Function at 0x18003bb40
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800a300c]
test ecx, ecx
jne 0x18003c167
mov eax, dword [0x1800a3008]
cmp eax, 3
ja 0x18003c167
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800a3008], eax
call fcn.1800133d0
test eax, eax
je 0x18003bb86
lea rcx, [0x180068188]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18003bb93
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18003bba5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.NtCreateFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenFile
mov rcx, rbx
mov qword [0x1800a2dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rbx
mov qword [0x1800a2dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtReadFile
mov rcx, rbx
mov qword [0x1800a2dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWriteFile
mov rcx, rbx
mov qword [0x1800a2de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryObject
mov rcx, rbx
mov qword [0x1800a2de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryFile
mov rcx, rbx
mov qword [0x1800a2df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationFile
mov rcx, rbx
mov qword [0x1800a2df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationFile
mov rcx, rbx
mov qword [0x1800a2e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
mov qword [0x1800a2e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeleteFile
mov rcx, rbx
mov qword [0x1800a2e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rbx
mov qword [0x1800a2e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitializeCriticalSection
mov rcx, rbx
mov qword [0x1800a2e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlDeleteCriticalSection
mov rcx, rbx
mov qword [0x1800a2e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlEnterCriticalSection
mov rcx, rbx
mov qword [0x1800a2e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rbx
mov qword [0x1800a2e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlTryEnterCriticalSection
mov rcx, rbx
mov qword [0x1800a2e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenDirectoryObject
mov rcx, rbx
mov qword [0x1800a2e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryObject
mov rcx, rbx
mov qword [0x1800a2e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, rbx
mov qword [0x1800a2e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x1800a2e60], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateKey
mov rcx, rbx
mov qword [0x1800a2e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenKey
mov rcx, rbx
mov qword [0x1800a2e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryKey
mov rcx, rbx
mov qword [0x1800a2e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryValueKey
mov rcx, rbx
mov qword [0x1800a2e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryMultipleValueKey
mov rcx, rbx
mov qword [0x1800a2e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtEnumerateKey
mov rcx, rbx
mov qword [0x1800a2e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtEnumerateValueKey
mov rcx, rbx
mov qword [0x1800a2e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtFlushKey
mov rcx, rbx
mov qword [0x1800a2ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeleteKey
mov rcx, rbx
mov qword [0x1800a2ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationKey
mov rcx, rbx
mov qword [0x1800a2eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetValueKey
mov rcx, rbx
mov qword [0x1800a2eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtNotifyChangeKey
mov rcx, rbx
mov qword [0x1800a2ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateProcess
mov rcx, rbx
mov qword [0x1800a2ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateProcessEx
mov rcx, rbx
mov qword [0x1800a2ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenProcess
mov rcx, rbx
mov qword [0x1800a2ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtTerminateProcess
mov rcx, rbx
mov qword [0x1800a2ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LdrShutdownProcess
mov rcx, rbx
mov qword [0x1800a2ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
mov qword [0x1800a2ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationProcess
mov rcx, rbx
mov qword [0x1800a2ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateThread
mov qword [0x1800a2f00], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenThread
mov rcx, rbx
mov qword [0x1800a2f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSuspendThread
mov rcx, rbx
mov qword [0x1800a2f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeThread
mov rcx, rbx
mov qword [0x1800a2f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtTerminateThread
mov rcx, rbx
mov qword [0x1800a2f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LdrShutdownThread
mov rcx, rbx
mov qword [0x1800a2f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
mov qword [0x1800a2f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationThread
mov rcx, rbx
mov qword [0x1800a2f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
mov qword [0x1800a2f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
mov qword [0x1800a2f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov rcx, rbx
mov qword [0x1800a2f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryAttributesFile
mov rcx, rbx
mov qword [0x1800a2f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryFullAttributesFile
mov rcx, rbx
mov qword [0x1800a2f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlConvertSidToUnicodeString
mov rcx, rbx
mov qword [0x1800a2f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, rbx
mov qword [0x1800a2f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, rbx
mov qword [0x1800a2f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitializeSid
mov rcx, rbx
mov qword [0x1800a2f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlSubAuthoritySid
mov rcx, rbx
mov qword [0x1800a2f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCreateAcl
mov rcx, rbx
mov qword [0x1800a2f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, rbx
mov qword [0x1800a2f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetCurrentDirectory_U
mov rcx, rbx
mov qword [0x1800a2fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlSetCurrentDirectory_U
mov rcx, rbx
mov qword [0x1800a2fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlGetFullPathName_U
mov rcx, rbx
mov qword [0x1800a2fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1800a2fb8], rax
mov dword [0x1800a300c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret