Function at 0x18002c9c0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800e14ec]
test ecx, ecx
jne 0x18002d51d
mov eax, dword [0x1800e14e8]
cmp eax, 3
ja 0x18002d51d
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800e14e8], eax
call fcn.18004b8e0
test eax, eax
je 0x18002ca06
lea rcx, [0x1800a0a18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18002ca13
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18002ca25
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x180088a00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800889f0]
mov rcx, rbx
mov qword [0x1800e1120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800889e0]
mov rcx, rbx
mov qword [0x1800e1128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800e1130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800889c0]
mov rcx, rbx
mov qword [0x1800e1138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800e1140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800e1148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088990]
mov rcx, rbx
mov qword [0x1800e1150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800e1158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800e1160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800e1168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800e1170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800e1178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800e1180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088920]
mov rcx, rbx
mov qword [0x1800e1188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088908]
mov rcx, rbx
mov qword [0x1800e1190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800888f8]
mov rcx, rbx
mov qword [0x1800e1198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800e11a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesA
mov rcx, rbx
mov qword [0x1800e11a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800888b0]
mov rcx, rbx
mov qword [0x1800e11b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800e11b8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x1800e11c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x1800e11c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088880]
mov rcx, rbx
mov qword [0x1800e11d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088860]
mov rcx, rbx
mov qword [0x1800e11d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088850]
mov rcx, rbx
mov qword [0x1800e11e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800e11e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800e11f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800e11f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088810]
mov rcx, rbx
mov qword [0x1800e1200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800e1208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800e1210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800e1218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800e1220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800e1228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800e1230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800e1238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800e1240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [0x1800e1248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088770]
mov rcx, rbx
mov qword [0x1800e1250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x1800e1258], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088750]
mov rcx, rbx
mov qword [0x1800e1260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x1800e1268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088730]
mov rcx, rbx
mov qword [0x1800e1270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800e1278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800e1280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x1800e1288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800886e0]
mov rcx, rbx
mov qword [0x1800e1290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800e1298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800e12a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x1800e12a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800e12b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800e12b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800e12c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088660]
mov rcx, rbx
mov qword [0x1800e12c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800e12d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088630]
mov rcx, rbx
mov qword [0x1800e12d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088620]
mov rcx, rbx
mov qword [0x1800e12e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800e12e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088600]
mov rcx, rbx
mov qword [0x1800e12f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800e12f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x1800e1300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800885c0]
mov rcx, rbx
mov qword [0x1800e1308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800e1310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800e1318], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x1800e1320], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088560]
mov rcx, rbx
mov qword [0x1800e1328], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileA
mov rcx, rbx
mov qword [0x1800e1330], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088540]
mov rcx, rbx
mov qword [0x1800e1338], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800e1340], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800e1348], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x1800e1350], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800884f0]
mov rcx, rbx
mov qword [0x1800e1358], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800884e0]
mov rcx, rbx
mov qword [0x1800e1360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800e1368], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800e1370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x1800e1378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x1800e1380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088460]
mov rcx, rbx
mov qword [0x1800e1388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088450]
mov rcx, rbx
mov qword [0x1800e1390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessInternalW
mov rcx, rbx
mov qword [0x1800e1398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e13a0], rax
lea rdx, [0x180088428]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088410]
mov rcx, rbx
mov qword [0x1800e13a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800e13b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800e13b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800e13c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800883d0]
mov rcx, rbx
mov qword [0x1800e13c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x1800e13d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800e13d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800e13e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800e13e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800e13f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088370]
mov rcx, rbx
mov qword [0x1800e13f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800e1400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088350]
mov rcx, rbx
mov qword [0x1800e1408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800e1410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800e1418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800e1420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800e1428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800e1430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800e1438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov qword [0x1800e1440], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800e1448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800e1450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800e1458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800e1460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800e1468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800e1470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800e1478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x1800e1480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x1800e1488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180088200]
mov rcx, rbx
mov qword [0x1800e1490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800881f0]
mov rcx, rbx
mov qword [0x1800e1498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x1800e14a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetQueuedCompletionStatus
mov rcx, rbx
mov qword [0x1800e14a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rbx
mov qword [0x1800e14b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackagePathByFullName
mov rcx, rbx
mov qword [0x1800e14b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetPackageFullName
mov rcx, rbx
mov qword [0x1800e14c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleHandleExA
mov rcx, rbx
mov qword [0x1800e14c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleHandleExW
mov rcx, rbx
mov qword [0x1800e14d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMitigationPolicy
mov rcx, rbx
mov qword [0x1800e14d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1800e14ec], 1
mov qword [0x1800e14e0], rax
mov eax, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret