Function at 0x140168000
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140246c9c]
test ecx, ecx
jne 0x140168b18
mov eax, dword [0x140246c98]
cmp eax, 3
ja 0x140168b18
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x140246c98], eax
call fcn.140167440
test eax, eax
je 0x140168046
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140168053
lea rcx, [0x140195d08]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x140168065
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1401e09f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e09e0]
mov rcx, rbx
mov qword [0x1402468e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e09d0]
mov rcx, rbx
mov qword [0x1402468f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e09c0]
mov rcx, rbx
mov qword [0x1402468f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e09b0]
mov rcx, rbx
mov qword [0x140246900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x140246908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x140246910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0980]
mov rcx, rbx
mov qword [0x140246918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x140246920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x140246928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0950]
mov rcx, rbx
mov qword [0x140246930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x140246938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0930]
mov rcx, rbx
mov qword [0x140246940], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x140246948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0910]
mov rcx, rbx
mov qword [0x140246950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e08f8]
mov rcx, rbx
mov qword [0x140246958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e08e8]
mov rcx, rbx
mov qword [0x140246960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x140246968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e08b8]
mov rcx, rbx
mov qword [0x140246970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesW
mov rcx, rbx
mov qword [0x140246978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0888]
mov qword [0x140246980], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x140246988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x140246990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesW
mov rcx, rbx
mov qword [0x140246998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileInformationByHandle
mov rcx, rbx
mov qword [0x1402469a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0810]
mov rcx, rbx
mov qword [0x1402469a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0800]
mov rcx, rbx
mov qword [0x1402469b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e07f0]
mov rcx, rbx
mov qword [0x1402469b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1402469c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e07d0]
mov rcx, rbx
mov qword [0x1402469c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1402469d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1402469d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0798]
mov rcx, rbx
mov qword [0x1402469e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1402469e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1402469f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1402469f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x140246a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x140246a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0710]
mov rcx, rbx
mov qword [0x140246a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileW
mov rcx, rbx
mov qword [0x140246a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x140246a20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileW
mov rcx, rbx
mov qword [0x140246a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x140246a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExW
mov rcx, rbx
mov qword [0x140246a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x140246a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x140246a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0680]
mov rcx, rbx
mov qword [0x140246a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileW
mov rcx, rbx
mov qword [0x140246a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x140246a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x140246a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x140246a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x140246a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x140246a80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x140246a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x140246a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x140246a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x140246aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFile
mov rcx, rbx
mov qword [0x140246aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x140246ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnmapViewOfFile
mov rcx, rbx
mov qword [0x140246ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x140246ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x140246ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryW
mov rcx, rbx
mov qword [0x140246ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x140246ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x140246ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x140246ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryW
mov rcx, rbx
mov qword [0x140246af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e04e0]
mov rcx, rbx
mov qword [0x140246af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileW
mov rcx, rbx
mov qword [0x140246b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x140246b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x140246b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x140246b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileW
mov rcx, rbx
mov qword [0x140246b20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0470]
mov rcx, rbx
mov qword [0x140246b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x140246b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x140246b38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x140246b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x140246b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x140246b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x140246b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x140246b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140246b68], rax
lea rdx, str.OpenProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e03b0]
mov rcx, rbx
mov qword [0x140246b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x140246b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x140246b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x140246b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x140246b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x140246b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x140246ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x140246ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x140246bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x140246bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x140246bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x140246bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x140246bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x140246bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x140246be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x140246be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x140246bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x140246bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x140246c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x140246c08], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x140246c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x140246c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x140246c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x140246c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x140246c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x140246c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x140246c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x140246c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x140246c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0160]
mov rcx, rbx
mov qword [0x140246c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0150]
mov rcx, rbx
mov qword [0x140246c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x140246c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x140246c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0100]
mov rcx, rbx
mov qword [0x140246c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x140246c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x140246c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x140246c9c], 1
mov qword [0x140246c90], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret