Function at 0x1401b1d18
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rax, [0x14069fcc8]
mov qword [0x1406f7f40], rax
lea rcx, [0x1406974c8]
xor eax, eax
mov qword [0x1406f7f48], rax
mov qword [0x1406f7f50], rax
mov qword [0x1406f7f58], rax
mov qword [0x1406f7f60], rax
mov qword [0x1406f7f68], rax
mov qword [0x1406f7f70], rax
mov qword [0x1406f7f78], rax
mov qword [0x1406f7f88], rax
mov qword [0x1406f7f90], rax
mov qword [0x1406f7f98], rax
mov qword [0x1406f7fa0], rax
mov qword [0x1406f7fa8], rax
mov qword [0x1406f7fb0], rax
mov qword [0x1406f7fb8], rax
mov qword [0x1406f7fc0], rax
mov qword [0x1406f7fc8], rax
mov qword [0x1406f7fd0], rax
mov qword [0x1406f7fd8], rax
mov qword [0x1406f7fe8], rax
mov qword [0x1406f7ff0], rax
mov qword [0x1406f7ff8], rax
mov qword [0x1406f8000], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x1406f7f48], rax
lea rdx, str.NtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtCreateFile
mov qword [0x1406f7f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtCreateKey
mov qword [0x1406f7f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtCreateKeyTransacted
mov qword [0x1406f7f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtCreateWnfStateName
mov qword [0x1406f7f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtDeleteKey
mov qword [0x1406f7f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtDeleteFile
mov qword [0x1406f7f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtDeleteValueKey
mov qword [0x1406f7f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtDeleteWnfStateName
mov qword [0x1406f7f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtEnumerateKey
mov qword [0x1406f7f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtEnumerateValueKey
mov qword [0x1406f7f98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtFlushKey
mov qword [0x1406f7fa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtNotifyChangeKey
mov qword [0x1406f7fa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406f7fb0], rax
lea rdx, str.NtOpenFile
mov rcx, qword [0x1406f7f48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtOpenKey
mov qword [0x1406f7fb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtOpenKeyEx
mov qword [0x1406f7fc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtOpenKeyTransacted
mov qword [0x1406f7fc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtOpenKeyTransactedEx
mov qword [0x1406f7fd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1406f7fd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtQueryKey
mov qword [0x1406f7fe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtQueryObject
mov qword [0x1406f7fe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtQueryValueKey
mov qword [0x1406f7ff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtSetValueKey
mov qword [0x1406f7ff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.RtlInitUnicodeString
mov qword [0x1406f8000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtSetInformationObject
mov qword [0x1406f8008], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1406f7f48]
lea rdx, str.NtDeviceIoControlFile
mov qword [0x1406f8010], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406f8018], rax
lea rax, [0x1406f7f40]
add rsp, 0x28
ret