Function at 0x18014e4e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18023cdf4]
test ecx, ecx
jne 0x18014eff8
mov eax, dword [0x18023cdf0]
cmp eax, 3
ja 0x18014eff8
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x18023cdf0], eax
call fcn.180127c90
test eax, eax
je 0x18014e526
lea rcx, [0x1801a74f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18014e533
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18014e545
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1801d74a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7498]
mov rcx, rbx
mov qword [0x18023ca40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7488]
mov rcx, rbx
mov qword [0x18023ca48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x18023ca50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7468]
mov rcx, rbx
mov qword [0x18023ca58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x18023ca60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x18023ca68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7438]
mov rcx, rbx
mov qword [0x18023ca70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x18023ca78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x18023ca80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x18023ca88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x18023ca90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x18023ca98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x18023caa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d73c8]
mov rcx, rbx
mov qword [0x18023caa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d73b0]
mov rcx, rbx
mov qword [0x18023cab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d73a0]
mov rcx, rbx
mov qword [0x18023cab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x18023cac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7370]
mov rcx, rbx
mov qword [0x18023cac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7358]
mov rcx, rbx
mov qword [0x18023cad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801a7528]
mov qword [0x18023cad8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801a7510]
mov rcx, rbx
mov qword [0x18023cae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7340]
mov rcx, rbx
mov qword [0x18023cae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7328]
mov rcx, rbx
mov qword [0x18023caf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7308]
mov rcx, rbx
mov qword [0x18023caf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d72f8]
mov rcx, rbx
mov qword [0x18023cb00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x18023cb08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x18023cb10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d72c8]
mov rcx, rbx
mov qword [0x18023cb18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d72b8]
mov rcx, rbx
mov qword [0x18023cb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x18023cb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x18023cb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x18023cb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7268]
mov rcx, rbx
mov qword [0x18023cb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x18023cb48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x18023cb50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x18023cb58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x18023cb60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7228]
mov rcx, rbx
mov qword [0x18023cb68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7218]
mov rcx, rbx
mov qword [0x18023cb70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7208]
mov qword [0x18023cb78], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71f8]
mov rcx, rbx
mov qword [0x18023cb80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71e8]
mov rcx, rbx
mov qword [0x18023cb88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801be288]
mov rcx, rbx
mov qword [0x18023cb90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x18023cb98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x18023cba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71c0]
mov rcx, rbx
mov qword [0x18023cba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71b0]
mov rcx, rbx
mov qword [0x18023cbb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x18023cbb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x18023cbc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x18023cbc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x18023cbd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x18023cbd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7148]
mov rcx, rbx
mov qword [0x18023cbe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7130]
mov rcx, rbx
mov qword [0x18023cbe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x18023cbf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7100]
mov rcx, rbx
mov qword [0x18023cbf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70f0]
mov rcx, rbx
mov qword [0x18023cc00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x18023cc08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70d0]
mov rcx, rbx
mov qword [0x18023cc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x18023cc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70a8]
mov rcx, rbx
mov qword [0x18023cc20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7090]
mov rcx, rbx
mov qword [0x18023cc28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x18023cc30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x18023cc38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7048]
mov rcx, rbx
mov qword [0x18023cc40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7030]
mov rcx, rbx
mov qword [0x18023cc48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7020]
mov rcx, rbx
mov qword [0x18023cc50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7010]
mov rcx, rbx
mov qword [0x18023cc58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x18023cc60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x18023cc68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fd0]
mov rcx, rbx
mov qword [0x18023cc70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fc0]
mov rcx, rbx
mov qword [0x18023cc78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fb0]
mov rcx, rbx
mov qword [0x18023cc80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x18023cc88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x18023cc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x18023cc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x18023cca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f30]
mov rcx, rbx
mov qword [0x18023cca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f30]
mov rcx, rbx
mov qword [0x18023ccb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x18023ccb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023ccc0], rax
lea rdx, [0x1801d6f20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f08]
mov rcx, rbx
mov qword [0x18023ccc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x18023ccd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x18023ccd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x18023cce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x18023cce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x18023ccf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x18023ccf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x18023cd00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x18023cd08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x18023cd10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x18023cd18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x18023cd20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x18023cd28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x18023cd30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x18023cd38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x18023cd40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x18023cd48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x18023cd50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x18023cd58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x18023cd60], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x18023cd68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x18023cd70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x18023cd78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x18023cd80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x18023cda0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x18023cda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6d08]
mov rcx, rbx
mov qword [0x18023cdb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6cf8]
mov rcx, rbx
mov qword [0x18023cdb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ce8]
mov rcx, rbx
mov qword [0x18023cdc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6cc8]
mov rcx, rbx
mov qword [0x18023cdc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x18023cdd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x18023cdd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x18023cde0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x18023cdf4], 1
mov qword [0x18023cde8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret