Function at 0x18003c880
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800a3564]
test ecx, ecx
jne 0x18003d228
mov eax, dword [0x1800a3560]
cmp eax, 3
ja 0x18003d228
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800a3560], eax
call fcn.1800133d0
test eax, eax
je 0x18003c8c6
lea rcx, [0x180075d60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18003c8d3
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18003c8e5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, [0x180069670]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069660]
mov rcx, rbx
mov qword [0x1800a3230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069650]
mov rcx, rbx
mov qword [0x1800a3238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateHandle
mov rcx, rbx
mov qword [0x1800a3240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069630]
mov rcx, rbx
mov qword [0x1800a3248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileEx
mov rcx, rbx
mov qword [0x1800a3250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReadFileScatter
mov rcx, rbx
mov qword [0x1800a3258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069600]
mov rcx, rbx
mov qword [0x1800a3260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileEx
mov rcx, rbx
mov qword [0x1800a3268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WriteFileGather
mov rcx, rbx
mov qword [0x1800a3270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFile
mov rcx, rbx
mov qword [0x1800a3278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LockFileEx
mov rcx, rbx
mov qword [0x1800a3280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFile
mov rcx, rbx
mov qword [0x1800a3288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnlockFileEx
mov rcx, rbx
mov qword [0x1800a3290], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069590]
mov rcx, rbx
mov qword [0x1800a3298], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069578]
mov rcx, rbx
mov qword [0x1800a32a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069568]
mov rcx, rbx
mov qword [0x1800a32a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFilePointerEx
mov rcx, rbx
mov qword [0x1800a32b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesA
mov rcx, rbx
mov qword [0x1800a32b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069520]
mov rcx, rbx
mov qword [0x1800a32c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov qword [0x1800a32c8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rbx
mov qword [0x1800a32d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileAttributesA
mov rcx, rbx
mov qword [0x1800a32d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800694f0]
mov rcx, rbx
mov qword [0x1800a32e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800694d0]
mov rcx, rbx
mov qword [0x1800a32e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800694c0]
mov rcx, rbx
mov qword [0x1800a32f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSizeEx
mov rcx, rbx
mov qword [0x1800a32f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileTime
mov rcx, rbx
mov qword [0x1800a3300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileTime
mov rcx, rbx
mov qword [0x1800a3308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069480]
mov rcx, rbx
mov qword [0x1800a3310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeA
mov rcx, rbx
mov qword [0x1800a3318], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetBinaryTypeW
mov rcx, rbx
mov qword [0x1800a3320], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameA
mov rcx, rbx
mov qword [0x1800a3328], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFullPathNameW
mov rcx, rbx
mov qword [0x1800a3330], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameA
mov rcx, rbx
mov qword [0x1800a3338], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLongPathNameW
mov rcx, rbx
mov qword [0x1800a3340], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameA
mov rcx, rbx
mov qword [0x1800a3348], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetShortPathNameW
mov rcx, rbx
mov qword [0x1800a3350], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [0x1800a3358], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800693e0]
mov rcx, rbx
mov qword [0x1800a3360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileA
mov qword [0x1800a3368], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800693c0]
mov rcx, rbx
mov qword [0x1800a3370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExA
mov rcx, rbx
mov qword [0x1800a3378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileExW
mov rcx, rbx
mov qword [0x1800a3380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressA
mov rcx, rbx
mov qword [0x1800a3388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MoveFileWithProgressW
mov rcx, rbx
mov qword [0x1800a3390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x1800a3398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069350]
mov rcx, rbx
mov qword [0x1800a33a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExA
mov rcx, rbx
mov qword [0x1800a33a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileExW
mov rcx, rbx
mov qword [0x1800a33b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileA
mov rcx, rbx
mov qword [0x1800a33b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReplaceFileW
mov rcx, rbx
mov qword [0x1800a33c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateFileMappingA
mov rcx, rbx
mov qword [0x1800a33c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800692e0]
mov rcx, rbx
mov qword [0x1800a33d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenFileMappingA
mov rcx, rbx
mov qword [0x1800a33d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800692b0]
mov rcx, rbx
mov qword [0x1800a33e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800692a0]
mov rcx, rbx
mov qword [0x1800a33e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.MapViewOfFileEx
mov rcx, rbx
mov qword [0x1800a33f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069280]
mov rcx, rbx
mov qword [0x1800a33f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FlushViewOfFile
mov rcx, rbx
mov qword [0x1800a3400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryA
mov rcx, rbx
mov qword [0x1800a3408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069240]
mov rcx, rbx
mov qword [0x1800a3410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExA
mov rcx, rbx
mov qword [0x1800a3418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateDirectoryExW
mov rcx, rbx
mov qword [0x1800a3420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveDirectoryA
mov rcx, rbx
mov qword [0x1800a3428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800691e0]
mov rcx, rbx
mov qword [0x1800a3430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileA
mov rcx, rbx
mov qword [0x1800a3438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800691c0]
mov rcx, rbx
mov qword [0x1800a3440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExA
mov rcx, rbx
mov qword [0x1800a3448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
mov qword [0x1800a3450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FindNextFileA
mov rcx, rbx
mov qword [0x1800a3458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069170]
mov rcx, rbx
mov qword [0x1800a3460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069160]
mov rcx, rbx
mov qword [0x1800a3468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069150]
mov rcx, rbx
mov qword [0x1800a3470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069150]
mov rcx, rbx
mov qword [0x1800a3478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069140]
mov rcx, rbx
mov qword [0x1800a3480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180069128]
mov rcx, rbx
mov qword [0x1800a3488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ProcessIdToSessionId
mov rcx, rbx
mov qword [0x1800a3490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenThread
mov rcx, rbx
mov qword [0x1800a3498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SwitchToThread
mov rcx, rbx
mov qword [0x1800a34a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
mov qword [0x1800a34a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a34b0], rax
lea rdx, str.Heap32First
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListFirst
mov rcx, rbx
mov qword [0x1800a34b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32ListNext
mov rcx, rbx
mov qword [0x1800a34c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Heap32Next
mov rcx, rbx
mov qword [0x1800a34c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rbx
mov qword [0x1800a34d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32FirstW
mov rcx, rbx
mov qword [0x1800a34d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rbx
mov qword [0x1800a34e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32NextW
mov rcx, rbx
mov qword [0x1800a34e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rbx
mov qword [0x1800a34f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov qword [0x1800a34f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rbx
mov qword [0x1800a3500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov qword [0x1800a3508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32First
mov rcx, rbx
mov qword [0x1800a3510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Thread32Next
mov rcx, rbx
mov qword [0x1800a3518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Toolhelp32ReadProcessMemory
mov rcx, rbx
mov qword [0x1800a3520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GlobalMemoryStatusEx
mov rcx, rbx
mov qword [0x1800a3528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process
mov rcx, rbx
mov qword [0x1800a3530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800a3538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rbx
mov qword [0x1800a3540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x1800a3548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSGetActiveConsoleSessionId
mov qword [0x1800a3550], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800a3564], 1
mov qword [0x1800a3558], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret