Function at 0x1400018a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x14009e198], 0
jne 0x1400018df
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x1400018df
xor ebx, ebx
mov esi, ebx
jmp 0x14000192b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001907
mov esi, ebx
jmp 0x14000192b
mov rcx, qword [0x14009e198]
lea r8, [0x14009e0e6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x14009e198], 0
jne 0x140001959
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001959
mov edi, ebx
jmp 0x1400019a3
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000197f
mov edi, ebx
jmp 0x1400019a3
mov rcx, qword [0x14009e198]
lea r8, [0x14009e0ec]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x14009e198], 0
jne 0x1400019d3
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x1400019d3
mov eax, ebx
jmp 0x140001a1b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14008f298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400019f9
mov eax, ebx
jmp 0x140001a1b
mov rcx, qword [0x14009e198]
lea r8, [0x14009e0f2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001a4b
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001a4b
mov eax, ebx
jmp 0x140001a93
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001a71
mov eax, ebx
jmp 0x140001a93
mov rcx, qword [0x14009e198]
lea r8, [0x14009e0f8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001ac3
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001ac3
mov eax, ebx
jmp 0x140001b0b
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ae9
mov eax, ebx
jmp 0x140001b0b
mov rcx, qword [0x14009e198]
lea r8, [0x14009e0fe]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001b3b
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001b3b
mov eax, ebx
jmp 0x140001b83
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14008f2c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b61
mov eax, ebx
jmp 0x140001b83
mov rcx, qword [0x14009e198]
lea r8, [0x14009e104]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001bb3
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001bb3
mov eax, ebx
jmp 0x140001bfb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14008f2d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001bd9
mov eax, ebx
jmp 0x140001bfb
mov rcx, qword [0x14009e198]
lea r8, [0x14009e10a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001c2b
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001c2b
mov eax, ebx
jmp 0x140001c73
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c51
mov eax, ebx
jmp 0x140001c73
mov rcx, qword [0x14009e198]
lea r8, [0x14009e11c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001ca3
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001ca3
mov eax, ebx
jmp 0x140001ceb
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001cc9
mov eax, ebx
jmp 0x140001ceb
mov rcx, qword [0x14009e198]
lea r8, [0x14009e122]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001d1b
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001d1b
mov eax, ebx
jmp 0x140001d63
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14008f310]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d41
mov eax, ebx
jmp 0x140001d63
mov rcx, qword [0x14009e198]
lea r8, [0x14009e128]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001d93
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001d93
mov eax, ebx
jmp 0x140001ddb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001db9
mov eax, ebx
jmp 0x140001ddb
mov rcx, qword [0x14009e198]
lea r8, [0x14009e12e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001e0b
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001e0b
mov eax, ebx
jmp 0x140001e53
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e31
mov eax, ebx
jmp 0x140001e53
mov rcx, qword [0x14009e198]
lea r8, [0x14009e134]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001e83
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001e83
mov eax, ebx
jmp 0x140001ecb
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ea9
mov eax, ebx
jmp 0x140001ecb
mov rcx, qword [0x14009e198]
lea r8, [0x14009e13a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001efb
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001efb
mov eax, ebx
jmp 0x140001f43
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14008f298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f21
mov eax, ebx
jmp 0x140001f43
mov rcx, qword [0x14009e198]
lea r8, [0x14009e140]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001f73
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001f73
mov eax, ebx
jmp 0x140001fbb
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f99
mov eax, ebx
jmp 0x140001fbb
mov rcx, qword [0x14009e198]
lea r8, [0x14009e146]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x140001feb
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
jne 0x140001feb
mov eax, ebx
jmp 0x140002033
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140002011
mov eax, ebx
jmp 0x140002033
mov rcx, qword [0x14009e198]
lea r8, [0x14009e14c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14009e198], 0
jne 0x14000205f
mov r8d, dword [0x14009e194]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14009e198], rax
test rax, rax
je 0x1400020a5
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400020a5
mov rcx, qword [0x14009e198]
lea r8, [0x14009e152]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret