Function at 0x18007e480
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18014100c]
test ecx, ecx
jne 0x18007ef98
mov eax, dword [0x180141008]
cmp eax, 3
ja 0x18007ef98
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180141008], eax
call fcn.180036d30
test eax, eax
je 0x18007e4c6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18007e4d3
lea rcx, [0x1800d45c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18007e4e5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1800e8940]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8930]
mov rcx, rbx
mov qword [0x180140c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8920]
mov rcx, rbx
mov qword [0x180140c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x180140c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8900]
mov rcx, rbx
mov qword [0x180140c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x180140c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x180140c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e88d0]
mov rcx, rbx
mov qword [0x180140c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x180140c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x180140c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x180140ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x180140ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x180140cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x180140cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8860]
mov rcx, rbx
mov qword [0x180140cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8848]
mov rcx, rbx
mov qword [0x180140cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8838]
mov rcx, rbx
mov qword [0x180140cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x180140cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8820]
mov rcx, rbx
mov qword [0x180140ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8808]
mov rcx, rbx
mov qword [0x180140ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d45e8]
mov qword [0x180140cf0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d45d0]
mov rcx, rbx
mov qword [0x180140cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e87f0]
mov rcx, rbx
mov qword [0x180140d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e87d8]
mov rcx, rbx
mov qword [0x180140d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e87b8]
mov rcx, rbx
mov qword [0x180140d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e87a8]
mov rcx, rbx
mov qword [0x180140d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x180140d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8788]
mov rcx, rbx
mov qword [0x180140d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8778]
mov rcx, rbx
mov qword [0x180140d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8768]
mov rcx, rbx
mov qword [0x180140d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x180140d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x180140d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x180140d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x180140d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x180140d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x180140d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x180140d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x180140d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e86d8]
mov rcx, rbx
mov qword [0x180140d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e86c8]
mov rcx, rbx
mov qword [0x180140d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e86b8]
mov qword [0x180140d90], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e86a8]
mov rcx, rbx
mov qword [0x180140d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8698]
mov rcx, rbx
mov qword [0x180140da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8688]
mov rcx, rbx
mov qword [0x180140da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x180140db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x180140db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8648]
mov rcx, rbx
mov qword [0x180140dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8638]
mov rcx, rbx
mov qword [0x180140dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x180140dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x180140dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x180140de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x180140de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x180140df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e85d0]
mov rcx, rbx
mov qword [0x180140df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x180140e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e85a0]
mov rcx, rbx
mov qword [0x180140e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x180140e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8578]
mov rcx, rbx
mov qword [0x180140e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x180140e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8558]
mov rcx, rbx
mov qword [0x180140e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x180140e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8530]
mov rcx, rbx
mov qword [0x180140e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8518]
mov rcx, rbx
mov qword [0x180140e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x180140e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x180140e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e84d0]
mov rcx, rbx
mov qword [0x180140e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e84b8]
mov rcx, rbx
mov qword [0x180140e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e84a8]
mov rcx, rbx
mov qword [0x180140e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8498]
mov rcx, rbx
mov qword [0x180140e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x180140e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x180140e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8458]
mov rcx, rbx
mov qword [0x180140e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8448]
mov rcx, rbx
mov qword [0x180140e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8438]
mov rcx, rbx
mov qword [0x180140e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x180140ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x180140ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x180140eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x180140eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e83b8]
mov rcx, rbx
mov qword [0x180140ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e83b8]
mov rcx, rbx
mov qword [0x180140ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x180140ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180140ed8], rax
lea rdx, [0x1800e8390]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8378]
mov rcx, rbx
mov qword [0x180140ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x180140ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x180140ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x180140ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x180140f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x180140f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x180140f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x180140f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x180140f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x180140f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x180140f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x180140f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x180140f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x180140f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x180140f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x180140f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x180140f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x180140f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x180140f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x180140f78], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180140f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180140f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x180140f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x180140f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x180140fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x180140fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x180140fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x180140fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x180140fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8128]
mov rcx, rbx
mov qword [0x180140fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8118]
mov rcx, rbx
mov qword [0x180140fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x180140fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x180140fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x180140fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x180140ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x180140ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x18014100c], 1
mov qword [0x180141000], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret