Function at 0x180044390
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1800b0288]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtOpenFile
mov qword [0x1800b0078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtClose
mov qword [0x1800b0080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtReadFile
mov qword [0x1800b0088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtWriteFile
mov qword [0x1800b0090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryObject
mov qword [0x1800b0098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1800b00a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryInformationFile
mov qword [0x1800b00a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSetInformationFile
mov qword [0x1800b00b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQuerySystemInformation
mov qword [0x1800b00b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtDeleteFile
mov qword [0x1800b00c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x1800b00c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtDuplicateObject
mov qword [0x1800b00d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x1800b00d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x1800b00e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x1800b00e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x1800b00f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x1800b00f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x1800b0100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x1800b0108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x1800b0110], rax
mov rcx, qword [0x1800b0288]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x1800b0118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtCreateKey
mov qword [0x1800b0120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtOpenKey
mov qword [0x1800b0128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryKey
mov qword [0x1800b0130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryValueKey
mov qword [0x1800b0138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x1800b0140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtEnumerateKey
mov qword [0x1800b0148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtEnumerateValueKey
mov qword [0x1800b0150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtFlushKey
mov qword [0x1800b0158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtDeleteKey
mov qword [0x1800b0160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSetInformationKey
mov qword [0x1800b0168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSetValueKey
mov qword [0x1800b0170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtNotifyChangeKey
mov qword [0x1800b0178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x1800b0180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtCreateProcess
mov qword [0x1800b0188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtCreateProcessEx
mov qword [0x1800b0190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtOpenProcess
mov qword [0x1800b0198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtTerminateProcess
mov qword [0x1800b01a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.LdrShutdownProcess
mov qword [0x1800b01a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
mov qword [0x1800b01b0], rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSetInformationProcess
mov qword [0x1800b01b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtCreateThread
mov qword [0x1800b01c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtOpenThread
mov qword [0x1800b01c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSuspendThread
mov qword [0x1800b01d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtResumeThread
mov qword [0x1800b01d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtTerminateThread
mov qword [0x1800b01e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.LdrShutdownThread
mov qword [0x1800b01e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryInformationThread
mov qword [0x1800b01f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtSetInformationThread
mov qword [0x1800b01f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlInitUnicodeString
mov qword [0x1800b0200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x1800b0208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x1800b0210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryAttributesFile
mov qword [0x1800b0218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x1800b0220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x1800b0228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x1800b0230], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x1800b0238], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlInitializeSid
mov qword [0x1800b0240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x1800b0248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlCreateAcl
mov qword [0x1800b0250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x1800b0258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x1800b0260], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x1800b0268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x1800b0270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800b0288]
lea rdx, str.NtDeleteValueKey
mov qword [0x1800b0278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b0280], rax
add rsp, 0x28
ret