Function at 0x180064980
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenFile
mov qword [0x1800f03f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtClose
mov qword [0x1800f03f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtReadFile
mov qword [0x1800f0400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtWriteFile
mov qword [0x1800f0408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryObject
mov qword [0x1800f0410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x1800f0418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryDirectoryFileEx
mov qword [0x1800f0420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryInformationFile
mov qword [0x1800f0428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSetInformationFile
mov qword [0x1800f0430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQuerySystemInformation
mov qword [0x1800f0438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtDeleteFile
mov qword [0x1800f0440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryVolumeInformationFile
mov qword [0x1800f0448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtDuplicateObject
mov qword [0x1800f0450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlInitializeCriticalSection
mov qword [0x1800f0458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlDeleteCriticalSection
mov qword [0x1800f0460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlEnterCriticalSection
mov qword [0x1800f0468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlLeaveCriticalSection
mov qword [0x1800f0470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlTryEnterCriticalSection
mov qword [0x1800f0478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenDirectoryObject
mov qword [0x1800f0480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryDirectoryObject
mov qword [0x1800f0488], rax
mov rcx, qword [0x1800f0628]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenSymbolicLinkObject
mov qword [0x1800f0490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQuerySymbolicLinkObject
mov qword [0x1800f0498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateKey
mov qword [0x1800f04a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenKey
mov qword [0x1800f04a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryKey
mov qword [0x1800f04b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryValueKey
mov qword [0x1800f04b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryMultipleValueKey
mov qword [0x1800f04c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtEnumerateKey
mov qword [0x1800f04c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtEnumerateValueKey
mov qword [0x1800f04d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtFlushKey
mov qword [0x1800f04d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtDeleteKey
mov qword [0x1800f04e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtDeleteValueKey
mov qword [0x1800f04e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSetInformationKey
mov qword [0x1800f04f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSetValueKey
mov qword [0x1800f04f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtNotifyChangeKey
mov qword [0x1800f0500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtNotifyChangeMultipleKeys
mov qword [0x1800f0508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateProcess
mov qword [0x1800f0510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateProcessEx
mov qword [0x1800f0518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenProcess
mov qword [0x1800f0520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
mov qword [0x1800f0528], rax
lea rdx, str.NtTerminateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.LdrShutdownProcess
mov qword [0x1800f0530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryInformationProcess
mov qword [0x1800f0538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSetInformationProcess
mov qword [0x1800f0540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateThread
mov qword [0x1800f0548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtOpenThread
mov qword [0x1800f0550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSuspendThread
mov qword [0x1800f0558], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtResumeThread
mov qword [0x1800f0560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtTerminateThread
mov qword [0x1800f0568], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.LdrShutdownThread
mov qword [0x1800f0570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryInformationThread
mov qword [0x1800f0578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtSetInformationThread
mov qword [0x1800f0580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlInitUnicodeString
mov qword [0x1800f0588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlFreeUnicodeString
mov qword [0x1800f0590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlDosPathNameToNtPathName_U
mov qword [0x1800f0598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryAttributesFile
mov qword [0x1800f05a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtQueryFullAttributesFile
mov qword [0x1800f05a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlConvertSidToUnicodeString
mov qword [0x1800f05b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlCreateSecurityDescriptor
mov qword [0x1800f05b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlSetDaclSecurityDescriptor
mov qword [0x1800f05c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlInitializeSid
mov qword [0x1800f05c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlSubAuthoritySid
mov qword [0x1800f05d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlCreateAcl
mov qword [0x1800f05d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlAddAccessAllowedAceEx
mov qword [0x1800f05e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlGetCurrentDirectory_U
mov qword [0x1800f05e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlSetCurrentDirectory_U
mov qword [0x1800f05f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlGetFullPathName_U
mov qword [0x1800f05f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.RtlFormatCurrentUserKeyPath
mov qword [0x1800f0600], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtRenameKey
mov qword [0x1800f0608], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateDirectoryObject
mov qword [0x1800f0610], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1800f0628]
lea rdx, str.NtCreateToken
mov qword [0x1800f0618], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800f0620], rax
add rsp, 0x28
ret