Function at 0x180015920
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
cmp dword [0x1802532b8], 0
jne 0x180015947
cmp dword [0x1802532b4], 3
jbe 0x180015952
mov eax, dword [0x1802532b8]
jmp 0x18001651f
mov eax, dword [0x1802532b4]
inc eax
mov dword [0x1802532b4], eax
mov qword [rsp + 0x20], 0
lea rcx, [0x1801f9cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18001598a
xor eax, eax
jmp 0x18001651f
lea rdx, str.CreateFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802526d8], rax
lea rdx, [0x1801f9cf8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802526e0], rax
lea rdx, [0x1801f9d08]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802526e8], rax
lea rdx, [0x1801f9d18]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802526f0], rax
lea rdx, [0x1801f9d28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802526f8], rax
lea rdx, str.ReadFileEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252700], rax
lea rdx, str.ReadFileScatter
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252708], rax
lea rdx, [0x1801f9d60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252710], rax
lea rdx, str.WriteFileEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252718], rax
lea rdx, str.WriteFileGather
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252720], rax
lea rdx, [0x1801f9d90]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252728], rax
lea rdx, str.LockFileEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252730], rax
lea rdx, [0x1801f9db8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252738], rax
lea rdx, str.UnlockFileEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252740], rax
lea rdx, [0x1801f9dd8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252748], rax
lea rdx, [0x1801f9de8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252750], rax
lea rdx, [0x1801f9e00]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252758], rax
lea rdx, str.SetFilePointerEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252760], rax
lea rdx, str.GetFileAttributesA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252768], rax
lea rdx, [0x1801f9e40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252770], rax
lea rdx, str.GetFileAttributesExA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252778], rax
lea rdx, [0x1801f9e70]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252780], rax
lea rdx, str.SetFileAttributesA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252788], rax
lea rdx, str.SetFileAttributesW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252790], rax
lea rdx, [0x1801f9eb8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252798], rax
lea rdx, [0x1801f9ed8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527a0], rax
lea rdx, [0x1801f9ee8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527a8], rax
lea rdx, [0x1801f9ef8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527b0], rax
lea rdx, str.SetFileTime
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527b8], rax
lea rdx, [0x1801f9f18]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527c0], rax
lea rdx, str.GetBinaryTypeA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527c8], rax
lea rdx, str.GetBinaryTypeW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527d0], rax
lea rdx, str.GetFullPathNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527d8], rax
lea rdx, [0x1801f9f60]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527e0], rax
lea rdx, str.GetLongPathNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527e8], rax
lea rdx, str.GetLongPathNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527f0], rax
lea rdx, str.GetShortPathNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802527f8], rax
lea rdx, str.GetShortPathNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252800], rax
lea rdx, str.DeleteFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252808], rax
lea rdx, [0x1801f9fe8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252810], rax
lea rdx, str.MoveFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252818], rax
lea rdx, str.MoveFileW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252820], rax
lea rdx, str.MoveFileExA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252828], rax
lea rdx, str.MoveFileExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252830], rax
lea rdx, str.MoveFileWithProgressA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252838], rax
lea rdx, str.MoveFileWithProgressW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252840], rax
lea rdx, str.CopyFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252848], rax
lea rdx, [0x1801fa078]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252850], rax
lea rdx, str.CopyFileExA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252858], rax
lea rdx, str.CopyFileExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252860], rax
lea rdx, str.CopyFile2
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252868], rax
lea rdx, str.ReplaceFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252870], rax
lea rdx, str.ReplaceFileW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252878], rax
lea rdx, str.CreateFileMappingA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252880], rax
lea rdx, str.CreateFileMappingW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252888], rax
lea rdx, str.OpenFileMappingA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252890], rax
lea rdx, str.OpenFileMappingW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252898], rax
lea rdx, str.MapViewOfFile
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528a0], rax
lea rdx, str.MapViewOfFileEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528a8], rax
lea rdx, str.UnmapViewOfFile
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528b0], rax
lea rdx, str.FlushViewOfFile
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528b8], rax
lea rdx, str.CreateDirectoryA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528c0], rax
lea rdx, [0x1801fa190]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528c8], rax
lea rdx, str.CreateDirectoryExA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528d0], rax
lea rdx, str.CreateDirectoryExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528d8], rax
lea rdx, str.RemoveDirectoryA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528e0], rax
lea rdx, str.RemoveDirectoryW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528e8], rax
lea rdx, str.FindFirstFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528f0], rax
lea rdx, [0x1801fa218]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802528f8], rax
lea rdx, str.FindFirstFileExA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252900], rax
lea rdx, str.FindFirstFileExW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252908], rax
lea rdx, str.FindNextFileA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252910], rax
lea rdx, str.FindNextFileW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252918], rax
lea rdx, [0x1801fa278]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252920], rax
lea rdx, str.K32GetMappedFileNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252928], rax
lea rdx, str.K32GetMappedFileNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252930], rax
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252938], rax
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252940], rax
lea rdx, [0x1801fa2f8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252948], rax
lea rdx, str.CreateProcessW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252950], rax
lea rdx, str.CreateProcessInternalW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252958], rax
lea rdx, [0x1801fa330]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252960], rax
lea rdx, [0x1801fa340]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252968], rax
lea rdx, [0x1801fa358]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252970], rax
lea rdx, str.OpenThread
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252978], rax
lea rdx, str.SwitchToThread
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252980], rax
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252988], rax
lea rdx, str.Heap32First
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252990], rax
lea rdx, str.Heap32ListFirst
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252998], rax
lea rdx, str.Heap32ListNext
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529a0], rax
lea rdx, str.Heap32Next
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529a8], rax
lea rdx, str.Module32First
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529b0], rax
lea rdx, str.Module32FirstW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529b8], rax
lea rdx, str.Module32Next
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529c0], rax
lea rdx, str.Module32NextW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529c8], rax
lea rdx, str.Process32First
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529d0], rax
lea rdx, str.Process32FirstW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529d8], rax
lea rdx, str.Process32Next
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529e0], rax
lea rdx, str.Process32NextW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529e8], rax
lea rdx, str.Thread32First
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529f0], rax
lea rdx, str.Thread32Next
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1802529f8], rax
lea rdx, str.Toolhelp32ReadProcessMemory
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a00], rax
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a08], rax
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a10], rax
lea rdx, str.GlobalMemoryStatusEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a18], rax
lea rdx, str.IsWow64Process
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a20], rax
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a28], rax
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a30], rax
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a38], rax
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a40], rax
lea rdx, str.GetProcessId
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a48], rax
lea rdx, [0x1801fa5a8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a50], rax
lea rdx, [0x1801fa5c0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a58], rax
lea rdx, str.GetCommandLineW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a60], rax
lea rdx, str.GetQueuedCompletionStatus
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a68], rax
lea rdx, [0x1801fa600]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a70], rax
lea rdx, str.GetPackagePathByFullName
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a78], rax
lea rdx, str.GetPackageFullName
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a80], rax
mov dword [0x1802532b8], 1
mov eax, 1
add rsp, 0x30
pop rdi
ret