Function at 0x140001110
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140006798], 0
jne 0x14000114f
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000114f
xor ebx, ebx
mov esi, ebx
jmp 0x1400011a5
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
jne 0x140001177
mov esi, ebx
jmp 0x14000119b
mov rcx, qword [0x140006798]
lea r8, [0x1400066e6]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
cmp qword [0x140006798], 0
jne 0x1400011c9
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x1400011c9
mov edi, ebx
jmp 0x14000121f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400011ef
mov edi, ebx
jmp 0x140001213
mov rcx, qword [0x140006798]
lea r8, [0x1400066ec]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
and edi, esi
cmp qword [0x140006798], 0
jne 0x140001243
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x140001243
mov edi, ebx
jmp 0x140001297
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001269
mov eax, ebx
jmp 0x14000128b
mov rcx, qword [0x140006798]
lea r8, [0x1400066f2]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x1400012bb
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x1400012bb
mov edi, ebx
jmp 0x14000130f
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400012e1
mov eax, ebx
jmp 0x140001303
mov rcx, qword [0x140006798]
lea r8, [0x1400066f8]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x140001333
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x140001333
mov edi, ebx
jmp 0x140001387
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001359
mov eax, ebx
jmp 0x14000137b
mov rcx, qword [0x140006798]
lea r8, [0x1400066fe]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x1400013ab
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x1400013ab
mov edi, ebx
jmp 0x1400013ff
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140004460]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400013d1
mov eax, ebx
jmp 0x1400013f3
mov rcx, qword [0x140006798]
lea r8, [0x140006704]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x140001423
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x140001423
mov edi, ebx
jmp 0x140001477
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x140004470]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001449
mov eax, ebx
jmp 0x14000146b
mov rcx, qword [0x140006798]
lea r8, [0x14000670a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x14000149b
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000149b
mov edi, ebx
jmp 0x1400014ef
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LdrLoadDll
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400014c1
mov eax, ebx
jmp 0x1400014e3
mov rcx, qword [0x140006798]
lea r8, [0x14000671c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x140001513
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x140001513
mov edi, ebx
jmp 0x140001567
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001539
mov eax, ebx
jmp 0x14000155b
mov rcx, qword [0x140006798]
lea r8, [0x140006722]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x14000158b
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000158b
mov edi, ebx
jmp 0x1400015df
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400015b1
mov eax, ebx
jmp 0x1400015d3
mov rcx, qword [0x140006798]
lea r8, [0x140006728]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x140001603
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x140001603
mov edi, ebx
jmp 0x140001657
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001629
mov eax, ebx
jmp 0x14000164b
mov rcx, qword [0x140006798]
lea r8, [0x14000672e]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x14000167b
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000167b
mov edi, ebx
jmp 0x1400016cf
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400016a1
mov eax, ebx
jmp 0x1400016c3
mov rcx, qword [0x140006798]
lea r8, [0x140006734]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x1400016f3
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x1400016f3
mov edi, ebx
jmp 0x140001747
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.VirtualProtectEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001719
mov eax, ebx
jmp 0x14000173b
mov rcx, qword [0x140006798]
lea r8, [0x14000673a]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x14000176b
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000176b
mov edi, ebx
jmp 0x1400017bf
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.FreeLibrary
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001791
mov eax, ebx
jmp 0x1400017b3
mov rcx, qword [0x140006798]
lea r8, [0x140006740]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x1400017e3
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x1400017e3
mov edi, ebx
jmp 0x140001837
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001809
mov eax, ebx
jmp 0x14000182b
mov rcx, qword [0x140006798]
lea r8, [0x140006746]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x14000185b
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
jne 0x14000185b
mov edi, ebx
jmp 0x1400018af
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.LoadLibraryExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001881
mov eax, ebx
jmp 0x1400018a3
mov rcx, qword [0x140006798]
lea r8, [0x14000674c]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and edi, eax
cmp qword [0x140006798], 0
jne 0x1400018cf
mov r8d, dword [0x140006794]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140006798], rax
test rax, rax
je 0x140001915
lea rcx, str.KernelBase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.ResumeThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001915
mov rcx, qword [0x140006798]
lea r8, [0x140006752]
mov r9d, 6
mov qword [rsp + 0x20], rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
mov rsi, qword [rsp + 0x48]
and edi, ebx
mov rbx, qword [rsp + 0x40]
and edi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret