Function at 0x140001cd0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140416fc8], 0
jne 0x140001d0f
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001d0f
xor ebx, ebx
mov esi, ebx
jmp 0x140001d5b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001d37
mov esi, ebx
jmp 0x140001d5b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f16]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140416fc8], 0
jne 0x140001d89
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001d89
mov edi, ebx
jmp 0x140001dd3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005490]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001daf
mov edi, ebx
jmp 0x140001dd3
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f1c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140416fc8], 0
jne 0x140001e03
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001e03
mov eax, ebx
jmp 0x140001e4b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e29
mov eax, ebx
jmp 0x140001e4b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f22]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001e7b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001e7b
mov eax, ebx
jmp 0x140001ec3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ea1
mov eax, ebx
jmp 0x140001ec3
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f28]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001ef3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001ef3
mov eax, ebx
jmp 0x140001f3b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f19
mov eax, ebx
jmp 0x140001f3b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f2e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001f6b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001f6b
mov eax, ebx
jmp 0x140001fb3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f91
mov eax, ebx
jmp 0x140001fb3
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f34]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x140001fe3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x140001fe3
mov eax, ebx
jmp 0x14000202b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002009
mov eax, ebx
jmp 0x14000202b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f3a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000205b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x14000205b
mov eax, ebx
jmp 0x1400020a3
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002081
mov eax, ebx
jmp 0x1400020a3
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f4c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400020d3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400020d3
mov eax, ebx
jmp 0x14000211b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400020f9
mov eax, ebx
jmp 0x14000211b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f52]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000214b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x14000214b
mov eax, ebx
jmp 0x140002193
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005518]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002171
mov eax, ebx
jmp 0x140002193
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f58]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400021c3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400021c3
mov eax, ebx
jmp 0x14000220b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400021e9
mov eax, ebx
jmp 0x14000220b
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f5e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000223b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x14000223b
mov eax, ebx
jmp 0x140002283
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002261
mov eax, ebx
jmp 0x140002283
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f64]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400022b3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400022b3
mov eax, ebx
jmp 0x1400022fb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005548]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400022d9
mov eax, ebx
jmp 0x1400022fb
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f6a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000232b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x14000232b
mov eax, ebx
jmp 0x140002373
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400054a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002351
mov eax, ebx
jmp 0x140002373
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f70]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x1400023a3
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x1400023a3
mov eax, ebx
jmp 0x1400023eb
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400023c9
mov eax, ebx
jmp 0x1400023eb
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f76]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000241b
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
jne 0x14000241b
mov eax, ebx
jmp 0x140002463
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002441
mov eax, ebx
jmp 0x140002463
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f7c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140416fc8], 0
jne 0x14000248f
mov r8d, dword [0x140416fc4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140416fc8], rax
test rax, rax
je 0x1400024d5
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140005570]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400024d5
mov rcx, qword [0x140416fc8]
lea r8, [0x140416f82]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret