Function at 0x1800bc1f0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180173d9c]
test ecx, ecx
jne 0x1800bcd08
mov eax, dword [0x180173d98]
cmp eax, 3
ja 0x1800bcd08
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180173d98], eax
call fcn.1800a3710
test eax, eax
je 0x1800bc236
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800bc243
lea rcx, [0x18010bfe8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800bc255
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x180123070]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123060]
mov rcx, rbx
mov qword [0x1801739e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123050]
mov rcx, rbx
mov qword [0x1801739f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1801739f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123030]
mov rcx, rbx
mov qword [0x180173a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x180173a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x180173a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123000]
mov rcx, rbx
mov qword [0x180173a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x180173a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x180173a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x180173a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x180173a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x180173a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x180173a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f90]
mov rcx, rbx
mov qword [0x180173a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f78]
mov rcx, rbx
mov qword [0x180173a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f68]
mov rcx, rbx
mov qword [0x180173a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x180173a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f38]
mov rcx, rbx
mov qword [0x180173a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f20]
mov rcx, rbx
mov qword [0x180173a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x180173a80], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18010bff8]
mov rcx, rbx
mov qword [0x180173a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122f08]
mov rcx, rbx
mov qword [0x180173a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122ef0]
mov rcx, rbx
mov qword [0x180173a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122ed0]
mov rcx, rbx
mov qword [0x180173aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122ec0]
mov rcx, rbx
mov qword [0x180173aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x180173ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x180173ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x180173ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122e80]
mov rcx, rbx
mov qword [0x180173ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x180173ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x180173ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x180173ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x180173ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x180173af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x180173af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x180173b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x180173b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122df0]
mov rcx, rbx
mov qword [0x180173b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122de0]
mov rcx, rbx
mov qword [0x180173b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122dd0]
mov qword [0x180173b20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122dc0]
mov rcx, rbx
mov qword [0x180173b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122db0]
mov rcx, rbx
mov qword [0x180173b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122da0]
mov rcx, rbx
mov qword [0x180173b38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x180173b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x180173b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122d60]
mov rcx, rbx
mov qword [0x180173b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122d50]
mov rcx, rbx
mov qword [0x180173b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x180173b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x180173b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x180173b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x180173b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x180173b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x180173b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x180173b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x180173b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x180173ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFile
mov rcx, rbx
mov qword [0x180173ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x180173bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnmapViewOfFile
mov rcx, rbx
mov qword [0x180173bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x180173bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122c48]
mov rcx, rbx
mov qword [0x180173bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122c30]
mov rcx, rbx
mov qword [0x180173bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x180173bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x180173be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122be8]
mov rcx, rbx
mov qword [0x180173be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122bd0]
mov rcx, rbx
mov qword [0x180173bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122bc0]
mov rcx, rbx
mov qword [0x180173bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122bb0]
mov rcx, rbx
mov qword [0x180173c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x180173c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x180173c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122b70]
mov rcx, rbx
mov qword [0x180173c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122b60]
mov rcx, rbx
mov qword [0x180173c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122b50]
mov rcx, rbx
mov qword [0x180173c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x180173c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x180173c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x180173c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x180173c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122ad0]
mov rcx, rbx
mov qword [0x180173c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122ad0]
mov rcx, rbx
mov qword [0x180173c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x180173c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180173c68], rax
lea rdx, [0x180122aa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122a90]
mov rcx, rbx
mov qword [0x180173c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x180173c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x180173c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x180173c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x180173c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x180173c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x180173ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x180173ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x180173cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x180173cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x180173cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x180173cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x180173cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x180173cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x180173ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x180173ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x180173cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x180173cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x180173d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x180173d08], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180173d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180173d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x180173d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x180173d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x180173d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x180173d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x180173d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x180173d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x180173d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122850]
mov rcx, rbx
mov qword [0x180173d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180122840]
mov rcx, rbx
mov qword [0x180173d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x180173d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x180173d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x180173d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x180173d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x180173d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180173d9c], 1
mov qword [0x180173d90], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret