Function at 0x180051ab0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180152f44]
test ecx, ecx
jne 0x1800525c8
mov eax, dword [0x180152f40]
cmp eax, 3
ja 0x1800525c8
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180152f40], eax
call fcn.18009fed0
test eax, eax
je 0x180051af6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180051b03
lea rcx, [0x1800e2f40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180051b15
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1800f84d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f84c0]
mov rcx, rbx
mov qword [0x180152b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f84b0]
mov rcx, rbx
mov qword [0x180152b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f84a0]
mov rcx, rbx
mov qword [0x180152ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8490]
mov rcx, rbx
mov qword [0x180152ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x180152bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x180152bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8460]
mov rcx, rbx
mov qword [0x180152bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x180152bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x180152bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x180152bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x180152be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x180152be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x180152bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f83f0]
mov rcx, rbx
mov qword [0x180152bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f83d8]
mov rcx, rbx
mov qword [0x180152c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f83c8]
mov rcx, rbx
mov qword [0x180152c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x180152c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f83b0]
mov rcx, rbx
mov qword [0x180152c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8398]
mov rcx, rbx
mov qword [0x180152c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e40e8]
mov qword [0x180152c28], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e40d0]
mov rcx, rbx
mov qword [0x180152c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8380]
mov rcx, rbx
mov qword [0x180152c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8368]
mov rcx, rbx
mov qword [0x180152c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8348]
mov rcx, rbx
mov qword [0x180152c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8338]
mov rcx, rbx
mov qword [0x180152c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x180152c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8318]
mov rcx, rbx
mov qword [0x180152c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8308]
mov rcx, rbx
mov qword [0x180152c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f82f8]
mov rcx, rbx
mov qword [0x180152c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x180152c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x180152c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x180152c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x180152c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x180152c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x180152ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x180152ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x180152cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8268]
mov rcx, rbx
mov qword [0x180152cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8258]
mov rcx, rbx
mov qword [0x180152cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8248]
mov qword [0x180152cc8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8238]
mov rcx, rbx
mov qword [0x180152cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8228]
mov rcx, rbx
mov qword [0x180152cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8218]
mov rcx, rbx
mov qword [0x180152ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x180152ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x180152cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f81d8]
mov rcx, rbx
mov qword [0x180152cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f81c8]
mov rcx, rbx
mov qword [0x180152d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x180152d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x180152d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x180152d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x180152d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x180152d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8160]
mov rcx, rbx
mov qword [0x180152d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x180152d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8130]
mov rcx, rbx
mov qword [0x180152d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x180152d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8108]
mov rcx, rbx
mov qword [0x180152d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x180152d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f80e8]
mov rcx, rbx
mov qword [0x180152d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x180152d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f80c0]
mov rcx, rbx
mov qword [0x180152d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f80a8]
mov rcx, rbx
mov qword [0x180152d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x180152d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x180152d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8060]
mov rcx, rbx
mov qword [0x180152d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8048]
mov rcx, rbx
mov qword [0x180152d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8038]
mov rcx, rbx
mov qword [0x180152da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f8028]
mov rcx, rbx
mov qword [0x180152da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x180152db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x180152db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7fe8]
mov rcx, rbx
mov qword [0x180152dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7fd8]
mov rcx, rbx
mov qword [0x180152dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7fc8]
mov rcx, rbx
mov qword [0x180152dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x180152dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x180152de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x180152de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x180152df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7f48]
mov rcx, rbx
mov qword [0x180152df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7f48]
mov rcx, rbx
mov qword [0x180152e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x180152e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180152e10], rax
lea rdx, [0x1800f7f20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7f08]
mov rcx, rbx
mov qword [0x180152e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x180152e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x180152e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x180152e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x180152e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x180152e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x180152e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x180152e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x180152e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x180152e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x180152e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x180152e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x180152e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x180152e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x180152e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x180152e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x180152e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x180152ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x180152ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x180152eb0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180152eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180152ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x180152ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x180152ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x180152ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x180152ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x180152ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x180152ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x180152ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7cb8]
mov rcx, rbx
mov qword [0x180152f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7ca8]
mov rcx, rbx
mov qword [0x180152f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x180152f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x180152f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x180152f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x180152f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x180152f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180152f44], 1
mov qword [0x180152f38], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret