Function at 0x180029c90
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800da114]
test ecx, ecx
jne 0x18002a7a8
mov eax, dword [0x1800da110]
cmp eax, 3
ja 0x18002a7a8
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800da110], eax
call fcn.180048930
test eax, eax
je 0x180029cd6
lea rcx, [0x18009b0f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180029ce3
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180029cf5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1800832f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800832e0]
mov rcx, rbx
mov qword [0x1800d9d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800832d0]
mov rcx, rbx
mov qword [0x1800d9d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800d9d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800832b0]
mov rcx, rbx
mov qword [0x1800d9d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800d9d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800d9d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083280]
mov rcx, rbx
mov qword [0x1800d9d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800d9d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800d9da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800d9da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800d9db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800d9db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800d9dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083210]
mov rcx, rbx
mov qword [0x1800d9dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800831f8]
mov rcx, rbx
mov qword [0x1800d9dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800831e8]
mov rcx, rbx
mov qword [0x1800d9dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800d9de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesA
mov rcx, rbx
mov qword [0x1800d9de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800831a0]
mov rcx, rbx
mov qword [0x1800d9df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800d9df8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x1800d9e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x1800d9e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083170]
mov rcx, rbx
mov qword [0x1800d9e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083150]
mov rcx, rbx
mov qword [0x1800d9e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083140]
mov rcx, rbx
mov qword [0x1800d9e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800d9e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800d9e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800d9e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083100]
mov rcx, rbx
mov qword [0x1800d9e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800d9e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800d9e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800d9e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800d9e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800d9e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800d9e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800d9e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800d9e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [0x1800d9e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083060]
mov rcx, rbx
mov qword [0x1800d9e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x1800d9e98], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083040]
mov rcx, rbx
mov qword [0x1800d9ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x1800d9ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180083020]
mov rcx, rbx
mov qword [0x1800d9eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800d9eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800d9ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x1800d9ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082fd0]
mov rcx, rbx
mov qword [0x1800d9ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800d9ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800d9ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800d9ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800d9ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800d9ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800d9f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082f50]
mov rcx, rbx
mov qword [0x1800d9f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800d9f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082f20]
mov rcx, rbx
mov qword [0x1800d9f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082f10]
mov rcx, rbx
mov qword [0x1800d9f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800d9f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082ef0]
mov rcx, rbx
mov qword [0x1800d9f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800d9f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x1800d9f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082eb0]
mov rcx, rbx
mov qword [0x1800d9f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800d9f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800d9f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x1800d9f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082e50]
mov rcx, rbx
mov qword [0x1800d9f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileA
mov rcx, rbx
mov qword [0x1800d9f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082e30]
mov rcx, rbx
mov qword [0x1800d9f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800d9f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800d9f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x1800d9f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082de0]
mov rcx, rbx
mov qword [0x1800d9f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082dd0]
mov rcx, rbx
mov qword [0x1800d9fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800d9fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800d9fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800d9fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800d9fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082d50]
mov rcx, rbx
mov qword [0x1800d9fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082d50]
mov rcx, rbx
mov qword [0x1800d9fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800d9fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d9fe0], rax
lea rdx, [0x180082d28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082d10]
mov rcx, rbx
mov qword [0x1800d9fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800d9ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800d9ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800da000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082cd0]
mov rcx, rbx
mov qword [0x1800da008], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800da010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800da018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800da020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800da028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800da030], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082c70]
mov rcx, rbx
mov qword [0x1800da038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800da040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082c50]
mov rcx, rbx
mov qword [0x1800da048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800da050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800da058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800da060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800da068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800da070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800da078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800da080], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800da088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800da090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800da098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800da0a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800da0a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800da0b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800da0b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800da0c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800da0c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082b00]
mov rcx, rbx
mov qword [0x1800da0d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180082af0]
mov rcx, rbx
mov qword [0x1800da0d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800da0e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800da0e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800da0f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800da0f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800da100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800da114], 1
mov qword [0x1800da108], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret