Function at 0x18010bd50
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtOpenFile
mov qword [0x1801b1800], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtClose
mov qword [0x1801b1808], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtReadFile
mov qword [0x1801b1810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtWriteFile
mov qword [0x1801b1818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryObject
mov qword [0x1801b1820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1801b1828], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryInformationFile
mov qword [0x1801b1830], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSetInformationFile
mov qword [0x1801b1838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQuerySystemInformation
mov qword [0x1801b1840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtDeleteFile
mov qword [0x1801b1848], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x1801b1850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtDuplicateObject
mov qword [0x1801b1858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x1801b1860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x1801b1868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x1801b1870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x1801b1878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x1801b1880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x1801b1888], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x1801b1890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x1801b1898], rax
mov rcx, qword [0x1801b1a28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x1801b18a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateKey
mov qword [0x1801b18a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtOpenKey
mov qword [0x1801b18b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryKey
mov qword [0x1801b18b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryValueKey
mov qword [0x1801b18c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x1801b18c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtEnumerateKey
mov qword [0x1801b18d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtEnumerateValueKey
mov qword [0x1801b18d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtFlushKey
mov qword [0x1801b18e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtDeleteKey
mov qword [0x1801b18e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtDeleteValueKey
mov qword [0x1801b18f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSetInformationKey
mov qword [0x1801b18f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSetValueKey
mov qword [0x1801b1900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtNotifyChangeKey
mov qword [0x1801b1908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x1801b1910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateProcess
mov qword [0x1801b1918], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateProcessEx
mov qword [0x1801b1920], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtOpenProcess
mov qword [0x1801b1928], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtTerminateProcess
mov qword [0x1801b1930], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
mov qword [0x1801b1938], rax
lea rdx, str.LdrShutdownProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryInformationProcess
mov qword [0x1801b1940], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSetInformationProcess
mov qword [0x1801b1948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateThread
mov qword [0x1801b1950], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtOpenThread
mov qword [0x1801b1958], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSuspendThread
mov qword [0x1801b1960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtResumeThread
mov qword [0x1801b1968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtTerminateThread
mov qword [0x1801b1970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.LdrShutdownThread
mov qword [0x1801b1978], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryInformationThread
mov qword [0x1801b1980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtSetInformationThread
mov qword [0x1801b1988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlInitUnicodeString
mov qword [0x1801b1990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x1801b1998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x1801b19a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryAttributesFile
mov qword [0x1801b19a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x1801b19b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x1801b19b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x1801b19c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x1801b19c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlInitializeSid
mov qword [0x1801b19d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x1801b19d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlCreateAcl
mov qword [0x1801b19e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x1801b19e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x1801b19f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x1801b19f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x1801b1a00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x1801b1a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtRenameKey
mov qword [0x1801b1a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1801b1a28]
lea rdx, str.NtCreateDirectoryObject
mov qword [0x1801b1a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1801b1a20], rax
add rsp, 0x28
ret