Function at 0x180017160
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x18002af78]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtOpenFile
mov qword [0x18002ad50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtClose
mov qword [0x18002ad58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtReadFile
mov qword [0x18002ad60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtWriteFile
mov qword [0x18002ad68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryObject
mov qword [0x18002ad70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x18002ad78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryInformationFile
mov qword [0x18002ad80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSetInformationFile
mov qword [0x18002ad88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQuerySystemInformation
mov qword [0x18002ad90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtDeleteFile
mov qword [0x18002ad98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x18002ada0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtDuplicateObject
mov qword [0x18002ada8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x18002adb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x18002adb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x18002adc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x18002adc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x18002add0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x18002add8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x18002ade0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x18002ade8], rax
mov rcx, qword [0x18002af78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x18002adf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtCreateKey
mov qword [0x18002adf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtOpenKey
mov qword [0x18002ae00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryKey
mov qword [0x18002ae08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryValueKey
mov qword [0x18002ae10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x18002ae18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtEnumerateKey
mov qword [0x18002ae20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtEnumerateValueKey
mov qword [0x18002ae28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtFlushKey
mov qword [0x18002ae30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtDeleteKey
mov qword [0x18002ae38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtDeleteValueKey
mov qword [0x18002ae40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSetInformationKey
mov qword [0x18002ae48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSetValueKey
mov qword [0x18002ae50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtNotifyChangeKey
mov qword [0x18002ae58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x18002ae60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtCreateProcess
mov qword [0x18002ae68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtCreateProcessEx
mov qword [0x18002ae70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtOpenProcess
mov qword [0x18002ae78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtTerminateProcess
mov qword [0x18002ae80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
mov qword [0x18002ae88], rax
lea rdx, str.LdrShutdownProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryInformationProcess
mov qword [0x18002ae90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSetInformationProcess
mov qword [0x18002ae98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtCreateThread
mov qword [0x18002aea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtOpenThread
mov qword [0x18002aea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSuspendThread
mov qword [0x18002aeb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtResumeThread
mov qword [0x18002aeb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtTerminateThread
mov qword [0x18002aec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.LdrShutdownThread
mov qword [0x18002aec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryInformationThread
mov qword [0x18002aed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtSetInformationThread
mov qword [0x18002aed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlInitUnicodeString
mov qword [0x18002aee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x18002aee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x18002aef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryAttributesFile
mov qword [0x18002aef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x18002af00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x18002af08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x18002af10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x18002af18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlInitializeSid
mov qword [0x18002af20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x18002af28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlCreateAcl
mov qword [0x18002af30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x18002af38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x18002af40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x18002af48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x18002af50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x18002af58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, str.NtRenameKey
mov qword [0x18002af60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18002af78]
lea rdx, [0x180020d30]
mov qword [0x18002af68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002af70], rax
add rsp, 0x28
ret