Function at 0x140001000
Capabilities:
Link many functions at runtime
Write file on windows

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0xf8
rep stosb byte [rdi], al
lea rcx, [0x140003260]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x140003250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x50], rax
lea rcx, [0x140003280]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.LocalAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x58], rax
lea rcx, [0x1400032a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x140003290]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x60], rax
lea rcx, [0x1400032c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CreateThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x68], rax
lea rcx, [0x1400032e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x1400032d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x70], rax
lea rcx, [0x140003308]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x1400032f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x78], rax
lea rcx, [0x140003328]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x80], rax
lea rcx, [0x140003350]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtWaitForSingleObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x88], rax
lea rcx, [0x140003378]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x90], rax
lea rcx, [0x1400033a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x140003388]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x98], rax
lea rcx, [0x1400033c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.WaitForSingleObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xa0], rax
lea rcx, [0x1400033e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.VirtualQuery
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xa8], rax
lea rcx, [0x140003408]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xb0], rax
lea rcx, [0x140003430]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtUserBuildHwndList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xb8], rax
lea rcx, [0x140003458]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CreateFileMappingA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xc0], rax
lea rcx, [0x140003478]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.MapViewOfFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xc8], rax
lea rcx, [0x140003498]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x140003488]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xd0], rax
lea rcx, [0x1400034b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xd8], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xe0], rax
lea rcx, [0x140003508]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x1400034f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xe8], rax
lea rcx, [0x140003530]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [0x140003518]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xf0], rax
lea rcx, [0x140003548]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.Sleep
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0xf8], rax
lea rcx, [0x140003570]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.WaitForSingleObjectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x100], rax
lea rcx, [0x140003598]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.ZwAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x108], rax
lea rcx, [0x1400035c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.ZwQueryVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x110], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtMapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x130], rax
lea rcx, str.KERNELBASE.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x120], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x118], rax
lea rcx, [0x140003628]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.mouse_event
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x128], rax
lea rcx, [0x140003658]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.GetKeyboardState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x138], rax
lea rcx, str.USER32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.GetKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
imul rax, rax, 3
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
lea rcx, str.dr.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x14000154b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001583
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x150]
mov r8d, 0xf8
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001581
xor eax, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140001630
add rsp, 0x160
pop rdi
ret