Function at 0x140001330
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140005788], 0
jne 0x14000136f
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x14000136f
xor ebx, ebx
mov esi, ebx
jmp 0x1400013bb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001397
mov esi, ebx
jmp 0x1400013bb
mov rcx, qword [0x140005788]
lea r8, [0x1400056d6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140005788], 0
jne 0x1400013e9
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x1400013e9
mov edi, ebx
jmp 0x140001433
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000140f
mov edi, ebx
jmp 0x140001433
mov rcx, qword [0x140005788]
lea r8, [0x1400056dc]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140005788], 0
jne 0x140001463
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001463
mov eax, ebx
jmp 0x1400014ab
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001489
mov eax, ebx
jmp 0x1400014ab
mov rcx, qword [0x140005788]
lea r8, [0x1400056e2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x1400014db
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x1400014db
mov eax, ebx
jmp 0x140001523
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001501
mov eax, ebx
jmp 0x140001523
mov rcx, qword [0x140005788]
lea r8, [0x1400056e8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001553
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001553
mov eax, ebx
jmp 0x14000159b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001579
mov eax, ebx
jmp 0x14000159b
mov rcx, qword [0x140005788]
lea r8, [0x1400056ee]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x1400015cb
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x1400015cb
mov eax, ebx
jmp 0x140001613
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400033f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015f1
mov eax, ebx
jmp 0x140001613
mov rcx, qword [0x140005788]
lea r8, [0x1400056f4]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001643
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001643
mov eax, ebx
jmp 0x14000168b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140003408]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001669
mov eax, ebx
jmp 0x14000168b
mov rcx, qword [0x140005788]
lea r8, [0x1400056fa]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x1400016bb
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x1400016bb
mov eax, ebx
jmp 0x140001703
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016e1
mov eax, ebx
jmp 0x140001703
mov rcx, qword [0x140005788]
lea r8, [0x14000570c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001733
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001733
mov eax, ebx
jmp 0x14000177b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001759
mov eax, ebx
jmp 0x14000177b
mov rcx, qword [0x140005788]
lea r8, [0x140005712]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x1400017ab
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x1400017ab
mov eax, ebx
jmp 0x1400017f3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017d1
mov eax, ebx
jmp 0x1400017f3
mov rcx, qword [0x140005788]
lea r8, [0x140005718]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001823
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001823
mov eax, ebx
jmp 0x14000186b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001849
mov eax, ebx
jmp 0x14000186b
mov rcx, qword [0x140005788]
lea r8, [0x14000571e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x14000189b
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x14000189b
mov eax, ebx
jmp 0x1400018e3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018c1
mov eax, ebx
jmp 0x1400018e3
mov rcx, qword [0x140005788]
lea r8, [0x140005724]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001913
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001913
mov eax, ebx
jmp 0x14000195b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001939
mov eax, ebx
jmp 0x14000195b
mov rcx, qword [0x140005788]
lea r8, [0x14000572a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x14000198b
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x14000198b
mov eax, ebx
jmp 0x1400019d3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019b1
mov eax, ebx
jmp 0x1400019d3
mov rcx, qword [0x140005788]
lea r8, [0x140005730]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001a03
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001a03
mov eax, ebx
jmp 0x140001a4b
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a29
mov eax, ebx
jmp 0x140001a4b
mov rcx, qword [0x140005788]
lea r8, [0x140005736]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001a7b
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
jne 0x140001a7b
mov eax, ebx
jmp 0x140001ac3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001aa1
mov eax, ebx
jmp 0x140001ac3
mov rcx, qword [0x140005788]
lea r8, [0x14000573c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140005788], 0
jne 0x140001aef
mov r8d, dword [0x140005784]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140005788], rax
test rax, rax
je 0x140001b35
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001b35
mov rcx, qword [0x140005788]
lea r8, [0x140005742]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret