Function at 0x1800e0c20
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rdx, [0x1801be118]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7d0], rax
lea rdx, [0x1801be108]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7d8], rax
lea rdx, [0x1801be100]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7e0], rax
lea rdx, [0x1801be240]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7e8], rax
lea rdx, [0x1801be230]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7f0], rax
lea rdx, [0x1801be2c8]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7f8], rax
lea rdx, [0x1801be290]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a800], rax
lea rdx, [0x1801be278]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a808], rax
lea rdx, [0x1801be2d8]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a810], rax
lea rdx, [0x1801be260]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a818], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a820], rax
lea rdx, [0x1801be250]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a828], rax
lea rdx, [0x1801be200]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a830], rax
lea rdx, str.NtDuplicateObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a838], rax
lea rdx, str.RtlInitializeCriticalSection
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a840], rax
lea rdx, str.RtlDeleteCriticalSection
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a848], rax
lea rdx, str.RtlEnterCriticalSection
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a850], rax
lea rdx, str.RtlLeaveCriticalSection
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a858], rax
lea rdx, str.RtlTryEnterCriticalSection
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a860], rax
lea rdx, str.NtOpenDirectoryObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a868], rax
lea rdx, str.NtQueryDirectoryObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a870], rax
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a878], rax
lea rdx, str.NtQuerySymbolicLinkObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a880], rax
lea rdx, str.NtCreateKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a888], rax
lea rdx, str.NtOpenKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a890], rax
lea rdx, str.NtQueryKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a898], rax
lea rdx, str.NtQueryValueKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8a0], rax
lea rdx, str.NtQueryMultipleValueKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8a8], rax
lea rdx, str.NtEnumerateKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8b0], rax
lea rdx, str.NtEnumerateValueKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8b8], rax
lea rdx, str.NtFlushKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8c0], rax
lea rdx, str.NtDeleteKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8c8], rax
lea rdx, str.NtDeleteValueKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8d0], rax
lea rdx, str.NtSetInformationKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8d8], rax
lea rdx, str.NtSetValueKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8e0], rax
lea rdx, str.NtNotifyChangeKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8e8], rax
lea rdx, str.NtNotifyChangeMultipleKeys
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8f0], rax
lea rdx, str.NtCreateProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a8f8], rax
lea rdx, str.NtCreateProcessEx
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a900], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a908], rax
lea rdx, str.NtTerminateProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a910], rax
lea rdx, str.LdrShutdownProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a918], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a920], rax
lea rdx, str.NtSetInformationProcess
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a928], rax
lea rdx, str.NtCreateThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a930], rax
lea rdx, str.NtOpenThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a938], rax
lea rdx, str.NtSuspendThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a940], rax
lea rdx, str.NtResumeThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a948], rax
lea rdx, str.NtTerminateThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a950], rax
lea rdx, str.LdrShutdownThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a958], rax
lea rdx, str.NtQueryInformationThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a960], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a968], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a970], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a978], rax
lea rdx, str.RtlDosPathNameToNtPathName_U
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a980], rax
lea rdx, [0x1801be2f0]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a988], rax
lea rdx, [0x1801be308]
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a990], rax
lea rdx, str.RtlConvertSidToUnicodeString
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a998], rax
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9a0], rax
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9a8], rax
lea rdx, str.RtlInitializeSid
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9b0], rax
lea rdx, str.RtlSubAuthoritySid
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9b8], rax
lea rdx, str.RtlCreateAcl
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9c0], rax
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9c8], rax
lea rdx, str.RtlGetCurrentDirectory_U
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9d0], rax
lea rdx, str.RtlSetCurrentDirectory_U
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9d8], rax
lea rdx, str.RtlGetFullPathName_U
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9e0], rax
lea rdx, str.RtlFormatCurrentUserKeyPath
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9e8], rax
lea rdx, str.NtRenameKey
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9f0], rax
lea rdx, str.NtCreateDirectoryObject
mov rcx, qword [0x18023aa00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a9f8], rax
add rsp, 0x28
ret