Function at 0x18014dfb0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18023cdf4]
test ecx, ecx
jne 0x18014eac8
mov eax, dword [0x18023cdf0]
cmp eax, 3
ja 0x18014eac8
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x18023cdf0], eax
call fcn.180127760
test eax, eax
je 0x18014dff6
lea rcx, [0x1801a74f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18014e003
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18014e015
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1801d7358]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7348]
mov rcx, rbx
mov qword [0x18023ca40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7338]
mov rcx, rbx
mov qword [0x18023ca48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x18023ca50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7318]
mov rcx, rbx
mov qword [0x18023ca58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x18023ca60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x18023ca68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d72e8]
mov rcx, rbx
mov qword [0x18023ca70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x18023ca78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x18023ca80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x18023ca88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x18023ca90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x18023ca98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x18023caa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7278]
mov rcx, rbx
mov qword [0x18023caa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7260]
mov rcx, rbx
mov qword [0x18023cab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7250]
mov rcx, rbx
mov qword [0x18023cab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x18023cac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7220]
mov rcx, rbx
mov qword [0x18023cac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7208]
mov rcx, rbx
mov qword [0x18023cad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801a7528]
mov qword [0x18023cad8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801a7510]
mov rcx, rbx
mov qword [0x18023cae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71f0]
mov rcx, rbx
mov qword [0x18023cae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71d8]
mov rcx, rbx
mov qword [0x18023caf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71b8]
mov rcx, rbx
mov qword [0x18023caf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d71a8]
mov rcx, rbx
mov qword [0x18023cb00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x18023cb08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x18023cb10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7178]
mov rcx, rbx
mov qword [0x18023cb18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7168]
mov rcx, rbx
mov qword [0x18023cb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x18023cb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x18023cb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x18023cb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7118]
mov rcx, rbx
mov qword [0x18023cb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x18023cb48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x18023cb50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x18023cb58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x18023cb60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70d8]
mov rcx, rbx
mov qword [0x18023cb68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70c8]
mov rcx, rbx
mov qword [0x18023cb70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70b8]
mov qword [0x18023cb78], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d70a8]
mov rcx, rbx
mov qword [0x18023cb80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7098]
mov rcx, rbx
mov qword [0x18023cb88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801be128]
mov rcx, rbx
mov qword [0x18023cb90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x18023cb98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x18023cba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7070]
mov rcx, rbx
mov qword [0x18023cba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d7060]
mov rcx, rbx
mov qword [0x18023cbb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x18023cbb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x18023cbc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x18023cbc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x18023cbd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x18023cbd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ff8]
mov rcx, rbx
mov qword [0x18023cbe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fe0]
mov rcx, rbx
mov qword [0x18023cbe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x18023cbf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fb0]
mov rcx, rbx
mov qword [0x18023cbf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6fa0]
mov rcx, rbx
mov qword [0x18023cc00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x18023cc08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f80]
mov rcx, rbx
mov qword [0x18023cc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x18023cc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f58]
mov rcx, rbx
mov qword [0x18023cc20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6f40]
mov rcx, rbx
mov qword [0x18023cc28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x18023cc30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x18023cc38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ef8]
mov rcx, rbx
mov qword [0x18023cc40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ee0]
mov rcx, rbx
mov qword [0x18023cc48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ed0]
mov rcx, rbx
mov qword [0x18023cc50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ec0]
mov rcx, rbx
mov qword [0x18023cc58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x18023cc60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x18023cc68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6e80]
mov rcx, rbx
mov qword [0x18023cc70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6e70]
mov rcx, rbx
mov qword [0x18023cc78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6e60]
mov rcx, rbx
mov qword [0x18023cc80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x18023cc88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x18023cc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x18023cc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x18023cca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6de0]
mov rcx, rbx
mov qword [0x18023cca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6de0]
mov rcx, rbx
mov qword [0x18023ccb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x18023ccb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023ccc0], rax
lea rdx, [0x1801d6dd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6db8]
mov rcx, rbx
mov qword [0x18023ccc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x18023ccd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x18023ccd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x18023cce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x18023cce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x18023ccf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x18023ccf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x18023cd00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x18023cd08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x18023cd10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x18023cd18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x18023cd20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x18023cd28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x18023cd30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x18023cd38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x18023cd40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x18023cd48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x18023cd50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x18023cd58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x18023cd60], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x18023cd68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x18023cd70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x18023cd78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x18023cd80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x18023cd98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x18023cda0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x18023cda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6bb8]
mov rcx, rbx
mov qword [0x18023cdb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6ba8]
mov rcx, rbx
mov qword [0x18023cdb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6b98]
mov rcx, rbx
mov qword [0x18023cdc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801d6b78]
mov rcx, rbx
mov qword [0x18023cdc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x18023cdd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x18023cdd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x18023cde0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x18023cdf4], 1
mov qword [0x18023cde8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret