Function at 0x1400a84b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McModulePathFromCLSIDW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x10], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McModulePathFromCLSIDA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x18], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McLoadLibraryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x20], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McLoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateProcessW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x30], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x38], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateProcess2W
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x40], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateProcess2A
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x48], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McIsNTAdmin
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x50], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDoesFileExistW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x58], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDoesFileExistA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x60], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetProgramFilesPathW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x68], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetProgramFilesPathA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x70], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McRegDeleteKeyW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x78], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McRegDeleteKeyA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x80], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDeleteFilesDeferedW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x88], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDeleteFilesDeferedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x90], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDeleteDirectoryDeferedW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x98], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDeleteDirectoryDeferedA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xa0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCopyFilesW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xa8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCopyFilesA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xb0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateDirWithPermissions
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xb8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetApplicationDataDirectory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xc0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetOSVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xc8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetOSVersion2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xd0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetMSCVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xe8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McShellExecute
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xf0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.IsPPInstalled
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0xf8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McCreateTask
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x100], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDeleteTask
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x108], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McEnableTask
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x110], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McDisableTask
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x118], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McIsFullScreen
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x120], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McIsMetroMode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x128], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McBeginFSMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x130], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McEndFSMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x138], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McBeginMetroMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x140], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McEndMetroMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x148], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.LaunchUIHost
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x150], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.IsUIHostRunning
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x158], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetHardwareID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x160], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetWindowsID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x168], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McGetMachineID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x170], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McBeginBMMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x178], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McEndBMMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x180], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McIsIdleMode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x188], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McIsIdleMode2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x190], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McBeginCSMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x198], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.McEndCSMonitor
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x1a0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.IsCSModeOn
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x1a8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.IsCSModeOn2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x1b0], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.GetPlatformType
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x1b8], rax
test rcx, rcx
je 0x1400a8b54
lea rdx, str.GetCPUVendorID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c0], rax
mov al, 1
add rsp, 0x20
pop rbx
ret