Function at 0x1400014d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001507
mov esi, ebx
jmp 0x14000152b
mov rcx, qword [0x140005710]
lea r8, [0x140005726]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001551
mov edi, ebx
jmp 0x140001575
mov rcx, qword [0x140005710]
lea r8, [0x14000572c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
lea rcx, str.kernel32
and edi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000159d
mov eax, ebx
jmp 0x1400015bf
mov rcx, qword [0x140005710]
lea r8, [0x140005732]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015e7
mov eax, ebx
jmp 0x140001609
mov rcx, qword [0x140005710]
lea r8, [0x140005738]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400034a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001631
mov eax, ebx
jmp 0x140001653
mov rcx, qword [0x140005710]
lea r8, [0x14000573e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000167b
mov eax, ebx
jmp 0x14000169d
mov rcx, qword [0x140005710]
lea r8, [0x140005744]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400034c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016c5
mov eax, ebx
jmp 0x1400016e7
mov rcx, qword [0x140005710]
lea r8, [0x14000574a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.ntdll
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000170f
mov eax, ebx
jmp 0x140001731
mov rcx, qword [0x140005710]
lea r8, [0x14000575c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.ntdll
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001759
mov eax, ebx
jmp 0x14000177b
mov rcx, qword [0x140005710]
lea r8, [0x140005762]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017a3
mov eax, ebx
jmp 0x1400017c5
mov rcx, qword [0x140005710]
lea r8, [0x140005768]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017ed
mov eax, ebx
jmp 0x14000180f
mov rcx, qword [0x140005710]
lea r8, [0x14000576e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001837
mov eax, ebx
jmp 0x140001859
mov rcx, qword [0x140005710]
lea r8, [0x140005774]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001881
mov eax, ebx
jmp 0x1400018a3
mov rcx, qword [0x140005710]
lea r8, [0x14000577a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.KernelBase
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018cb
mov eax, ebx
jmp 0x1400018ed
mov rcx, qword [0x140005710]
lea r8, [0x140005780]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.KernelBase
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001915
mov eax, ebx
jmp 0x140001937
mov rcx, qword [0x140005710]
lea r8, [0x140005786]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.KernelBase
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000195f
mov eax, ebx
jmp 0x140001981
mov rcx, qword [0x140005710]
lea r8, [0x14000578c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.KernelBase
and edi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400019c9
mov rcx, qword [0x140005710]
lea r8, [0x140005792]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret