Function at 0x180002370
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x1800023ad
mov r9d, 0x10
lea r8, str.Failure
lea rdx, str.Failed_to_get_a_handle_for__ntdll.dll_
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180032098], rax
test rax, rax
je 0x180002c74
mov qword [rsp + 0x30], rsi
lea rdx, str.NtOpenProcess
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rsi, [0x180031080]
mov rdi, rax
test rax, rax
je 0x180002442
lea r8, [0x1800320e0]
mov rdx, rax
lea rcx, section..text
call fcn.180002f10
test eax, eax
je 0x180002442
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320e0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtSuspendProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002499
lea r8, [0x180032160]
mov rdx, rax
lea rcx, [0x1800010b0]
call fcn.180002f10
test eax, eax
je 0x180002499
mov ecx, dword [0x180032080]
mov rax, qword [0x180032160]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtResumeProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800024f0
lea r8, [0x1800320e8]
mov rdx, rax
lea rcx, [0x180001150]
call fcn.180002f10
test eax, eax
je 0x1800024f0
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320e8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtQuerySystemInformationEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002547
lea r8, [0x1800320d8]
mov rdx, rax
lea rcx, [0x1800011f0]
call fcn.180002f10
test eax, eax
je 0x180002547
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320d8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000259e
lea r8, [0x1800320d0]
mov rdx, rax
lea rcx, [0x180001300]
call fcn.180002f10
test eax, eax
je 0x18000259e
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320d0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtSetInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800025f5
lea r8, [0x180032130]
mov rdx, rax
lea rcx, [0x1800013e0]
call fcn.180002f10
test eax, eax
je 0x1800025f5
mov ecx, dword [0x180032080]
mov rax, qword [0x180032130]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtFlushInstructionCache
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000264c
lea r8, [0x1800320b8]
mov rdx, rax
lea rcx, [0x1800014a0]
call fcn.180002f10
test eax, eax
je 0x18000264c
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320b8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800026a3
lea r8, [0x180032110]
mov rdx, rax
lea rcx, [0x180001560]
call fcn.180002f10
test eax, eax
je 0x1800026a3
mov ecx, dword [0x180032080]
mov rax, qword [0x180032110]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800026fa
lea r8, [0x1800320f8]
mov rdx, rax
lea rcx, [0x180001580]
call fcn.180002f10
test eax, eax
je 0x1800026fa
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320f8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtFlushVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002751
lea r8, [0x180032148]
mov rdx, rax
lea rcx, [0x180001680]
call fcn.180002f10
test eax, eax
je 0x180002751
mov ecx, dword [0x180032080]
mov rax, qword [0x180032148]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtFreeVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800027a8
lea r8, [0x1800320a0]
mov rdx, rax
lea rcx, [0x180001750]
call fcn.180002f10
test eax, eax
je 0x1800027a8
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320a0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtLockVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800027ff
lea r8, [0x180032100]
mov rdx, rax
lea rcx, [0x180001820]
call fcn.180002f10
test eax, eax
je 0x1800027ff
mov ecx, dword [0x180032080]
mov rax, qword [0x180032100]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtUnlockVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002856
lea r8, [0x180032118]
mov rdx, rax
lea rcx, [0x1800018f0]
call fcn.180002f10
test eax, eax
je 0x180002856
mov ecx, dword [0x180032080]
mov rax, qword [0x180032118]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800028ad
lea r8, [0x180032120]
mov rdx, rax
lea rcx, [0x1800019c0]
call fcn.180002f10
test eax, eax
je 0x1800028ad
mov ecx, dword [0x180032080]
mov rax, qword [0x180032120]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtReadVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002904
lea r8, [0x180032108]
mov rdx, rax
lea rcx, [0x180001aa0]
call fcn.180002f10
test eax, eax
je 0x180002904
mov ecx, dword [0x180032080]
mov rax, qword [0x180032108]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18000295b
lea r8, [0x180032140]
mov rdx, rax
lea rcx, [0x180001b80]
call fcn.180002f10
test eax, eax
je 0x18000295b
mov ecx, dword [0x180032080]
mov rax, qword [0x180032140]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtQueryVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x1800029b2
lea r8, [0x1800320c0]
mov rdx, rax
lea rcx, [0x180001c60]
call fcn.180002f10
test eax, eax
je 0x1800029b2
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320c0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtOpenThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002a09
lea r8, [0x1800320a8]
mov rdx, rax
lea rcx, [0x180001d60]
call fcn.180002f10
test eax, eax
je 0x180002a09
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320a8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002a60
lea r8, [0x180032138]
mov rdx, rax
lea rcx, [0x180001e30]
call fcn.180002f10
test eax, eax
je 0x180002a60
mov ecx, dword [0x180032080]
mov rax, qword [0x180032138]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtSetInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002ab7
lea r8, [0x1800320f0]
mov rdx, rax
lea rcx, [0x180001f10]
call fcn.180002f10
test eax, eax
je 0x180002ab7
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320f0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtGetContextThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002b0e
lea r8, [0x1800320b0]
mov rdx, rax
lea rcx, [0x180001fd0]
call fcn.180002f10
test eax, eax
je 0x180002b0e
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320b0]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtSetContextThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002b65
lea r8, [0x180032128]
mov rdx, rax
lea rcx, [0x180002090]
call fcn.180002f10
test eax, eax
je 0x180002b65
mov ecx, dword [0x180032080]
mov rax, qword [0x180032128]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtSuspendThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002bbc
lea r8, [0x1800320c8]
mov rdx, rax
lea rcx, [0x180002210]
call fcn.180002f10
test eax, eax
je 0x180002bbc
mov ecx, dword [0x180032080]
mov rax, qword [0x1800320c8]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtResumeThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180002c13
lea r8, [0x180032158]
mov rdx, rax
lea rcx, [0x180002150]
call fcn.180002f10
test eax, eax
je 0x180002c13
mov ecx, dword [0x180032080]
mov rax, qword [0x180032158]
mov qword [rsi + rcx*8], rdi
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
lea rdx, str.NtWaitForSingleObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, qword [rsp + 0x38]
mov rbx, rax
test rax, rax
je 0x180002c6f
lea r8, [0x180032150]
mov rdx, rax
lea rcx, [0x1800022d0]
call fcn.180002f10
test eax, eax
je 0x180002c6f
mov ecx, dword [0x180032080]
mov rax, qword [0x180032150]
mov qword [rsi + rcx*8], rbx
mov ecx, dword [0x180032080]
mov qword [rsi + rcx*8 + 0x800], rax
inc dword [0x180032080]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret