Function at 0x140021380
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x1400bd700], 0
je 0x140021397
mov eax, 1
add rsp, 0x28
ret
mov rax, qword [0x1400bd708]
mov byte [0x1400bd700], 1
test rax, rax
jne 0x1400213be
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400bd708], rax
cmp qword [0x1400bd660], 0
jne 0x1400213f2
lea rdx, str.NtTerminateProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd660], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd668], 0
jne 0x140021426
lea rdx, str.NtReadVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd668], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd670], 0
jne 0x14002145a
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd670], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd678], 0
jne 0x14002148e
lea rdx, str.NtGetContextThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd678], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd680], 0
jne 0x1400214c2
lea rdx, str.NtSetContextThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd680], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd688], 0
jne 0x1400214f6
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd688], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd690], 0
jne 0x14002152a
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd690], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd698], 0
jne 0x14002155e
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd698], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6a8], 0
jne 0x140021592
lea rdx, str.NtQueryInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6a8], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6a0], 0
jne 0x1400215c6
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6a0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6b0], 0
jne 0x1400215fa
lea rdx, str.NtQueryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6b0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6b8], 0
jne 0x14002162e
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6b8], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6c0], 0
jne 0x140021662
lea rdx, str.NtQueryInformationFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6c0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6c8], 0
jne 0x140021696
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6c8], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6d0], 0
jne 0x1400216ca
lea rdx, str.NtSuspendProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6d0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6d8], 0
jne 0x1400216fe
lea rdx, str.NtResumeProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6d8], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd708]
cmp qword [0x1400bd6e0], 0
jne 0x14002172b
lea rdx, str.NtDuplicateObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6e0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd710]
test rax, rax
jne 0x14002174b
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1400bd710], rax
cmp qword [0x1400bd6e8], 0
jne 0x14002177f
lea rdx, str.InitializeProcThreadAttributeList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6e8], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd710]
cmp qword [0x1400bd6f0], 0
jne 0x1400217b3
lea rdx, str.UpdateProcThreadAttribute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6f0], rax
setne al
and byte [0x1400bd700], al
mov rax, qword [0x1400bd710]
cmp qword [0x1400bd6f8], 0
jne 0x1400217e0
lea rdx, str.DeleteProcThreadAttributeList
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1400bd6f8], rax
setne al
and byte [0x1400bd700], al
movzx eax, byte [0x1400bd700]
add rsp, 0x28
ret