Function at 0x1800e1f20
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rdx, [0x1801c1708]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f930], rax
lea rdx, [0x1801c16f8]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f938], rax
lea rdx, [0x1801c16f0]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f940], rax
lea rdx, [0x1801c1830]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f948], rax
lea rdx, [0x1801c1820]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f950], rax
lea rdx, [0x1801c18b8]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f958], rax
lea rdx, [0x1801c1880]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f960], rax
lea rdx, [0x1801c1868]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f968], rax
lea rdx, [0x1801c18c8]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f970], rax
lea rdx, [0x1801c1850]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f978], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f980], rax
lea rdx, [0x1801c1840]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f988], rax
lea rdx, [0x1801c17f0]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f990], rax
lea rdx, str.NtDuplicateObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f998], rax
lea rdx, str.RtlInitializeCriticalSection
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9a0], rax
lea rdx, str.RtlDeleteCriticalSection
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9a8], rax
lea rdx, str.RtlEnterCriticalSection
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9b0], rax
lea rdx, str.RtlLeaveCriticalSection
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9b8], rax
lea rdx, str.RtlTryEnterCriticalSection
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9c0], rax
lea rdx, str.NtOpenDirectoryObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9c8], rax
lea rdx, str.NtQueryDirectoryObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9d0], rax
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9d8], rax
lea rdx, str.NtQuerySymbolicLinkObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9e0], rax
lea rdx, str.NtCreateKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9e8], rax
lea rdx, str.NtOpenKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9f0], rax
lea rdx, str.NtQueryKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f9f8], rax
lea rdx, str.NtQueryValueKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa00], rax
lea rdx, str.NtQueryMultipleValueKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa08], rax
lea rdx, str.NtEnumerateKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa10], rax
lea rdx, str.NtEnumerateValueKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa18], rax
lea rdx, str.NtFlushKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa20], rax
lea rdx, str.NtDeleteKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa28], rax
lea rdx, str.NtDeleteValueKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa30], rax
lea rdx, str.NtSetInformationKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa38], rax
lea rdx, str.NtSetValueKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa40], rax
lea rdx, str.NtNotifyChangeKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa48], rax
lea rdx, str.NtNotifyChangeMultipleKeys
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa50], rax
lea rdx, str.NtCreateProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa58], rax
lea rdx, str.NtCreateProcessEx
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa60], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa68], rax
lea rdx, str.NtTerminateProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa70], rax
lea rdx, str.LdrShutdownProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa78], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa80], rax
lea rdx, str.NtSetInformationProcess
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa88], rax
lea rdx, str.NtCreateThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa90], rax
lea rdx, str.NtOpenThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fa98], rax
lea rdx, str.NtSuspendThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023faa0], rax
lea rdx, str.NtResumeThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023faa8], rax
lea rdx, str.NtTerminateThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fab0], rax
lea rdx, str.LdrShutdownThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fab8], rax
lea rdx, str.NtQueryInformationThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fac0], rax
lea rdx, str.NtSetInformationThread
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fac8], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fad0], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fad8], rax
lea rdx, str.RtlDosPathNameToNtPathName_U
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fae0], rax
lea rdx, [0x1801c18e0]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fae8], rax
lea rdx, [0x1801c18f8]
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023faf0], rax
lea rdx, str.RtlConvertSidToUnicodeString
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023faf8], rax
lea rdx, str.RtlCreateSecurityDescriptor
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb00], rax
lea rdx, str.RtlSetDaclSecurityDescriptor
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb08], rax
lea rdx, str.RtlInitializeSid
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb10], rax
lea rdx, str.RtlSubAuthoritySid
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb18], rax
lea rdx, str.RtlCreateAcl
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb20], rax
lea rdx, str.RtlAddAccessAllowedAceEx
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb28], rax
lea rdx, str.RtlGetCurrentDirectory_U
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb30], rax
lea rdx, str.RtlSetCurrentDirectory_U
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb38], rax
lea rdx, str.RtlGetFullPathName_U
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb40], rax
lea rdx, str.RtlFormatCurrentUserKeyPath
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb48], rax
lea rdx, str.NtRenameKey
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb50], rax
lea rdx, str.NtCreateDirectoryObject
mov rcx, qword [0x18023fb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023fb58], rax
add rsp, 0x28
ret