Function at 0x180006610
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
lea rcx, vtable.Nt::NtApi.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x38], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x48], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x58], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x68], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x70], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x78], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x80], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x88], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x90], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x98], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xa8], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xb0], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xb8], 0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0xc0], 0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 8], rax
lea rdx, str.NtClose
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x10], rax
lea rdx, str.NtCreateFile
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x18], rax
lea rdx, str.NtCreateKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
lea rdx, str.NtCreateKeyTransacted
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x28], rax
lea rdx, str.NtCreateWnfStateName
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, str.NtDeleteKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x38], rax
lea rdx, str.NtDeleteFile
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x40], rax
lea rdx, str.NtDeleteValueKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x48], rax
lea rdx, str.NtDeleteWnfStateName
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x50], rax
lea rdx, str.NtEnumerateKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x58], rax
lea rdx, str.NtEnumerateValueKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x60], rax
lea rdx, str.NtFlushKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x68], rax
lea rdx, str.NtNotifyChangeKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x70], rax
lea rdx, str.NtOpenFile
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x78], rax
lea rdx, str.NtOpenKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x80], rax
lea rdx, str.NtOpenKeyEx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x88], rax
lea rdx, str.NtOpenKeyTransacted
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x90], rax
lea rdx, str.NtOpenKeyTransactedEx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x98], rax
lea rdx, str.NtQueryDirectoryFile
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xa0], rax
lea rdx, str.NtQueryKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xa8], rax
lea rdx, str.NtQueryObject
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xb0], rax
lea rdx, str.NtQueryValueKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xb8], rax
lea rdx, str.NtSetValueKey
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xc0], rax
lea rdx, str.RtlInitUnicodeString
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xc8], rax
lea rdx, str.NtSetInformationObject
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xd0], rax
lea rdx, str.NtDeviceIoControlFile
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0xd8], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret