Function at 0x18010a920
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801b17e4]
test ecx, ecx
jne 0x18010b438
mov eax, dword [0x1801b17e0]
cmp eax, 3
ja 0x18010b438
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1801b17e0], eax
call fcn.1800d08e0
test eax, eax
je 0x18010a966
lea rcx, [0x18012e9d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18010a973
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18010a985
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x18015ac20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ac10]
mov rcx, rbx
mov qword [0x1801b1430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ac00]
mov rcx, rbx
mov qword [0x1801b1438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015abf0]
mov rcx, rbx
mov qword [0x1801b1440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015abe0]
mov rcx, rbx
mov qword [0x1801b1448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1801b1450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1801b1458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015abb0]
mov rcx, rbx
mov qword [0x1801b1460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1801b1468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1801b1470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ab80]
mov rcx, rbx
mov qword [0x1801b1478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1801b1480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ab60]
mov rcx, rbx
mov qword [0x1801b1488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1801b1490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ab40]
mov rcx, rbx
mov qword [0x1801b1498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ab28]
mov rcx, rbx
mov qword [0x1801b14a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015ab18]
mov rcx, rbx
mov qword [0x1801b14a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1801b14b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aae8]
mov rcx, rbx
mov qword [0x1801b14b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aad0]
mov rcx, rbx
mov qword [0x1801b14c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1801b14c8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18012e9f0]
mov rcx, rbx
mov qword [0x1801b14d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aab8]
mov rcx, rbx
mov qword [0x1801b14d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aaa0]
mov rcx, rbx
mov qword [0x1801b14e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa80]
mov rcx, rbx
mov qword [0x1801b14e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa70]
mov rcx, rbx
mov qword [0x1801b14f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa60]
mov rcx, rbx
mov qword [0x1801b14f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa50]
mov rcx, rbx
mov qword [0x1801b1500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa40]
mov rcx, rbx
mov qword [0x1801b1508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015aa30]
mov rcx, rbx
mov qword [0x1801b1510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1801b1518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1801b1520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1801b1528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a9e0]
mov rcx, rbx
mov qword [0x1801b1530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1801b1538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1801b1540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1801b1548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a9b0]
mov rcx, rbx
mov qword [0x1801b1550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a9a0]
mov rcx, rbx
mov qword [0x1801b1558], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a990]
mov rcx, rbx
mov qword [0x1801b1560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a980]
mov qword [0x1801b1568], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a970]
mov rcx, rbx
mov qword [0x1801b1570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a960]
mov rcx, rbx
mov qword [0x1801b1578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a950]
mov rcx, rbx
mov qword [0x1801b1580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1801b1588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1801b1590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a910]
mov rcx, rbx
mov qword [0x1801b1598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a900]
mov rcx, rbx
mov qword [0x1801b15a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1801b15a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1801b15b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1801b15b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1801b15c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1801b15c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a898]
mov rcx, rbx
mov qword [0x1801b15d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a880]
mov rcx, rbx
mov qword [0x1801b15d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1801b15e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a850]
mov rcx, rbx
mov qword [0x1801b15e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a840]
mov rcx, rbx
mov qword [0x1801b15f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1801b15f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a820]
mov rcx, rbx
mov qword [0x1801b1600], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1801b1608], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a7f8]
mov rcx, rbx
mov qword [0x1801b1610], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a7e0]
mov rcx, rbx
mov qword [0x1801b1618], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1801b1620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1801b1628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a798]
mov rcx, rbx
mov qword [0x1801b1630], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a780]
mov rcx, rbx
mov qword [0x1801b1638], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a770]
mov rcx, rbx
mov qword [0x1801b1640], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a760]
mov rcx, rbx
mov qword [0x1801b1648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1801b1650], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1801b1658], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a720]
mov rcx, rbx
mov qword [0x1801b1660], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a710]
mov rcx, rbx
mov qword [0x1801b1668], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a700]
mov rcx, rbx
mov qword [0x1801b1670], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1801b1678], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1801b1680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1801b1688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1801b1690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x1801b1698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x1801b16a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1801b16a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801b16b0], rax
lea rdx, [0x18015a658]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a640]
mov rcx, rbx
mov qword [0x1801b16b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1801b16c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1801b16c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1801b16d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1801b16d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1801b16e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1801b16e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1801b16f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1801b16f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1801b1700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1801b1708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1801b1710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1801b1718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1801b1720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1801b1728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1801b1730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1801b1738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1801b1740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1801b1748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1801b1750], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1801b1758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1801b1760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1801b1768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1801b1770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1801b1778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1801b1780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1801b1788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1801b1790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1801b1798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a3f0]
mov rcx, rbx
mov qword [0x1801b17a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a3e0]
mov rcx, rbx
mov qword [0x1801b17a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015a3d0]
mov rcx, rbx
mov qword [0x1801b17b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1801b17b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1801b17c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1801b17c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1801b17d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1801b17e4], 1
mov qword [0x1801b17d8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret