Function at 0x1401cfa68
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
xorps xmm0, xmm0
lea rax, [0x1406bedd8]
xorps xmm1, xmm1
mov qword [0x14070d400], rax
xor eax, eax
movdqa xmmword [0x14070d410], xmm0
lea rcx, [0x1406b6b10]
mov qword [0x14070d408], rax
mov qword [0x14070d448], rax
mov qword [0x14070d4a8], rax
mov qword [0x14070d4c0], rax
movdqa xmmword [0x14070d420], xmm1
movdqa xmmword [0x14070d430], xmm0
movdqa xmmword [0x14070d450], xmm1
movdqa xmmword [0x14070d460], xmm0
movdqa xmmword [0x14070d470], xmm1
movdqa xmmword [0x14070d480], xmm0
movdqa xmmword [0x14070d490], xmm1
movdqa xmmword [0x14070d4b0], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [0x14070d408], rax
lea rdx, str.NtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtCreateFile
mov qword [0x14070d410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtCreateKey
mov qword [0x14070d418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtCreateKeyTransacted
mov qword [0x14070d420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtCreateWnfStateName
mov qword [0x14070d428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtDeleteKey
mov qword [0x14070d430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtDeleteFile
mov qword [0x14070d438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtDeleteValueKey
mov qword [0x14070d440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtDeleteWnfStateName
mov qword [0x14070d448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtEnumerateKey
mov qword [0x14070d450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtEnumerateValueKey
mov qword [0x14070d458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtFlushKey
mov qword [0x14070d460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtNotifyChangeKey
mov qword [0x14070d468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtOpenFile
mov qword [0x14070d470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtOpenKey
mov qword [0x14070d478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14070d480], rax
mov rcx, qword [0x14070d408]
lea rdx, str.NtOpenKeyEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtOpenKeyTransacted
mov qword [0x14070d488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtOpenKeyTransactedEx
mov qword [0x14070d490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtQueryDirectoryFile
mov qword [0x14070d498], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtQueryKey
mov qword [0x14070d4a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtQueryObject
mov qword [0x14070d4a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtQueryValueKey
mov qword [0x14070d4b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtSetValueKey
mov qword [0x14070d4b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.RtlInitUnicodeString
mov qword [0x14070d4c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtSetInformationObject
mov qword [0x14070d4c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14070d408]
lea rdx, str.NtDeviceIoControlFile
mov qword [0x14070d4d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14070d4d8], rax
lea rax, [0x14070d400]
add rsp, 0x28
ret