Function at 0x1800697f0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenFile
mov qword [0x1800ade60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtClose
mov qword [0x1800ade68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtReadFile
mov qword [0x1800ade70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtWriteFile
mov qword [0x1800ade78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryObject
mov qword [0x1800ade80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1800ade88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryDirectoryFileEx
mov qword [0x1800ade90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryInformationFile
mov qword [0x1800ade98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSetInformationFile
mov qword [0x1800adea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQuerySystemInformation
mov qword [0x1800adea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtDeleteFile
mov qword [0x1800adeb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x1800adeb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtDuplicateObject
mov qword [0x1800adec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x1800adec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x1800aded0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x1800aded8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x1800adee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x1800adee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x1800adef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x1800adef8], rax
mov rcx, qword [0x1800ae098]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x1800adf00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x1800adf08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateKey
mov qword [0x1800adf10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenKey
mov qword [0x1800adf18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryKey
mov qword [0x1800adf20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryValueKey
mov qword [0x1800adf28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x1800adf30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtEnumerateKey
mov qword [0x1800adf38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtEnumerateValueKey
mov qword [0x1800adf40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtFlushKey
mov qword [0x1800adf48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtDeleteKey
mov qword [0x1800adf50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtDeleteValueKey
mov qword [0x1800adf58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSetInformationKey
mov qword [0x1800adf60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSetValueKey
mov qword [0x1800adf68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtNotifyChangeKey
mov qword [0x1800adf70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x1800adf78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateProcess
mov qword [0x1800adf80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateProcessEx
mov qword [0x1800adf88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenProcess
mov qword [0x1800adf90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
mov qword [0x1800adf98], rax
lea rdx, str.NtTerminateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.LdrShutdownProcess
mov qword [0x1800adfa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryInformationProcess
mov qword [0x1800adfa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSetInformationProcess
mov qword [0x1800adfb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateThread
mov qword [0x1800adfb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtOpenThread
mov qword [0x1800adfc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSuspendThread
mov qword [0x1800adfc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtResumeThread
mov qword [0x1800adfd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtTerminateThread
mov qword [0x1800adfd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.LdrShutdownThread
mov qword [0x1800adfe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryInformationThread
mov qword [0x1800adfe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtSetInformationThread
mov qword [0x1800adff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlInitUnicodeString
mov qword [0x1800adff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x1800ae000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x1800ae008], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryAttributesFile
mov qword [0x1800ae010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x1800ae018], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x1800ae020], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x1800ae028], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x1800ae030], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlInitializeSid
mov qword [0x1800ae038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x1800ae040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlCreateAcl
mov qword [0x1800ae048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x1800ae050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x1800ae058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x1800ae060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x1800ae068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x1800ae070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtRenameKey
mov qword [0x1800ae078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateDirectoryObject
mov qword [0x1800ae080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800ae098]
lea rdx, str.NtCreateToken
mov qword [0x1800ae088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800ae090], rax
add rsp, 0x28
ret