Function at 0x140001080
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x14001dad8], 0
jne 0x1400010bf
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400010bf
xor ebx, ebx
mov esi, ebx
jmp 0x140001115
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x1400010e7
mov esi, ebx
jmp 0x14000110b
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da26]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x14001dad8], 0
jne 0x140001139
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001139
mov edi, ebx
jmp 0x14000118f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000115f
mov edi, ebx
jmp 0x140001183
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da2c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x14001dad8], 0
jne 0x1400011b3
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400011b3
mov edi, ebx
jmp 0x140001207
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400011d9
mov eax, ebx
jmp 0x1400011fb
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da32]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x14000122b
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x14000122b
mov edi, ebx
jmp 0x14000127f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001251
mov eax, ebx
jmp 0x140001273
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da38]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x1400012a3
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400012a3
mov edi, ebx
jmp 0x1400012f7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400012c9
mov eax, ebx
jmp 0x1400012eb
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da3e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x14000131b
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x14000131b
mov edi, ebx
jmp 0x14000136f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140017700]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001341
mov eax, ebx
jmp 0x140001363
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da44]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x140001393
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001393
mov edi, ebx
jmp 0x1400013e7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAllocEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400013b9
mov eax, ebx
jmp 0x1400013db
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da4a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x14000140b
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x14000140b
mov edi, ebx
jmp 0x14000145f
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001431
mov eax, ebx
jmp 0x140001453
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da5c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x140001483
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001483
mov edi, ebx
jmp 0x1400014d7
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400014a9
mov eax, ebx
jmp 0x1400014cb
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da62]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x1400014fb
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400014fb
mov edi, ebx
jmp 0x14000154f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001521
mov eax, ebx
jmp 0x140001543
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da68]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x140001573
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001573
mov edi, ebx
jmp 0x1400015c7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001599
mov eax, ebx
jmp 0x1400015bb
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da6e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x1400015eb
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400015eb
mov edi, ebx
jmp 0x14000163f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001611
mov eax, ebx
jmp 0x140001633
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da74]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x140001663
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001663
mov edi, ebx
jmp 0x1400016b7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001689
mov eax, ebx
jmp 0x1400016ab
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da7a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x1400016db
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400016db
mov edi, ebx
jmp 0x14000172f
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001701
mov eax, ebx
jmp 0x140001723
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da80]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x140001753
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x140001753
mov edi, ebx
jmp 0x1400017a7
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001779
mov eax, ebx
jmp 0x14000179b
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da86]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x1400017cb
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
jne 0x1400017cb
mov edi, ebx
jmp 0x14000181f
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400017f1
mov eax, ebx
jmp 0x140001813
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da8c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x14001dad8], 0
jne 0x14000183f
mov r8d, dword [0x14001dad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14001dad8], rax
test rax, rax
je 0x140001885
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001885
mov rcx, qword [0x14001dad8]
lea r8, [0x14001da92]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret