Function at 0x180066c80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800f0a7c]
test ecx, ecx
jne 0x180067798
mov eax, dword [0x1800f0a78]
cmp eax, 3
ja 0x180067798
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800f0a78], eax
call fcn.18001c810
test eax, eax
je 0x180066cc6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180066cd3
lea rcx, [0x1800a8828]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180066ce5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1800b1a30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1a20]
mov rcx, rbx
mov qword [0x1800f06c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1a10]
mov rcx, rbx
mov qword [0x1800f06d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800f06d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b19f0]
mov rcx, rbx
mov qword [0x1800f06e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800f06e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800f06f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b19c0]
mov rcx, rbx
mov qword [0x1800f06f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800f0700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800f0708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800f0710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800f0718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800f0720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800f0728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1950]
mov rcx, rbx
mov qword [0x1800f0730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1938]
mov rcx, rbx
mov qword [0x1800f0738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1928]
mov rcx, rbx
mov qword [0x1800f0740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800f0748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b18f8]
mov rcx, rbx
mov qword [0x1800f0750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b18e0]
mov rcx, rbx
mov qword [0x1800f0758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800a9100]
mov qword [0x1800f0760], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800a90e8]
mov rcx, rbx
mov qword [0x1800f0768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b18c8]
mov rcx, rbx
mov qword [0x1800f0770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b18b0]
mov rcx, rbx
mov qword [0x1800f0778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1890]
mov rcx, rbx
mov qword [0x1800f0780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1880]
mov rcx, rbx
mov qword [0x1800f0788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800f0790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800f0798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800f07a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1840]
mov rcx, rbx
mov qword [0x1800f07a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800f07b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800f07b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800f07c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800f07c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800f07d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800f07d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800f07e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800f07e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b17b0]
mov rcx, rbx
mov qword [0x1800f07f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b17a0]
mov rcx, rbx
mov qword [0x1800f07f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1790]
mov qword [0x1800f0800], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1780]
mov rcx, rbx
mov qword [0x1800f0808], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1770]
mov rcx, rbx
mov qword [0x1800f0810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1760]
mov rcx, rbx
mov qword [0x1800f0818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800f0820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800f0828], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1720]
mov rcx, rbx
mov qword [0x1800f0830], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1710]
mov rcx, rbx
mov qword [0x1800f0838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800f0840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800f0848], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800f0850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800f0858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800f0860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b16a8]
mov rcx, rbx
mov qword [0x1800f0868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x1800f0870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1678]
mov rcx, rbx
mov qword [0x1800f0878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x1800f0880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1650]
mov rcx, rbx
mov qword [0x1800f0888], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800f0890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1630]
mov rcx, rbx
mov qword [0x1800f0898], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800f08a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1608]
mov rcx, rbx
mov qword [0x1800f08a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b15f0]
mov rcx, rbx
mov qword [0x1800f08b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800f08b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800f08c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b15a8]
mov rcx, rbx
mov qword [0x1800f08c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1590]
mov rcx, rbx
mov qword [0x1800f08d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1580]
mov rcx, rbx
mov qword [0x1800f08d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1570]
mov rcx, rbx
mov qword [0x1800f08e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800f08e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800f08f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1530]
mov rcx, rbx
mov qword [0x1800f08f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1520]
mov rcx, rbx
mov qword [0x1800f0900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1510]
mov rcx, rbx
mov qword [0x1800f0908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800f0910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800f0918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800f0920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800f0928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1490]
mov rcx, rbx
mov qword [0x1800f0930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1490]
mov rcx, rbx
mov qword [0x1800f0938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800f0940], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f0948], rax
lea rdx, [0x1800b1468]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1450]
mov rcx, rbx
mov qword [0x1800f0950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800f0958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800f0960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800f0968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1800f0970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800f0978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800f0980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800f0988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800f0990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800f0998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1800f09a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800f09a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1800f09b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800f09b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800f09c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800f09c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800f09d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800f09d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800f09e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800f09e8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800f09f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800f09f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800f0a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800f0a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800f0a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800f0a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800f0a20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800f0a28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800f0a30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1210]
mov rcx, rbx
mov qword [0x1800f0a38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800b1200]
mov rcx, rbx
mov qword [0x1800f0a40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800f0a48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800f0a50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800f0a58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800f0a60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800f0a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800f0a7c], 1
mov qword [0x1800f0a70], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret