Function at 0x140001340
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140007818], 0
jne 0x14000137f
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x14000137f
xor ebx, ebx
mov esi, ebx
jmp 0x1400013cb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x1400013a7
mov esi, ebx
jmp 0x1400013cb
mov rcx, qword [0x140007818]
lea r8, [0x140007766]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140007818], 0
jne 0x1400013f9
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400013f9
mov edi, ebx
jmp 0x140001443
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000141f
mov edi, ebx
jmp 0x140001443
mov rcx, qword [0x140007818]
lea r8, [0x14000776c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140007818], 0
jne 0x140001473
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001473
mov eax, ebx
jmp 0x1400014bb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001499
mov eax, ebx
jmp 0x1400014bb
mov rcx, qword [0x140007818]
lea r8, [0x140007772]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x1400014eb
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400014eb
mov eax, ebx
jmp 0x140001533
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001511
mov eax, ebx
jmp 0x140001533
mov rcx, qword [0x140007818]
lea r8, [0x140007778]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001563
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001563
mov eax, ebx
jmp 0x1400015ab
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001589
mov eax, ebx
jmp 0x1400015ab
mov rcx, qword [0x140007818]
lea r8, [0x14000777e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x1400015db
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400015db
mov eax, ebx
jmp 0x140001623
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400044c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001601
mov eax, ebx
jmp 0x140001623
mov rcx, qword [0x140007818]
lea r8, [0x140007784]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001653
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001653
mov eax, ebx
jmp 0x14000169b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400044d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001679
mov eax, ebx
jmp 0x14000169b
mov rcx, qword [0x140007818]
lea r8, [0x14000778a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x1400016cb
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400016cb
mov eax, ebx
jmp 0x140001713
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016f1
mov eax, ebx
jmp 0x140001713
mov rcx, qword [0x140007818]
lea r8, [0x14000779c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001743
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001743
mov eax, ebx
jmp 0x14000178b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001769
mov eax, ebx
jmp 0x14000178b
mov rcx, qword [0x140007818]
lea r8, [0x1400077a2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x1400017bb
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400017bb
mov eax, ebx
jmp 0x140001803
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017e1
mov eax, ebx
jmp 0x140001803
mov rcx, qword [0x140007818]
lea r8, [0x1400077a8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001833
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001833
mov eax, ebx
jmp 0x14000187b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001859
mov eax, ebx
jmp 0x14000187b
mov rcx, qword [0x140007818]
lea r8, [0x1400077ae]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x1400018ab
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x1400018ab
mov eax, ebx
jmp 0x1400018f3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400018d1
mov eax, ebx
jmp 0x1400018f3
mov rcx, qword [0x140007818]
lea r8, [0x1400077b4]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001923
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001923
mov eax, ebx
jmp 0x14000196b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001949
mov eax, ebx
jmp 0x14000196b
mov rcx, qword [0x140007818]
lea r8, [0x1400077ba]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x14000199b
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x14000199b
mov eax, ebx
jmp 0x1400019e3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019c1
mov eax, ebx
jmp 0x1400019e3
mov rcx, qword [0x140007818]
lea r8, [0x1400077c0]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001a13
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001a13
mov eax, ebx
jmp 0x140001a5b
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a39
mov eax, ebx
jmp 0x140001a5b
mov rcx, qword [0x140007818]
lea r8, [0x1400077c6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001a8b
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
jne 0x140001a8b
mov eax, ebx
jmp 0x140001ad3
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ab1
mov eax, ebx
jmp 0x140001ad3
mov rcx, qword [0x140007818]
lea r8, [0x1400077cc]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140007818], 0
jne 0x140001aff
mov r8d, dword [0x140007814]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140007818], rax
test rax, rax
je 0x140001b45
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001b45
mov rcx, qword [0x140007818]
lea r8, [0x1400077d2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret