Function at 0x180150b30
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180241f64]
test ecx, ecx
jne 0x180151648
mov eax, dword [0x180241f60]
cmp eax, 3
ja 0x180151648
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180241f60], eax
call fcn.18012a2e0
test eax, eax
je 0x180150b76
lea rcx, [0x1801aa500]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180150b83
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180150b95
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1801db0a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801db098]
mov rcx, rbx
mov qword [0x180241bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801db088]
mov rcx, rbx
mov qword [0x180241bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x180241bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801db068]
mov rcx, rbx
mov qword [0x180241bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x180241bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x180241bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801db038]
mov rcx, rbx
mov qword [0x180241be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x180241be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x180241bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x180241bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x180241c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x180241c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x180241c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dafc8]
mov rcx, rbx
mov qword [0x180241c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dafb0]
mov rcx, rbx
mov qword [0x180241c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dafa0]
mov rcx, rbx
mov qword [0x180241c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x180241c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daf70]
mov rcx, rbx
mov qword [0x180241c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daf58]
mov rcx, rbx
mov qword [0x180241c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801aa538]
mov qword [0x180241c48], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801aa520]
mov rcx, rbx
mov qword [0x180241c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daf40]
mov rcx, rbx
mov qword [0x180241c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daf28]
mov rcx, rbx
mov qword [0x180241c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daf08]
mov rcx, rbx
mov qword [0x180241c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daef8]
mov rcx, rbx
mov qword [0x180241c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x180241c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x180241c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daec8]
mov rcx, rbx
mov qword [0x180241c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daeb8]
mov rcx, rbx
mov qword [0x180241c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x180241c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x180241ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x180241ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dae68]
mov rcx, rbx
mov qword [0x180241cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x180241cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x180241cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x180241cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x180241cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dae28]
mov rcx, rbx
mov qword [0x180241cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dae18]
mov rcx, rbx
mov qword [0x180241ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dae08]
mov qword [0x180241ce8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dadf8]
mov rcx, rbx
mov qword [0x180241cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dade8]
mov rcx, rbx
mov qword [0x180241cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801c1718]
mov rcx, rbx
mov qword [0x180241d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x180241d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x180241d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dadc0]
mov rcx, rbx
mov qword [0x180241d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dadb0]
mov rcx, rbx
mov qword [0x180241d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x180241d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x180241d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x180241d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x180241d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x180241d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dad48]
mov rcx, rbx
mov qword [0x180241d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dad30]
mov rcx, rbx
mov qword [0x180241d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x180241d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dad00]
mov rcx, rbx
mov qword [0x180241d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dacf0]
mov rcx, rbx
mov qword [0x180241d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x180241d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dacd0]
mov rcx, rbx
mov qword [0x180241d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x180241d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801daca8]
mov rcx, rbx
mov qword [0x180241d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dac90]
mov rcx, rbx
mov qword [0x180241d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x180241da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x180241da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dac48]
mov rcx, rbx
mov qword [0x180241db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dac30]
mov rcx, rbx
mov qword [0x180241db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dac20]
mov rcx, rbx
mov qword [0x180241dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dac10]
mov rcx, rbx
mov qword [0x180241dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x180241dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x180241dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dabd0]
mov rcx, rbx
mov qword [0x180241de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dabc0]
mov rcx, rbx
mov qword [0x180241de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dabb0]
mov rcx, rbx
mov qword [0x180241df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x180241df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x180241e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x180241e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x180241e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dab30]
mov rcx, rbx
mov qword [0x180241e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dab30]
mov rcx, rbx
mov qword [0x180241e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x180241e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180241e30], rax
lea rdx, [0x1801dab20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801dab08]
mov rcx, rbx
mov qword [0x180241e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x180241e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x180241e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x180241e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x180241e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x180241e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x180241e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x180241e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x180241e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x180241e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x180241e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x180241e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x180241e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x180241ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x180241ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x180241eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x180241eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x180241ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x180241ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x180241ed0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x180241ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180241ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x180241ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x180241ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x180241ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x180241f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x180241f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x180241f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x180241f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801da908]
mov rcx, rbx
mov qword [0x180241f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801da8f8]
mov rcx, rbx
mov qword [0x180241f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801da8e8]
mov rcx, rbx
mov qword [0x180241f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801da8c8]
mov rcx, rbx
mov qword [0x180241f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x180241f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x180241f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x180241f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180241f64], 1
mov qword [0x180241f58], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret