mov eax, ebx
jmp 0x1400019db
mov rcx, qword [0x140021b28]
lea r8, [0x140021aca]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x140001a0b
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x140001a0b
mov eax, ebx
jmp 0x140001a53
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a31
mov eax, ebx
jmp 0x140001a53
mov rcx, qword [0x140021b28]
lea r8, [0x140021ad0]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x140001a83
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x140001a83
mov eax, ebx
jmp 0x140001acb
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001aa9
mov eax, ebx
jmp 0x140001acb
mov rcx, qword [0x140021b28]
lea r8, [0x140021ad6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x140001afb
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
jne 0x140001afb
mov eax, ebx
jmp 0x140001b43
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b21
mov eax, ebx
jmp 0x140001b43
mov rcx, qword [0x140021b28]
lea r8, [0x140021adc]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140021b28], 0
jne 0x140001b6f
mov r8d, dword [0x140021b24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140021b28], rax
test rax, rax
je 0x140001bb5
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001bb5
mov rcx, qword [0x140021b28]
lea r8, [0x140021ae2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret