Function at 0x140001910
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140086018], 0
jne 0x14000194f
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x14000194f
xor ebx, ebx
mov esi, ebx
jmp 0x14000199b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001977
mov esi, ebx
jmp 0x14000199b
mov rcx, qword [0x140086018]
lea r8, [0x140085f66]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140086018], 0
jne 0x1400019c9
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x1400019c9
mov edi, ebx
jmp 0x140001a13
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019ef
mov edi, ebx
jmp 0x140001a13
mov rcx, qword [0x140086018]
lea r8, [0x140085f6c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140086018], 0
jne 0x140001a43
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001a43
mov eax, ebx
jmp 0x140001a8b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14007a1f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a69
mov eax, ebx
jmp 0x140001a8b
mov rcx, qword [0x140086018]
lea r8, [0x140085f72]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001abb
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001abb
mov eax, ebx
jmp 0x140001b03
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ae1
mov eax, ebx
jmp 0x140001b03
mov rcx, qword [0x140086018]
lea r8, [0x140085f78]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001b33
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001b33
mov eax, ebx
jmp 0x140001b7b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b59
mov eax, ebx
jmp 0x140001b7b
mov rcx, qword [0x140086018]
lea r8, [0x140085f7e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001bab
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001bab
mov eax, ebx
jmp 0x140001bf3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14007a228]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001bd1
mov eax, ebx
jmp 0x140001bf3
mov rcx, qword [0x140086018]
lea r8, [0x140085f84]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001c23
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001c23
mov eax, ebx
jmp 0x140001c6b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14007a238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c49
mov eax, ebx
jmp 0x140001c6b
mov rcx, qword [0x140086018]
lea r8, [0x140085f8a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001c9b
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001c9b
mov eax, ebx
jmp 0x140001ce3
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001cc1
mov eax, ebx
jmp 0x140001ce3
mov rcx, qword [0x140086018]
lea r8, [0x140085f9c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001d13
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001d13
mov eax, ebx
jmp 0x140001d5b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d39
mov eax, ebx
jmp 0x140001d5b
mov rcx, qword [0x140086018]
lea r8, [0x140085fa2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001d8b
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001d8b
mov eax, ebx
jmp 0x140001dd3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001db1
mov eax, ebx
jmp 0x140001dd3
mov rcx, qword [0x140086018]
lea r8, [0x140085fa8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001e03
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001e03
mov eax, ebx
jmp 0x140001e4b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e29
mov eax, ebx
jmp 0x140001e4b
mov rcx, qword [0x140086018]
lea r8, [0x140085fae]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001e7b
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001e7b
mov eax, ebx
jmp 0x140001ec3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ea1
mov eax, ebx
jmp 0x140001ec3
mov rcx, qword [0x140086018]
lea r8, [0x140085fb4]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001ef3
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001ef3
mov eax, ebx
jmp 0x140001f3b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f19
mov eax, ebx
jmp 0x140001f3b
mov rcx, qword [0x140086018]
lea r8, [0x140085fba]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001f6b
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001f6b
mov eax, ebx
jmp 0x140001fb3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14007a1f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f91
mov eax, ebx
jmp 0x140001fb3
mov rcx, qword [0x140086018]
lea r8, [0x140085fc0]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x140001fe3
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x140001fe3
mov eax, ebx
jmp 0x14000202b
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002009
mov eax, ebx
jmp 0x14000202b
mov rcx, qword [0x140086018]
lea r8, [0x140085fc6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x14000205b
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
jne 0x14000205b
mov eax, ebx
jmp 0x1400020a3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002081
mov eax, ebx
jmp 0x1400020a3
mov rcx, qword [0x140086018]
lea r8, [0x140085fcc]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140086018], 0
jne 0x1400020cf
mov r8d, dword [0x140086014]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140086018], rax
test rax, rax
je 0x140002115
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002115
mov rcx, qword [0x140086018]
lea r8, [0x140085fd2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret