Function at 0x1800e6c10
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801e0d2c]
test ecx, ecx
jne 0x1800e7728
mov eax, dword [0x1801e0d28]
cmp eax, 3
ja 0x1800e7728
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1801e0d28], eax
call fcn.1800dbb00
test eax, eax
je 0x1800e6c56
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800e6c63
lea rcx, [0x18015ae08]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800e6c75
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x18016ade8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180141fd0]
mov rcx, rbx
mov qword [0x1801e0978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180142150]
mov rcx, rbx
mov qword [0x1801e0980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016add8]
mov rcx, rbx
mov qword [0x1801e0988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180141f90]
mov rcx, rbx
mov qword [0x1801e0990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1801e0998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1801e09a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180142170]
mov rcx, rbx
mov qword [0x1801e09a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1801e09b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1801e09b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016adb8]
mov rcx, rbx
mov qword [0x1801e09c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1801e09c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad98]
mov rcx, rbx
mov qword [0x1801e09d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1801e09d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad78]
mov rcx, rbx
mov qword [0x1801e09e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad60]
mov rcx, rbx
mov qword [0x1801e09e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad50]
mov rcx, rbx
mov qword [0x1801e09f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1801e09f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad20]
mov rcx, rbx
mov qword [0x1801e0a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ad08]
mov rcx, rbx
mov qword [0x1801e0a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1801e0a10], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015b888]
mov rcx, rbx
mov qword [0x1801e0a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016acf0]
mov rcx, rbx
mov qword [0x1801e0a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016acd8]
mov rcx, rbx
mov qword [0x1801e0a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016acb8]
mov rcx, rbx
mov qword [0x1801e0a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aca8]
mov rcx, rbx
mov qword [0x1801e0a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1801e0a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ac88]
mov rcx, rbx
mov qword [0x1801e0a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ac78]
mov rcx, rbx
mov qword [0x1801e0a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ac68]
mov rcx, rbx
mov qword [0x1801e0a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1801e0a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1801e0a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ac30]
mov rcx, rbx
mov qword [0x1801e0a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ac18]
mov rcx, rbx
mov qword [0x1801e0a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015bbe0]
mov rcx, rbx
mov qword [0x1801e0a80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015bbc8]
mov rcx, rbx
mov qword [0x1801e0a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1801e0a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1801e0a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016abd8]
mov rcx, rbx
mov qword [0x1801e0aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016abc8]
mov rcx, rbx
mov qword [0x1801e0aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016abb8]
mov qword [0x1801e0ab0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aba8]
mov rcx, rbx
mov qword [0x1801e0ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ab98]
mov rcx, rbx
mov qword [0x1801e0ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ab88]
mov rcx, rbx
mov qword [0x1801e0ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1801e0ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1801e0ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ab48]
mov rcx, rbx
mov qword [0x1801e0ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180141f60]
mov rcx, rbx
mov qword [0x1801e0ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1801e0af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1801e0af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1801e0b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1801e0b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1801e0b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016ab00]
mov rcx, rbx
mov qword [0x1801e0b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aae8]
mov rcx, rbx
mov qword [0x1801e0b20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1801e0b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aab8]
mov rcx, rbx
mov qword [0x1801e0b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aaa8]
mov rcx, rbx
mov qword [0x1801e0b38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1801e0b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aa88]
mov rcx, rbx
mov qword [0x1801e0b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1801e0b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aa60]
mov rcx, rbx
mov qword [0x1801e0b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aa48]
mov rcx, rbx
mov qword [0x1801e0b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1801e0b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1801e0b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016aa00]
mov rcx, rbx
mov qword [0x1801e0b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a9e8]
mov rcx, rbx
mov qword [0x1801e0b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a9d8]
mov rcx, rbx
mov qword [0x1801e0b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180141f30]
mov rcx, rbx
mov qword [0x1801e0b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1801e0b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1801e0ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a998]
mov rcx, rbx
mov qword [0x1801e0ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a988]
mov rcx, rbx
mov qword [0x1801e0bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a978]
mov rcx, rbx
mov qword [0x1801e0bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1801e0bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1801e0bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1801e0bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1801e0bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a8f8]
mov rcx, rbx
mov qword [0x1801e0be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a8f8]
mov rcx, rbx
mov qword [0x1801e0be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1801e0bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801e0bf8], rax
lea rdx, [0x18016a8d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a8b8]
mov rcx, rbx
mov qword [0x1801e0c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1801e0c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1801e0c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1801e0c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1801e0c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1801e0c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1801e0c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1801e0c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1801e0c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1801e0c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1801e0c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1801e0c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1801e0c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1801e0c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1801e0c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1801e0c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1801e0c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1801e0c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1801e0c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1801e0c98], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1801e0ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1801e0ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1801e0cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1801e0cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1801e0cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1801e0cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1801e0cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1801e0cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1801e0ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a678]
mov rcx, rbx
mov qword [0x1801e0ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016a668]
mov rcx, rbx
mov qword [0x1801e0cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1801e0cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1801e0d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1801e0d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1801e0d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1801e0d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1801e0d2c], 1
mov qword [0x1801e0d20], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret