Function at 0x140168820
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140247d9c]
test ecx, ecx
jne 0x140169338
mov eax, dword [0x140247d98]
cmp eax, 3
ja 0x140169338
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x140247d98], eax
call fcn.140167c60
test eax, eax
je 0x140168866
lea rcx, [0x1401e04b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x140168873
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x140168885
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1401e0e10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0e00]
mov rcx, rbx
mov qword [0x1402479e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0df0]
mov rcx, rbx
mov qword [0x1402479f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0de0]
mov rcx, rbx
mov qword [0x1402479f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0dd0]
mov rcx, rbx
mov qword [0x140247a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x140247a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x140247a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0da0]
mov rcx, rbx
mov qword [0x140247a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x140247a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x140247a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0d70]
mov rcx, rbx
mov qword [0x140247a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x140247a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0d50]
mov rcx, rbx
mov qword [0x140247a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x140247a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0d30]
mov rcx, rbx
mov qword [0x140247a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0d18]
mov rcx, rbx
mov qword [0x140247a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0d08]
mov rcx, rbx
mov qword [0x140247a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x140247a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0cd8]
mov rcx, rbx
mov qword [0x140247a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesW
mov rcx, rbx
mov qword [0x140247a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0ca8]
mov qword [0x140247a80], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x140247a88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x140247a90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesW
mov rcx, rbx
mov qword [0x140247a98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileInformationByHandle
mov rcx, rbx
mov qword [0x140247aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0c30]
mov rcx, rbx
mov qword [0x140247aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0c20]
mov rcx, rbx
mov qword [0x140247ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0c10]
mov rcx, rbx
mov qword [0x140247ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x140247ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0bf0]
mov rcx, rbx
mov qword [0x140247ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x140247ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x140247ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0bb8]
mov rcx, rbx
mov qword [0x140247ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x140247ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x140247af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x140247af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x140247b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x140247b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0b30]
mov rcx, rbx
mov qword [0x140247b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileW
mov rcx, rbx
mov qword [0x140247b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x140247b20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileW
mov rcx, rbx
mov qword [0x140247b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x140247b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExW
mov rcx, rbx
mov qword [0x140247b38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x140247b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x140247b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0aa0]
mov rcx, rbx
mov qword [0x140247b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileW
mov rcx, rbx
mov qword [0x140247b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x140247b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x140247b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x140247b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x140247b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x140247b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x140247b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x140247b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x140247b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x140247ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFile
mov rcx, rbx
mov qword [0x140247ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x140247bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnmapViewOfFile
mov rcx, rbx
mov qword [0x140247bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x140247bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x140247bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryW
mov rcx, rbx
mov qword [0x140247bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x140247bd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x140247be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x140247be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryW
mov rcx, rbx
mov qword [0x140247bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0900]
mov rcx, rbx
mov qword [0x140247bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileW
mov rcx, rbx
mov qword [0x140247c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x140247c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x140247c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x140247c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileW
mov rcx, rbx
mov qword [0x140247c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0890]
mov rcx, rbx
mov qword [0x140247c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x140247c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x140247c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x140247c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x140247c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x140247c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessW
mov rcx, rbx
mov qword [0x140247c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x140247c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140247c68], rax
lea rdx, str.OpenProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e07d0]
mov rcx, rbx
mov qword [0x140247c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x140247c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x140247c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x140247c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x140247c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x140247c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x140247ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x140247ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x140247cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x140247cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x140247cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x140247cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x140247cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x140247cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x140247ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x140247ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x140247cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x140247cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x140247d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x140247d08], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x140247d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x140247d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x140247d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x140247d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x140247d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x140247d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x140247d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x140247d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x140247d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0580]
mov rcx, rbx
mov qword [0x140247d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0570]
mov rcx, rbx
mov qword [0x140247d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x140247d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x140247d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1401e0520]
mov rcx, rbx
mov qword [0x140247d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x140247d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x140247d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x140247d9c], 1
mov qword [0x140247d90], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret