Function at 0x18006baf0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800ae4ec]
test ecx, ecx
jne 0x18006c608
mov eax, dword [0x1800ae4e8]
cmp eax, 3
ja 0x18006c608
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800ae4e8], eax
call fcn.18005ca70
test eax, eax
je 0x18006bb36
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18006bb43
lea rcx, [0x1800896b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18006bb55
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x180091198]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091188]
mov rcx, rbx
mov qword [0x1800ae138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091178]
mov rcx, rbx
mov qword [0x1800ae140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800ae148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091158]
mov rcx, rbx
mov qword [0x1800ae150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800ae158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800ae160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091128]
mov rcx, rbx
mov qword [0x1800ae168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800ae170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800ae178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800ae180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800ae188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800ae190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800ae198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetEndOfFile
mov rcx, rbx
mov qword [0x1800ae1a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800910a0]
mov rcx, rbx
mov qword [0x1800ae1a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091090]
mov rcx, rbx
mov qword [0x1800ae1b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800ae1b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091060]
mov rcx, rbx
mov qword [0x1800ae1c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091048]
mov rcx, rbx
mov qword [0x1800ae1c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800ae1d0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800896c8]
mov rcx, rbx
mov qword [0x1800ae1d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091030]
mov rcx, rbx
mov qword [0x1800ae1e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180091018]
mov rcx, rbx
mov qword [0x1800ae1e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ff8]
mov rcx, rbx
mov qword [0x1800ae1f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSize
mov rcx, rbx
mov qword [0x1800ae1f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800ae200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800ae208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800ae210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090fa8]
mov rcx, rbx
mov qword [0x1800ae218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800ae220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800ae228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800ae230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800ae238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800ae240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800ae248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800ae250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800ae258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090f18]
mov rcx, rbx
mov qword [0x1800ae260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090f08]
mov rcx, rbx
mov qword [0x1800ae268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ef8]
mov qword [0x1800ae270], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ee8]
mov rcx, rbx
mov qword [0x1800ae278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ed8]
mov rcx, rbx
mov qword [0x1800ae280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ec8]
mov rcx, rbx
mov qword [0x1800ae288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800ae290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800ae298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090e88]
mov rcx, rbx
mov qword [0x1800ae2a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090e78]
mov rcx, rbx
mov qword [0x1800ae2a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800ae2b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800ae2b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800ae2c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800ae2c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800ae2d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800ae2d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x1800ae2e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800ae2e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x1800ae2f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFile
mov rcx, rbx
mov qword [0x1800ae2f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800ae300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnmapViewOfFile
mov rcx, rbx
mov qword [0x1800ae308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800ae310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090d70]
mov rcx, rbx
mov qword [0x1800ae318], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090d58]
mov rcx, rbx
mov qword [0x1800ae320], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800ae328], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800ae330], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090d10]
mov rcx, rbx
mov qword [0x1800ae338], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090cf8]
mov rcx, rbx
mov qword [0x1800ae340], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090ce8]
mov rcx, rbx
mov qword [0x1800ae348], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090cd8]
mov rcx, rbx
mov qword [0x1800ae350], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800ae358], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800ae360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090c98]
mov rcx, rbx
mov qword [0x1800ae368], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090c88]
mov rcx, rbx
mov qword [0x1800ae370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090c78]
mov rcx, rbx
mov qword [0x1800ae378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800ae380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800ae388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800ae390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800ae398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x1800ae3a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x1800ae3a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800ae3b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800ae3b8], rax
lea rdx, [0x180090bd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090bb8]
mov rcx, rbx
mov qword [0x1800ae3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800ae3c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800ae3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800ae3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1800ae3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800ae3e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800ae3f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800ae3f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800ae400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800ae408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1800ae410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800ae418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1800ae420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800ae428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800ae430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800ae438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800ae440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800ae448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800ae450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800ae458], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800ae460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800ae468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800ae470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800ae478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800ae480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800ae488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800ae490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800ae498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800ae4a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090978]
mov rcx, rbx
mov qword [0x1800ae4a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180090968]
mov rcx, rbx
mov qword [0x1800ae4b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800ae4b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800ae4c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800ae4c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800ae4d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800ae4d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800ae4ec], 1
mov qword [0x1800ae4e0], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret