Function at 0x180026e00
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800d1e54]
test ecx, ecx
jne 0x180027918
mov eax, dword [0x1800d1e50]
cmp eax, 3
ja 0x180027918
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800d1e50], eax
call fcn.180045950
test eax, eax
je 0x180026e46
lea rcx, [0x1800958f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180026e53
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180026e65
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x18007e2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e2a0]
mov rcx, rbx
mov qword [0x1800d1aa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e290]
mov rcx, rbx
mov qword [0x1800d1aa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800d1ab0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e270]
mov rcx, rbx
mov qword [0x1800d1ab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800d1ac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800d1ac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e240]
mov rcx, rbx
mov qword [0x1800d1ad0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800d1ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800d1ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800d1ae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800d1af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800d1af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800d1b00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e1d0]
mov rcx, rbx
mov qword [0x1800d1b08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e1b8]
mov rcx, rbx
mov qword [0x1800d1b10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e1a8]
mov rcx, rbx
mov qword [0x1800d1b18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800d1b20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesA
mov rcx, rbx
mov qword [0x1800d1b28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e160]
mov rcx, rbx
mov qword [0x1800d1b30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800d1b38], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x1800d1b40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x1800d1b48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e130]
mov rcx, rbx
mov qword [0x1800d1b50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e110]
mov rcx, rbx
mov qword [0x1800d1b58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e100]
mov rcx, rbx
mov qword [0x1800d1b60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800d1b68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800d1b70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800d1b78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e0c0]
mov rcx, rbx
mov qword [0x1800d1b80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800d1b88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800d1b90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800d1b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800d1ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800d1ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800d1bb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800d1bb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800d1bc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [0x1800d1bc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e020]
mov rcx, rbx
mov qword [0x1800d1bd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x1800d1bd8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e000]
mov rcx, rbx
mov qword [0x1800d1be0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x1800d1be8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dfe0]
mov rcx, rbx
mov qword [0x1800d1bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800d1bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800d1c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x1800d1c08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007df90]
mov rcx, rbx
mov qword [0x1800d1c10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800d1c18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800d1c20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800d1c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800d1c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800d1c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800d1c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007df10]
mov rcx, rbx
mov qword [0x1800d1c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800d1c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dee0]
mov rcx, rbx
mov qword [0x1800d1c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ded0]
mov rcx, rbx
mov qword [0x1800d1c60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800d1c68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007deb0]
mov rcx, rbx
mov qword [0x1800d1c70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800d1c78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x1800d1c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007de70]
mov rcx, rbx
mov qword [0x1800d1c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800d1c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800d1c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x1800d1ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007de10]
mov rcx, rbx
mov qword [0x1800d1ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileA
mov rcx, rbx
mov qword [0x1800d1cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ddf0]
mov rcx, rbx
mov qword [0x1800d1cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800d1cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800d1cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x1800d1cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dda0]
mov rcx, rbx
mov qword [0x1800d1cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dd90]
mov rcx, rbx
mov qword [0x1800d1ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800d1ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800d1cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800d1cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800d1d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dd10]
mov rcx, rbx
mov qword [0x1800d1d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dd10]
mov rcx, rbx
mov qword [0x1800d1d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800d1d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800d1d20], rax
lea rdx, [0x18007dce8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dcd0]
mov rcx, rbx
mov qword [0x1800d1d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800d1d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800d1d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800d1d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1800d1d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800d1d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800d1d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800d1d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800d1d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800d1d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1800d1d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800d1d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1800d1d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800d1d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800d1d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800d1da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800d1da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800d1db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800d1db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800d1dc0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800d1dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800d1dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800d1dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800d1de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d1de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d1df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800d1df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800d1e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800d1e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dac0]
mov rcx, rbx
mov qword [0x1800d1e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007dab0]
mov rcx, rbx
mov qword [0x1800d1e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800d1e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800d1e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800d1e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800d1e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800d1e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800d1e54], 1
mov qword [0x1800d1e48], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret