Function at 0x140001110
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x1400077e8], 0
jne 0x14000114f
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x14000114f
xor ebx, ebx
mov esi, ebx
jmp 0x1400011a5
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001177
mov esi, ebx
jmp 0x14000119b
mov rcx, qword [0x1400077e8]
lea r8, [0x140007736]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x1400077e8], 0
jne 0x1400011c9
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400011c9
mov edi, ebx
jmp 0x14000121a
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400011ef
mov edi, ebx
jmp 0x140001213
mov rcx, qword [0x1400077e8]
lea r8, [0x14000773c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
mov rax, qword [0x1400077e8]
and edi, esi
test rax, rax
jne 0x140001245
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001245
mov ecx, ebx
jmp 0x140001296
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000126b
mov ecx, ebx
jmp 0x14000128f
mov rcx, qword [0x1400077e8]
lea r8, [0x140007742]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x1400012c1
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400012c1
mov ecx, ebx
jmp 0x140001312
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400012e7
mov ecx, ebx
jmp 0x14000130b
mov rcx, qword [0x1400077e8]
lea r8, [0x140007748]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x14000133d
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x14000133d
mov ecx, ebx
jmp 0x14000138e
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001363
mov ecx, ebx
jmp 0x140001387
mov rcx, qword [0x1400077e8]
lea r8, [0x14000774e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x1400013b9
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400013b9
mov ecx, ebx
jmp 0x14000140a
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005530]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400013df
mov ecx, ebx
jmp 0x140001403
mov rcx, qword [0x1400077e8]
lea r8, [0x140007754]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001435
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001435
mov ecx, ebx
jmp 0x140001486
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005540]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000145b
mov ecx, ebx
jmp 0x14000147f
mov rcx, qword [0x1400077e8]
lea r8, [0x14000775a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x1400014b1
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400014b1
mov ecx, ebx
jmp 0x140001502
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400014d7
mov ecx, ebx
jmp 0x1400014fb
mov rcx, qword [0x1400077e8]
lea r8, [0x14000776c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x14000152d
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x14000152d
mov ecx, ebx
jmp 0x14000157e
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001553
mov ecx, ebx
jmp 0x140001577
mov rcx, qword [0x1400077e8]
lea r8, [0x140007772]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x1400015a9
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400015a9
mov ecx, ebx
jmp 0x1400015fa
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015cf
mov ecx, ebx
jmp 0x1400015f3
mov rcx, qword [0x1400077e8]
lea r8, [0x140007778]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001625
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001625
mov ecx, ebx
jmp 0x140001676
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000164b
mov ecx, ebx
jmp 0x14000166f
mov rcx, qword [0x1400077e8]
lea r8, [0x14000777e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x1400016a1
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x1400016a1
mov ecx, ebx
jmp 0x1400016f2
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016c7
mov ecx, ebx
jmp 0x1400016eb
mov rcx, qword [0x1400077e8]
lea r8, [0x140007784]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x14000171d
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x14000171d
mov ecx, ebx
jmp 0x14000176e
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001743
mov ecx, ebx
jmp 0x140001767
mov rcx, qword [0x1400077e8]
lea r8, [0x14000778a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001799
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001799
mov ecx, ebx
jmp 0x1400017ea
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017bf
mov ecx, ebx
jmp 0x1400017e3
mov rcx, qword [0x1400077e8]
lea r8, [0x140007790]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001815
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001815
mov ecx, ebx
jmp 0x140001866
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000183b
mov ecx, ebx
jmp 0x14000185f
mov rcx, qword [0x1400077e8]
lea r8, [0x140007796]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001891
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
jne 0x140001891
mov ecx, ebx
jmp 0x1400018e2
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018b7
mov ecx, ebx
jmp 0x1400018db
mov rcx, qword [0x1400077e8]
lea r8, [0x14000779c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, eax
mov rax, qword [0x1400077e8]
and edi, ecx
test rax, rax
jne 0x140001909
mov r8d, dword [0x1400077e4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400077e8], rax
test rax, rax
je 0x14000194f
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000194f
mov rcx, qword [0x1400077e8]
lea r8, [0x1400077a2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret