Function at 0x180063710
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenFile
mov qword [0x180101f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtClose
mov qword [0x180101f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtReadFile
mov qword [0x180101f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtWriteFile
mov qword [0x180101f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryObject
mov qword [0x180101f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x180101f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryDirectoryFileEx
mov qword [0x180101f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryInformationFile
mov qword [0x180101fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSetInformationFile
mov qword [0x180101fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQuerySystemInformation
mov qword [0x180101fb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtDeleteFile
mov qword [0x180101fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x180101fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtDuplicateObject
mov qword [0x180101fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x180101fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x180101fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x180101fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x180101fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x180101ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x180101ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x180102000], rax
mov rcx, qword [0x1801021a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x180102008], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x180102010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateKey
mov qword [0x180102018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenKey
mov qword [0x180102020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryKey
mov qword [0x180102028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryValueKey
mov qword [0x180102030], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x180102038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtEnumerateKey
mov qword [0x180102040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtEnumerateValueKey
mov qword [0x180102048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtFlushKey
mov qword [0x180102050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtDeleteKey
mov qword [0x180102058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtDeleteValueKey
mov qword [0x180102060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSetInformationKey
mov qword [0x180102068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSetValueKey
mov qword [0x180102070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtNotifyChangeKey
mov qword [0x180102078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x180102080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateProcess
mov qword [0x180102088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateProcessEx
mov qword [0x180102090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenProcess
mov qword [0x180102098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
mov qword [0x1801020a0], rax
lea rdx, str.NtTerminateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.LdrShutdownProcess
mov qword [0x1801020a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryInformationProcess
mov qword [0x1801020b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSetInformationProcess
mov qword [0x1801020b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateThread
mov qword [0x1801020c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtOpenThread
mov qword [0x1801020c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSuspendThread
mov qword [0x1801020d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtResumeThread
mov qword [0x1801020d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtTerminateThread
mov qword [0x1801020e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.LdrShutdownThread
mov qword [0x1801020e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryInformationThread
mov qword [0x1801020f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtSetInformationThread
mov qword [0x1801020f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlInitUnicodeString
mov qword [0x180102100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x180102108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x180102110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryAttributesFile
mov qword [0x180102118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x180102120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x180102128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x180102130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x180102138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlInitializeSid
mov qword [0x180102140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x180102148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlCreateAcl
mov qword [0x180102150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x180102158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x180102160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x180102168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x180102170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x180102178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtRenameKey
mov qword [0x180102180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateDirectoryObject
mov qword [0x180102188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801021a0]
lea rdx, str.NtCreateToken
mov qword [0x180102190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180102198], rax
add rsp, 0x28
ret