Function at 0x140001340
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140009a08], 0
jne 0x14000137f
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x14000137f
xor ebx, ebx
mov esi, ebx
jmp 0x1400013cb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x1400013a7
mov esi, ebx
jmp 0x1400013cb
mov rcx, qword [0x140009a08]
lea r8, [0x140009956]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140009a08], 0
jne 0x1400013f9
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400013f9
mov edi, ebx
jmp 0x140001443
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000141f
mov edi, ebx
jmp 0x140001443
mov rcx, qword [0x140009a08]
lea r8, [0x14000995c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140009a08], 0
jne 0x140001473
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001473
mov eax, ebx
jmp 0x1400014bb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001499
mov eax, ebx
jmp 0x1400014bb
mov rcx, qword [0x140009a08]
lea r8, [0x140009962]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x1400014eb
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400014eb
mov eax, ebx
jmp 0x140001533
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001511
mov eax, ebx
jmp 0x140001533
mov rcx, qword [0x140009a08]
lea r8, [0x140009968]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001563
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001563
mov eax, ebx
jmp 0x1400015ab
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001589
mov eax, ebx
jmp 0x1400015ab
mov rcx, qword [0x140009a08]
lea r8, [0x14000996e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x1400015db
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400015db
mov eax, ebx
jmp 0x140001623
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400055b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001601
mov eax, ebx
jmp 0x140001623
mov rcx, qword [0x140009a08]
lea r8, [0x140009974]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001653
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001653
mov eax, ebx
jmp 0x14000169b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400055c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001679
mov eax, ebx
jmp 0x14000169b
mov rcx, qword [0x140009a08]
lea r8, [0x14000997a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x1400016cb
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400016cb
mov eax, ebx
jmp 0x140001713
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016f1
mov eax, ebx
jmp 0x140001713
mov rcx, qword [0x140009a08]
lea r8, [0x14000998c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001743
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001743
mov eax, ebx
jmp 0x14000178b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001769
mov eax, ebx
jmp 0x14000178b
mov rcx, qword [0x140009a08]
lea r8, [0x140009992]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x1400017bb
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400017bb
mov eax, ebx
jmp 0x140001803
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017e1
mov eax, ebx
jmp 0x140001803
mov rcx, qword [0x140009a08]
lea r8, [0x140009998]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001833
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001833
mov eax, ebx
jmp 0x14000187b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001859
mov eax, ebx
jmp 0x14000187b
mov rcx, qword [0x140009a08]
lea r8, [0x14000999e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x1400018ab
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x1400018ab
mov eax, ebx
jmp 0x1400018f3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018d1
mov eax, ebx
jmp 0x1400018f3
mov rcx, qword [0x140009a08]
lea r8, [0x1400099a4]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001923
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001923
mov eax, ebx
jmp 0x14000196b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001949
mov eax, ebx
jmp 0x14000196b
mov rcx, qword [0x140009a08]
lea r8, [0x1400099aa]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x14000199b
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x14000199b
mov eax, ebx
jmp 0x1400019e3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019c1
mov eax, ebx
jmp 0x1400019e3
mov rcx, qword [0x140009a08]
lea r8, [0x1400099b0]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001a13
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001a13
mov eax, ebx
jmp 0x140001a5b
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a39
mov eax, ebx
jmp 0x140001a5b
mov rcx, qword [0x140009a08]
lea r8, [0x1400099b6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001a8b
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
jne 0x140001a8b
mov eax, ebx
jmp 0x140001ad3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ab1
mov eax, ebx
jmp 0x140001ad3
mov rcx, qword [0x140009a08]
lea r8, [0x1400099bc]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140009a08], 0
jne 0x140001aff
mov r8d, dword [0x140009a04]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140009a08], rax
test rax, rax
je 0x140001b45
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001b45
mov rcx, qword [0x140009a08]
lea r8, [0x1400099c2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret