Function at 0x1800278b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800d2e54]
test ecx, ecx
jne 0x1800283c8
mov eax, dword [0x1800d2e50]
cmp eax, 3
ja 0x1800283c8
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800d2e50], eax
call fcn.1800464a0
test eax, eax
je 0x1800278f6
lea rcx, [0x1800968f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180027903
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180027915
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x18007f2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f2a0]
mov rcx, rbx
mov qword [0x1800d2aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f290]
mov rcx, rbx
mov qword [0x1800d2aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800d2ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f270]
mov rcx, rbx
mov qword [0x1800d2ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800d2ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800d2ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f240]
mov rcx, rbx
mov qword [0x1800d2ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800d2ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800d2ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800d2ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800d2af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800d2af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800d2b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f1d0]
mov rcx, rbx
mov qword [0x1800d2b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f1b8]
mov rcx, rbx
mov qword [0x1800d2b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f1a8]
mov rcx, rbx
mov qword [0x1800d2b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800d2b20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesA
mov rcx, rbx
mov qword [0x1800d2b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f160]
mov rcx, rbx
mov qword [0x1800d2b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800d2b38], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x1800d2b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x1800d2b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f130]
mov rcx, rbx
mov qword [0x1800d2b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f110]
mov rcx, rbx
mov qword [0x1800d2b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f100]
mov rcx, rbx
mov qword [0x1800d2b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800d2b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800d2b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800d2b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f0c0]
mov rcx, rbx
mov qword [0x1800d2b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800d2b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800d2b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800d2b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800d2ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800d2ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800d2bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800d2bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800d2bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [0x1800d2bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f020]
mov rcx, rbx
mov qword [0x1800d2bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x1800d2bd8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007f000]
mov rcx, rbx
mov qword [0x1800d2be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x1800d2be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007efe0]
mov rcx, rbx
mov qword [0x1800d2bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800d2bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800d2c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x1800d2c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ef90]
mov rcx, rbx
mov qword [0x1800d2c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800d2c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800d2c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800d2c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800d2c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800d2c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800d2c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ef10]
mov rcx, rbx
mov qword [0x1800d2c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800d2c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eee0]
mov rcx, rbx
mov qword [0x1800d2c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eed0]
mov rcx, rbx
mov qword [0x1800d2c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800d2c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eeb0]
mov rcx, rbx
mov qword [0x1800d2c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800d2c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x1800d2c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ee70]
mov rcx, rbx
mov qword [0x1800d2c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800d2c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800d2c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x1800d2ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ee10]
mov rcx, rbx
mov qword [0x1800d2ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileA
mov rcx, rbx
mov qword [0x1800d2cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007edf0]
mov rcx, rbx
mov qword [0x1800d2cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800d2cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800d2cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x1800d2cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eda0]
mov rcx, rbx
mov qword [0x1800d2cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ed90]
mov rcx, rbx
mov qword [0x1800d2ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800d2ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800d2cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800d2cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800d2d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ed10]
mov rcx, rbx
mov qword [0x1800d2d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ed10]
mov rcx, rbx
mov qword [0x1800d2d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800d2d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d2d20], rax
lea rdx, [0x18007ece8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ecd0]
mov rcx, rbx
mov qword [0x1800d2d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800d2d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800d2d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800d2d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1800d2d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800d2d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800d2d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800d2d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800d2d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800d2d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1800d2d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800d2d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1800d2d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800d2d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800d2d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800d2da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800d2da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800d2db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800d2db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800d2dc0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800d2dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800d2dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800d2dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800d2de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d2de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d2df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d2df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800d2e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800d2e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eac0]
mov rcx, rbx
mov qword [0x1800d2e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007eab0]
mov rcx, rbx
mov qword [0x1800d2e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800d2e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800d2e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800d2e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800d2e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800d2e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800d2e54], 1
mov qword [0x1800d2e48], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret