Function at 0x180070470
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180123004]
test ecx, ecx
jne 0x180070efe
mov eax, dword [0x180123000]
cmp eax, 3
ja 0x180070efe
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180123000], eax
call fcn.18002c330
test eax, eax
je 0x1800704b6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800704c3
lea rcx, [0x1800c3dc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800704d5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x1800d2ef0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2ee0]
mov rcx, rbx
mov qword [0x180122c80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2ed0]
mov rcx, rbx
mov qword [0x180122c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x180122c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2eb0]
mov rcx, rbx
mov qword [0x180122c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x180122ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x180122ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2e80]
mov rcx, rbx
mov qword [0x180122cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x180122cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x180122cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x180122cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x180122cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x180122cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x180122ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2e10]
mov rcx, rbx
mov qword [0x180122ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2df8]
mov rcx, rbx
mov qword [0x180122cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2de8]
mov rcx, rbx
mov qword [0x180122cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x180122d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2db8]
mov rcx, rbx
mov qword [0x180122d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2da0]
mov rcx, rbx
mov qword [0x180122d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800c3df0]
mov qword [0x180122d18], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800c3dd8]
mov rcx, rbx
mov qword [0x180122d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d88]
mov rcx, rbx
mov qword [0x180122d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d70]
mov rcx, rbx
mov qword [0x180122d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d50]
mov rcx, rbx
mov qword [0x180122d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d40]
mov rcx, rbx
mov qword [0x180122d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x180122d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d20]
mov rcx, rbx
mov qword [0x180122d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x180122d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2d00]
mov rcx, rbx
mov qword [0x180122d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x180122d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x180122d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x180122d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x180122d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x180122d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x180122d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x180122d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x180122da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c70]
mov rcx, rbx
mov qword [0x180122da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c60]
mov rcx, rbx
mov qword [0x180122db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c50]
mov qword [0x180122db8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c40]
mov rcx, rbx
mov qword [0x180122dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c30]
mov rcx, rbx
mov qword [0x180122dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2c20]
mov rcx, rbx
mov qword [0x180122dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x180122dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x180122de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2be0]
mov rcx, rbx
mov qword [0x180122de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2bd0]
mov rcx, rbx
mov qword [0x180122df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x180122df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x180122e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFile2
mov rcx, rbx
mov qword [0x180122e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x180122e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x180122e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2b68]
mov rcx, rbx
mov qword [0x180122e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingW
mov rcx, rbx
mov qword [0x180122e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2b38]
mov rcx, rbx
mov qword [0x180122e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingW
mov rcx, rbx
mov qword [0x180122e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2b10]
mov rcx, rbx
mov qword [0x180122e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x180122e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2af0]
mov rcx, rbx
mov qword [0x180122e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x180122e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2ac8]
mov rcx, rbx
mov qword [0x180122e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2ab0]
mov rcx, rbx
mov qword [0x180122e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x180122e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x180122e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2a68]
mov rcx, rbx
mov qword [0x180122e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2a50]
mov rcx, rbx
mov qword [0x180122e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2a40]
mov rcx, rbx
mov qword [0x180122e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2a30]
mov rcx, rbx
mov qword [0x180122e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x180122ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x180122ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d29f0]
mov rcx, rbx
mov qword [0x180122eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d29e0]
mov rcx, rbx
mov qword [0x180122eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d29d0]
mov rcx, rbx
mov qword [0x180122ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameA
mov rcx, rbx
mov qword [0x180122ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetMappedFileNameW
mov rcx, rbx
mov qword [0x180122ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleA
mov rcx, rbx
mov qword [0x180122ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFinalPathNameByHandleW
mov rcx, rbx
mov qword [0x180122ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2950]
mov rcx, rbx
mov qword [0x180122ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2950]
mov rcx, rbx
mov qword [0x180122ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d2940]
mov rcx, rbx
mov qword [0x180122ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180122f00], rax
lea rdx, [0x1800d2928]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x180122f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x180122f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x180122f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x180122f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32First
mov rcx, rbx
mov qword [0x180122f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x180122f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x180122f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x180122f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x180122f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x180122f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x180122f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x180122f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x180122f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x180122f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x180122f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x180122f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x180122f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x180122f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov rcx, rbx
mov qword [0x180122f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameA
mov qword [0x180122fa0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x180122fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x180122fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x180122fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x180122fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x180122fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x180122fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbx
mov qword [0x180122fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessId
mov rcx, rbx
mov qword [0x180122fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800d26e0]
mov rcx, rbx
mov qword [0x180122fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCommandLineW
mov rcx, rbx
mov qword [0x180122ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x180123004], 1
mov qword [0x180122ff8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret