Function at 0x1800169c0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rdx, str.NtCreateFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a88], rax
lea rdx, str.NtOpenFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a90], rax
lea rdx, str.NtClose
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252a98], rax
lea rdx, str.NtReadFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252aa0], rax
lea rdx, str.NtWriteFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252aa8], rax
lea rdx, str.NtQueryObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ab0], rax
lea rdx, str.NtQueryDirectoryFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ab8], rax
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ac0], rax
lea rdx, str.NtQueryInformationFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ac8], rax
lea rdx, str.NtSetInformationFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ad0], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ad8], rax
lea rdx, str.NtDeleteFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ae0], rax
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ae8], rax
lea rdx, str.NtDuplicateObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252af0], rax
lea rdx, str.RtlInitializeCriticalSection
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252af8], rax
lea rdx, str.RtlDeleteCriticalSection
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b00], rax
lea rdx, str.RtlEnterCriticalSection
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b08], rax
lea rdx, str.RtlLeaveCriticalSection
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b10], rax
lea rdx, str.RtlTryEnterCriticalSection
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b18], rax
lea rdx, str.NtOpenDirectoryObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b20], rax
lea rdx, str.NtQueryDirectoryObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b28], rax
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b30], rax
lea rdx, str.NtQuerySymbolicLinkObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b38], rax
lea rdx, str.NtCreateKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b40], rax
lea rdx, str.NtOpenKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b48], rax
lea rdx, str.NtQueryKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b50], rax
lea rdx, str.NtQueryValueKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b58], rax
lea rdx, str.NtQueryMultipleValueKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b60], rax
lea rdx, str.NtEnumerateKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b68], rax
lea rdx, str.NtEnumerateValueKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b70], rax
lea rdx, str.NtFlushKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b78], rax
lea rdx, str.NtDeleteKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b80], rax
lea rdx, str.NtDeleteValueKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b88], rax
lea rdx, str.NtSetInformationKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b90], rax
lea rdx, str.NtSetValueKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252b98], rax
lea rdx, str.NtNotifyChangeKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ba0], rax
lea rdx, str.NtNotifyChangeMultipleKeys
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ba8], rax
lea rdx, str.NtCreateProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bb0], rax
lea rdx, str.NtCreateProcessEx
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bb8], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bc0], rax
lea rdx, str.NtTerminateProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bc8], rax
lea rdx, str.LdrShutdownProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bd0], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bd8], rax
lea rdx, str.NtSetInformationProcess
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252be0], rax
lea rdx, str.NtCreateThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252be8], rax
lea rdx, str.NtOpenThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bf0], rax
lea rdx, str.NtSuspendThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252bf8], rax
lea rdx, str.NtResumeThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c00], rax
lea rdx, str.NtTerminateThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c08], rax
lea rdx, str.LdrShutdownThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c10], rax
lea rdx, str.NtQueryInformationThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c18], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c20], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c28], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c30], rax
lea rdx, str.RtlDosPathNameToNtPathName_U
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c38], rax
lea rdx, str.NtQueryAttributesFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c40], rax
lea rdx, str.NtQueryFullAttributesFile
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c48], rax
lea rdx, str.RtlConvertSidToUnicodeString
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c50], rax
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c58], rax
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c60], rax
lea rdx, str.RtlInitializeSid
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c68], rax
lea rdx, str.RtlSubAuthoritySid
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c70], rax
lea rdx, str.RtlCreateAcl
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c78], rax
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c80], rax
lea rdx, str.RtlGetCurrentDirectory_U
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c88], rax
lea rdx, str.RtlSetCurrentDirectory_U
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c90], rax
lea rdx, str.RtlGetFullPathName_U
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252c98], rax
lea rdx, str.RtlFormatCurrentUserKeyPath
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ca0], rax
lea rdx, str.NtRenameKey
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252ca8], rax
lea rdx, str.NtCreateDirectoryObject
mov rcx, qword [0x180252cb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180252cb0], rax
add rsp, 0x20
pop rdi
ret