Function at 0x140001190
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140022ad8], 0
jne 0x1400011cf
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400011cf
xor ebx, ebx
mov esi, ebx
jmp 0x140001225
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x1400011f7
mov esi, ebx
jmp 0x14000121b
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a26]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140022ad8], 0
jne 0x140001249
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x140001249
mov edi, ebx
jmp 0x14000129f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000126f
mov edi, ebx
jmp 0x140001293
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a2c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140022ad8], 0
jne 0x1400012c3
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400012c3
mov edi, ebx
jmp 0x140001317
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400012e9
mov eax, ebx
jmp 0x14000130b
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a32]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x14000133b
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x14000133b
mov edi, ebx
jmp 0x14000138f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001361
mov eax, ebx
jmp 0x140001383
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a38]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x1400013b3
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400013b3
mov edi, ebx
jmp 0x140001407
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400013d9
mov eax, ebx
jmp 0x1400013fb
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a3e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x14000142b
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x14000142b
mov edi, ebx
jmp 0x14000147f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14001c730]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001451
mov eax, ebx
jmp 0x140001473
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a44]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x1400014a3
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400014a3
mov edi, ebx
jmp 0x1400014f7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14001c740]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400014c9
mov eax, ebx
jmp 0x1400014eb
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a4a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x14000151b
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x14000151b
mov edi, ebx
jmp 0x14000156f
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001541
mov eax, ebx
jmp 0x140001563
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a5c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x140001593
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x140001593
mov edi, ebx
jmp 0x1400015e7
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015b9
mov eax, ebx
jmp 0x1400015db
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a62]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x14000160b
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x14000160b
mov edi, ebx
jmp 0x14000165f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001631
mov eax, ebx
jmp 0x140001653
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a68]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x140001683
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x140001683
mov edi, ebx
jmp 0x1400016d7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016a9
mov eax, ebx
jmp 0x1400016cb
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a6e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x1400016fb
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400016fb
mov edi, ebx
jmp 0x14000174f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001721
mov eax, ebx
jmp 0x140001743
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a74]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x140001773
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x140001773
mov edi, ebx
jmp 0x1400017c7
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001799
mov eax, ebx
jmp 0x1400017bb
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a7a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x1400017eb
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400017eb
mov edi, ebx
jmp 0x14000183f
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001811
mov eax, ebx
jmp 0x140001833
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a80]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x140001863
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x140001863
mov edi, ebx
jmp 0x1400018b7
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001889
mov eax, ebx
jmp 0x1400018ab
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a86]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x1400018db
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
jne 0x1400018db
mov edi, ebx
jmp 0x14000192f
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001901
mov eax, ebx
jmp 0x140001923
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a8c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140022ad8], 0
jne 0x14000194f
mov r8d, dword [0x140022ad4]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140022ad8], rax
test rax, rax
je 0x140001995
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001995
mov rcx, qword [0x140022ad8]
lea r8, [0x140022a92]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret